chore: code cleanup

src/Controller/Traits/ConfirmedActionTrait.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Traits;
+
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * The POST half of a confirmation modal: its CSRF check, and where to go once it is confirmed.
+ */
+trait ConfirmedActionTrait
+{
+    /**
+     * Where to navigate after a confirmed action, or null when the caller is the board and wants
+     * its fragments swapped instead. The opener says which -- the admin screen sends
+     * ?return=admin so freeing somebody else's desk does not drop the administrator on their own
+     * bookings.
+     */
+    private function returnRoute(Request $request): ?string
+    {
+        return match ($request->query->get('return')) {
+            'admin' => 'app_admin_booking',
+            'bookings' => 'app_booking',
+            default => null,
+        };
+    }
+
+    private function denyUnlessCsrfValid(Request $request, string $tokenId): void
+    {
+        if (!$this->isCsrfTokenValid($tokenId, $request->request->getString('_token'))) {
+            throw $this->createAccessDeniedException('Invalid CSRF token.');
+        }
+    }
+}