habit-tracker/app/Controllers/AuthController.php

<?php

class AuthController
{
    public function showLogin(): void
    {
        View::render('auth/login', [
            'values' => ['email' => ''],
            'errors' => [],
        ]);
    }

    public function login(): void
    {
        verify_csrf_token();

        $email = $this->postString('email');
        $password = $this->postPassword();
        $errors = [];

        if (!filter_var($email, FILTER_VALIDATE_EMAIL) || mb_strlen($email) > 190) {
            $errors['email'] = 'Bitte gib eine gueltige E-Mail-Adresse ein.';
        }

        if ($password === '') {
            $errors['password'] = 'Bitte gib dein Passwort ein.';
        }

        if (!empty($errors)) {
            $this->renderLogin($email, $errors);
            return;
        }

        try {
            $user = User::findByEmail($email);
        } catch (PDOException $exception) {
            $this->renderLogin($email, ['form' => 'Die Anmeldung ist gerade nicht verfuegbar. Bitte versuche es spaeter erneut.']);
            return;
        }

        if (!$user || !password_verify($password, $user['password_hash'])) {
            $this->renderLogin($email, ['form' => 'E-Mail oder Passwort ist nicht korrekt.']);
            return;
        }

        session_regenerate_id(true);
        $_SESSION['user_id'] = (int) $user['id'];
        $_SESSION['user_name'] = $user['name'];
        unset($_SESSION['csrf_token']);
        redirect('dashboard');
    }

    public function showRegister(): void
    {
        View::render('auth/register', [
            'values' => ['name' => '', 'email' => ''],
            'errors' => [],
        ]);
    }

    public function register(): void
    {
        verify_csrf_token();

        $name = $this->postString('name');
        $email = $this->postString('email');
        $password = $this->postPassword();
        $errors = [];

        if ($name === '') {
            $errors['name'] = 'Bitte gib deinen Namen ein.';
        } elseif (mb_strlen($name) > 100) {
            $errors['name'] = 'Der Name darf maximal 100 Zeichen lang sein.';
        }

        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $errors['email'] = 'Bitte gib eine gueltige E-Mail-Adresse ein.';
        } elseif (mb_strlen($email) > 190) {
            $errors['email'] = 'Die E-Mail-Adresse darf maximal 190 Zeichen lang sein.';
        }

        if (strlen($password) < 8) {
            $errors['password'] = 'Das Passwort muss mindestens 8 Zeichen lang sein.';
        }

        if (!empty($errors)) {
            $this->renderRegister($name, $email, $errors);
            return;
        }

        try {
            if (User::findByEmail($email)) {
                $this->renderRegister($name, $email, ['email' => 'Diese E-Mail ist bereits registriert.']);
                return;
            }

            $created = User::create($name, $email, $password);
        } catch (PDOException $exception) {
            $this->renderRegister($name, $email, ['form' => 'Das Konto konnte nicht erstellt werden. Bitte versuche es spaeter erneut.']);
            return;
        }

        if (!$created) {
            $this->renderRegister($name, $email, ['form' => 'Das Konto konnte nicht erstellt werden. Bitte versuche es spaeter erneut.']);
            return;
        }

        flash('success', 'Registrierung erfolgreich. Du kannst dich jetzt anmelden.');
        redirect('login');
    }

    public function logout(): void
    {
        verify_csrf_token();

        $_SESSION = [];
        if (ini_get('session.use_cookies')) {
            $params = session_get_cookie_params();
            setcookie(session_name(), '', time() - 42000, $params['path'], $params['domain'], $params['secure'], $params['httponly']);
        }
        session_destroy();
        redirect('login');
    }

    private function renderLogin(string $email, array $errors): void
    {
        View::render('auth/login', [
            'values' => ['email' => $email],
            'errors' => $errors,
        ]);
    }

    private function renderRegister(string $name, string $email, array $errors): void
    {
        View::render('auth/register', [
            'values' => ['name' => $name, 'email' => $email],
            'errors' => $errors,
        ]);
    }

    private function postString(string $key): string
    {
        $value = $_POST[$key] ?? '';

        return is_string($value) ? trim($value) : '';
    }

    private function postPassword(): string
    {
        $value = $_POST['password'] ?? '';

        return is_string($value) ? $value : '';
    }
}