Small CRUD App With PDO

<?php

declare(strict_types=1);

function openDatabase(string $path): PDO
{
    $pdo = new PDO('sqlite:' . $path, null, null, [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_STRINGIFY_FETCHES => false,
    ]);
    $pdo->exec('PRAGMA foreign_keys = ON');

    return $pdo;
}

<?php

declare(strict_types=1);

// no-execute: creates the project database and requires local project files.
require dirname(__DIR__) . '/src/Database.php';

$pdo = openDatabase(dirname(__DIR__) . '/storage/app.sqlite');
$sql = file_get_contents(dirname(__DIR__) . '/migrations/001_create_products.sql');
if ($sql === false) {
    throw new RuntimeException('Migration could not be read.');
}
$pdo->exec($sql);
echo "Migration applied.\n";

<?php

declare(strict_types=1);

final class ProductRepository
{
    public function __construct(private PDO $pdo) {}

    public function page(int $limit, int $offset): array
    {
        $statement = $this->pdo->prepare(
            'SELECT id, name, price_cents, status
             FROM products ORDER BY id DESC LIMIT :limit OFFSET :offset'
        );
        $statement->bindValue(':limit', $limit, PDO::PARAM_INT);
        $statement->bindValue(':offset', $offset, PDO::PARAM_INT);
        $statement->execute();

        return $statement->fetchAll();
    }

    public function find(int $id): ?array
    {
        $statement = $this->pdo->prepare(
            'SELECT id, name, price_cents, status FROM products WHERE id = :id'
        );
        $statement->execute(['id' => $id]);
        $row = $statement->fetch();

        return $row === false ? null : $row;
    }

    public function insert(string $name, int $priceCents, string $status): int
    {
        $statement = $this->pdo->prepare(
            'INSERT INTO products (name, price_cents, status)
             VALUES (:name, :price_cents, :status)'
        );
        $statement->execute([
            'name' => $name,
            'price_cents' => $priceCents,
            'status' => $status,
        ]);

        $id = $this->pdo->lastInsertId();
        if ($id === false) {
            throw new RuntimeException('Inserted product ID was unavailable.');
        }

        return (int) $id;
    }

    public function update(int $id, string $name, int $priceCents, string $status): bool
    {
        $statement = $this->pdo->prepare(
            'UPDATE products
             SET name = :name, price_cents = :price_cents, status = :status
             WHERE id = :id'
        );
        $statement->execute([
            'id' => $id,
            'name' => $name,
            'price_cents' => $priceCents,
            'status' => $status,
        ]);

        return $statement->rowCount() === 1;
    }

    public function delete(int $id): bool
    {
        $statement = $this->pdo->prepare('DELETE FROM products WHERE id = :id');
        $statement->execute(['id' => $id]);

        return $statement->rowCount() === 1;
    }
}

<?php

declare(strict_types=1);

function parsePriceCents(string $price): ?int
{
    if (preg_match('/\A(0|[1-9][0-9]*)(?:\.([0-9]{1,2}))?\z/', $price, $matches) !== 1) {
        return null;
    }

    $whole = (int) $matches[1];
    $fraction = str_pad($matches[2] ?? '', 2, '0');
    if ($whole > 999_999) {
        return null;
    }

    $cents = ($whole * 100) + (int) $fraction;

    return $cents <= 99_999_999 ? $cents : null;
}

function validateProduct(array $input): array
{
    $name = is_string($input['name'] ?? null) ? trim($input['name']) : '';
    $price = is_string($input['price'] ?? null) ? trim($input['price']) : '';
    $status = is_string($input['status'] ?? null) ? $input['status'] : '';
    $errors = [];

    if ($name === '' || strlen($name) > 100) {
        $errors['name'] = 'Enter a name up to 100 bytes.';
    }
    $priceCents = parsePriceCents($price);
    if ($priceCents === null) {
        $errors['price'] = 'Enter a price from 0.00 to 999999.99.';
    }
    if (!in_array($status, ['draft', 'published'], true)) {
        $errors['status'] = 'Choose draft or published.';
    }

    return [
        ['name' => $name, 'price' => $price, 'price_cents' => $priceCents, 'status' => $status],
        $errors,
    ];
}

<?php

declare(strict_types=1);

// no-execute: requires the project bootstrap, active session, and HTTP request.
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
    header('Allow: POST');
    http_response_code(405);
    exit('Method Not Allowed');
}

$token = $_POST['_csrf'] ?? null;
if (!is_string($token) || !hash_equals($_SESSION['csrf'], $token)) {
    http_response_code(403);
    exit('Invalid request token.');
}

[$values, $errors] = validateProduct($_POST);
if ($errors !== []) {
    http_response_code(422);
    require dirname(__DIR__) . '/templates/product-form.php';
    exit;
}

$id = $repository->insert($values['name'], $values['price_cents'], $values['status']);
header('Location: /product-edit.php?id=' . $id, true, 303);
exit;