Add a custom failure handler feature

src/CsrfMiddleware.php

@@ -4,6 +4,7 @@
 
 namespace Yiisoft\Csrf;
 
+use Closure;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
@@ -30,24 +31,37 @@ final class CsrfMiddleware implements MiddlewareInterface
 
     private ResponseFactoryInterface $responseFactory;
     private CsrfTokenInterface $token;
+    private ?Closure $failureHandler;
 
     public function __construct(
         ResponseFactoryInterface $responseFactory,
-        CsrfTokenInterface $token
+        CsrfTokenInterface $token,
+        ?Closure $failureHandler = null
     ) {
         $this->responseFactory = $responseFactory;
         $this->token = $token;
+        $this->failureHandler = $failureHandler;
     }
 
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
         if (!$this->validateCsrfToken($request)) {
+            return $this->handleFailure();
+        }
+
+        return $handler->handle($request);
+    }
+
+    private function handleFailure(): ResponseInterface
+    {
+        if (is_null($handler = $this->failureHandler)) {
             $response = $this->responseFactory->createResponse(Status::UNPROCESSABLE_ENTITY);
             $response->getBody()->write(Status::TEXTS[Status::UNPROCESSABLE_ENTITY]);
             return $response;
         }
 
-        return $handler->handle($request);
+        /** @var Closure():ResponseInterface $handler */
+        return $handler();
     }
 
     public function withParameterName(string $name): self

tests/TokenCsrfMiddlewareTest.php

@@ -4,6 +4,7 @@
 
 namespace Yiisoft\Csrf\Tests;
 
+use Closure;
 use Nyholm\Psr7\Factory\Psr17Factory;
 use Nyholm\Psr7\Response;
 use Nyholm\Psr7\ServerRequest;
@@ -98,6 +99,25 @@ public function testInvalidTokenResultIn422(): void
         $this->assertEquals(Status::UNPROCESSABLE_ENTITY, $response->getStatusCode());
     }
 
+    public function testInvalidTokenResultWithCustomFailureHandler(): void
+    {
+        $failureHandler = function () {
+            $response = new Response(Status::BAD_REQUEST);
+            $response->getBody()->write(Status::TEXTS[Status::BAD_REQUEST]);
+            return $response;
+        };
+
+        $middleware = $this->createCsrfMiddleware(null, $failureHandler);
+
+        $response = $middleware->process(
+            $this->createPostServerRequestWithBodyToken(Random::string()),
+            $this->createRequestHandler()
+        );
+
+        $this->assertEquals(Status::TEXTS[Status::BAD_REQUEST], $response->getBody());
+        $this->assertEquals(Status::BAD_REQUEST, $response->getStatusCode());
+    }
+
     public function testEmptyTokenInRequestResultIn422(): void
     {
         $middleware = $this->createCsrfMiddleware();
@@ -155,12 +175,15 @@ private function getBodyRequestParamsByToken(string $token): array
         ];
     }
 
-    protected function createCsrfMiddleware(?CsrfTokenInterface $csrfToken = null): CsrfMiddleware
-    {
+    protected function createCsrfMiddleware(
+        ?CsrfTokenInterface $csrfToken = null,
+        ?Closure $failureHandler = null
+    ): CsrfMiddleware {
+
         $csrfToken = new MaskedCsrfToken($csrfToken ?? $this->createCsrfToken());
         $this->token = $csrfToken->getValue();
 
-        $middleware = new CsrfMiddleware(new Psr17Factory(), $csrfToken);
+        $middleware = new CsrfMiddleware(new Psr17Factory(), $csrfToken, $failureHandler);
 
         return $middleware->withParameterName(self::PARAM_NAME);
     }