Validate API request security results before dispatch

FoodScanAppService.php

@@ -20,8 +20,13 @@
 require 'src/PdoFunctions.php';
 
 $postBody = file_get_contents('php://input');
-$postBody = iconv('UTF-8', 'UTF-8//IGNORE', utf8_encode($postBody));
 $postData = json_decode($postBody);
+if (json_last_error() !== JSON_ERROR_NONE || !is_object($postData)) {
+    http_response_code(400);
+    header('Content-type: application/json');
+    echo json_encode(['status' => FAILED, 'message' => 'Request body must be a valid JSON object.']);
+    exit;
+}
 
 $logger = new Logger();
 if (DEBUG_MODE) {
@@ -58,17 +63,24 @@
             $secret_key = addslashes($secret_key);
 
             $isSecure = (new Security($db))->checkForSecurityNew($access_key, $secret_key);
-            $isSecure = YES;
             if ($isSecure === NO) {
                 $data['status'] = FAILED;
                 $data['message'] = MALICIOUS_SOURCE;
             } elseif ($isSecure === ERROR) {
                 $data['status'] = FAILED;
                 $data['message'] = TOKEN_ERROR;
+            } elseif ($isSecure !== YES && !(
+                is_array($isSecure)
+                && in_array($isSecure['key'] ?? null, ['Temp', 'User'], true)
+                && is_string($isSecure['value'] ?? null)
+                && $isSecure['value'] !== ''
+            )) {
+                $data['status'] = FAILED;
+                $data['message'] = TOKEN_ERROR;
             } else {
                 $user = new User($db);
                 $data = $user->callService($_REQUEST['Service'], $postData);
-                if ($isSecure !== YES || $isSecure !== YES) {
+                if (is_array($isSecure)) {
                     if ($isSecure['key'] == 'Temp') {
                         $data['TempToken'] = $isSecure['value'];
                     } else {
@@ -97,18 +109,25 @@
             $secret_key = addslashes($secret_key);
 
             $isSecure = (new Security($db))->checkForSecurityNew($access_key, $secret_key);
-            $isSecure = YES;
 
             if ($isSecure === NO) {
                 $data['status'] = FAILED;
                 $data['message'] = MALICIOUS_SOURCE;
             } elseif ($isSecure === ERROR) {
                 $data['status'] = FAILED;
                 $data['message'] = TOKEN_ERROR;
+            } elseif ($isSecure !== YES && !(
+                is_array($isSecure)
+                && in_array($isSecure['key'] ?? null, ['Temp', 'User'], true)
+                && is_string($isSecure['value'] ?? null)
+                && $isSecure['value'] !== ''
+            )) {
+                $data['status'] = FAILED;
+                $data['message'] = TOKEN_ERROR;
             } else {
                 $product = new Product($db);
                 $data = $product->callService($_REQUEST['Service'], $postData);
-                if ($isSecure !== YES || $isSecure !== YES) {
+                if (is_array($isSecure)) {
                     if ($isSecure['key'] === 'Temp') {
                         $data['TempToken'] = $isSecure['value'];
                     } else {

README.md

@@ -40,3 +40,18 @@ The index file to be called for requesting the API is `FoodScanAppService.php`.
 <!-- GitHub's Markdown reference links -->
 [twitter-image]: https://img.shields.io/badge/Twitter-1DA1F2?style=for-the-badge&logo=twitter&logoColor=white
 [github-image]: https://img.shields.io/badge/GitHub-100000?style=for-the-badge&logo=github&logoColor=white
+
+## Offline validation and deployment limitations
+
+Run `php tests/request-dispatch.php` to exercise the real entrypoint routing with
+offline database/security/service doubles. This checks failed authentication,
+token response handling, malformed JSON, and UTF-8 preservation without credentials.
+Run `composer validate --no-check-publish` and `composer audit --locked` for the
+dependency contract. Composer resolves against PHP 7.4; the tests also run on PHP 8.5.
+The original project's licence metadata still needs clarification.
+
+These checks do not validate a live database, mobile-client compatibility or
+provider calls. The legacy token protocol still requires a dedicated review of
+account ownership, token expiry, recovery endpoints and shared-secret handling
+before this API is suitable for production deployment. Request routing fixes alone
+do not establish complete authentication or authorisation.

composer.json

@@ -24,5 +24,10 @@
   },
   "require-dev": {
     "phpunit/phpunit": "^9.5"
+  },
+  "config": {
+    "platform": {
+      "php": "7.4.0"
+    }
   }
 }