Routing & Parameter Injection

<?php
use ZealPHP\RequestContext;

$g = RequestContext::instance();
session_start();
if (empty($g->session['user'])) { header('Location: /login'); exit; }
?>
<h1>Welcome, <?= htmlspecialchars($g->session['user']['name']) ?></h1>
<p>Your orders: <?= count($g->get['filter'] ?? []) ?> filters active</p>

<?php
$list = function () {
    $this->response($this->json(['devices' => []]), 200);
};

// Two-arg shorthand — GET only:
$app->route('/hello/{name}', fn($name) => "Hi {$name}");

// Array options (backward-compatible):
$app->route('/users', ['methods' => ['GET', 'POST']], $handler);

// Named arguments — same result:
$app->route('/users', $handler, methods: ['GET', 'POST']);

// raw: skip output buffering for a hand-rolled streaming writer:
$app->route('/export.csv', function($response) {
    $response->stream(fn($write) => $write("id,name\n"));
}, methods: ['GET'], raw: true);

use ZealPHP\Middleware\{RequestIdMiddleware, IpAccessMiddleware};

// Mix alias strings with a live instance:
$app->route('/admin/users', fn() => User::all(), methods: ['GET'],
    middleware: ['auth', 'request-id', new IpAccessMiddleware(['allow' => ['10.0.0.0/8']])]);

// Same option on nsRoute / nsPathRoute / patternRoute:
$app->nsRoute('api', '/jobs', $list, middleware: ['request-id']);

// Array-option form — entries here run OUTSIDE the named-arg ones:
$app->route('/report', ['middleware' => ['auth']], $handler, middleware: ['request-id']);
// chain: auth (outer) -> request-id -> handler

use ZealPHP\Middleware\{BasicAuthMiddleware, IpAccessMiddleware, RateLimitMiddleware, RequestIdMiddleware};

App::middlewareAlias('auth',       fn() => new BasicAuthMiddleware($verifier));
App::middlewareAlias('admin-only', new IpAccessMiddleware(['allow' => ['10.0.0.0/8']]));
App::middlewareAlias('request-id', fn() => new RequestIdMiddleware());

// Parameterised reference: 'throttle:120' calls the factory with the
// comma-split args, e.g. fn('120') — mirrors Laravel 'throttle:60,1'.
App::middlewareAlias('throttle', fn($n = '60') => new RateLimitMiddleware(limit: (int)$n));

$app->route('/admin/users', $fn, middleware: ['auth', 'admin-only', 'throttle:120']);

$app->group('/admin', ['auth', 'admin-only'], function ($g) {
    $g->route('/users',    fn() => User::all());       // /admin/users
    $g->route('/settings', fn() => Settings::get());   // /admin/settings

    $g->group('/audit', ['audit-log'], function ($g) { // nests the prefix + middleware
        $g->route('/recent', fn() => Audit::recent()); // /admin/audit/recent
        // chain: auth -> admin-only -> audit-log -> handler
    });
});

// Middleware is optional — pass just a prefix and a registrar:
$app->group('/v1', function ($g) {
    $g->route('/ping', fn() => 'pong');                // /v1/ping
});

use ZealPHP\App;
use ZealPHP\Middleware\{BasicAuthMiddleware, IpAccessMiddleware, RateLimitMiddleware, RequestIdMiddleware};

$app = App::instance();

// 1) Register reusable middleware by name.
App::middlewareAlias('request-id', fn() => new RequestIdMiddleware());
App::middlewareAlias('auth',       fn() => new BasicAuthMiddleware($verifier));
App::middlewareAlias('throttle',   fn($n = '60') => new RateLimitMiddleware(limit: (int)$n));

// 2) request-id on every request, globally (outermost of all).
$app->addMiddleware(new RequestIdMiddleware());

// 3) The whole /admin area is auth-gated and IP-restricted.
$app->group('/admin', ['auth', new IpAccessMiddleware(['allow' => ['10.0.0.0/8']])], function ($g) {
    $g->route('/users', fn() => User::all());                       // auth -> ip -> handler

    // 4) One route gets an extra, tighter rate limit on top of the group chain.
    $g->route('/export', fn() => Report::export(), methods: ['POST'], middleware: ['throttle:30']);                         // auth -> ip -> throttle:30 -> handler
});

$app->run();

// Match any URL starting with /raw/
$app->patternRoute('/raw/(?P<rest>.*)', ['methods' => ['GET']], function($rest) {
    echo "You requested: $rest";
    return 202;
});

// Multiple groups
$app->patternRoute('/blog/(?P<year>\d{4})/(?P<slug>[a-z-]+)', function($year, $slug) {
    return ['year' => $year, 'slug' => $slug];
});

// Block .php extension entirely
$app->patternRoute('/.*\.php', ['methods' => ['GET', 'POST']], function($response) {
    $response->status(403);
    $response->write("403 Forbidden");
});