Add rector and phpstan

- Applied `#[IsCsrfTokenValid]` attribute for CSRF checks to simplify and standardize validation.
- Removed manual `isCsrfTokenValid` calls and associated exception throwing.
- Updated method signatures across affected endpoints to remove unnecessary `Request` dependency.
- Ensured consistency in route HTTP method restrictions where applicable.

.github/workflows/ci.yml

@@ -48,6 +48,10 @@ jobs:
         run: docker compose exec -T php vendor/bin/php-cs-fixer check --diff --show-progress=none
       - name: Twig Coding Style
         run: docker compose exec -T php vendor/bin/twig-cs-fixer check
+      - name: Static Analysis (PHPStan)
+        run: docker compose exec -T php vendor/bin/phpstan analyse --no-progress --no-ansi
+      - name: Rector
+        run: docker compose exec -T php vendor/bin/rector process --dry-run
       - name: Check HTTP reachability
         run: curl -v --fail-with-body http://localhost
       - name: Check Mercure reachability

.idea/TijdVoorDeTest.iml

@@ -166,6 +166,7 @@
       <excludeFolder url="file://$MODULE_DIR$/vendor/gedmo/doctrine-extensions" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/stof/doctrine-extensions-bundle" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/git-state" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/ergebnis/agent-detector" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />

.idea/php.xml

@@ -203,6 +203,7 @@
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php84" />
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php85" />
       <path value="$PROJECT_DIR$/vendor/sebastian/git-state" />
+      <path value="$PROJECT_DIR$/vendor/ergebnis/agent-detector" />
     </include_path>
   </component>
   <component name="PhpInterpreters">

composer.json

@@ -40,7 +40,7 @@
         "symfony/ux-turbo": "^2.35.0",
         "symfony/validator": "8.0.*",
         "symfony/yaml": "8.0.*",
-        "symfonycasts/sass-bundle": "^0.9",
+        "symfonycasts/sass-bundle": "^0.10",
         "symfonycasts/verify-email-bundle": "^1.18.0",
         "thecodingmachine/safe": "^3.4.0",
         "twig/extra-bundle": "^3.24.0",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "cccceca487b3bce45a81110944723fd4",
+    "content-hash": "05cf0154674041e04c48a37f5d7c9b42",
     "packages": [
         {
             "name": "composer/pcre",
@@ -1041,16 +1041,16 @@
         },
         {
             "name": "doctrine/orm",
-            "version": "3.6.2",
+            "version": "3.6.6",
             "source": {
                 "type": "git",
                 "url": "https://github.com/doctrine/orm.git",
-                "reference": "4262eb495b4d2a53b45de1ac58881e0091f2970f"
+                "reference": "471b12949ff9bc23ecdc809ce838613c1aa9a0b9"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/doctrine/orm/zipball/4262eb495b4d2a53b45de1ac58881e0091f2970f",
+                "url": "https://api.github.com/repos/doctrine/orm/zipball/471b12949ff9bc23ecdc809ce838613c1aa9a0b9",
-                "reference": "4262eb495b4d2a53b45de1ac58881e0091f2970f",
+                "reference": "471b12949ff9bc23ecdc809ce838613c1aa9a0b9",
                 "shasum": ""
             },
             "require": {
@@ -1123,9 +1123,9 @@
             ],
             "support": {
                 "issues": "https://github.com/doctrine/orm/issues",
-                "source": "https://github.com/doctrine/orm/tree/3.6.2"
+                "source": "https://github.com/doctrine/orm/tree/3.6.6"
             },
-            "time": "2026-01-30T21:41:41+00:00"
+            "time": "2026-05-21T06:05:47+00:00"
         },
         {
             "name": "doctrine/persistence",
@@ -1477,16 +1477,16 @@
         },
         {
             "name": "guzzlehttp/psr7",
-            "version": "2.9.0",
+            "version": "2.10.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/psr7.git",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884"
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/7d0ed42f28e42d61352a7a79de682e5e67fec884",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/73ab136360b5dfd858006eae9795e8fe43c80361",
-                "reference": "7d0ed42f28e42d61352a7a79de682e5e67fec884",
+                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361",
                 "shasum": ""
             },
             "require": {
@@ -1501,9 +1501,9 @@
             },
             "require-dev": {
                 "bamarni/composer-bin-plugin": "^1.8.2",
-                "http-interop/http-factory-tests": "0.9.0",
+                "http-interop/http-factory-tests": "1.1.0",
                 "jshttp/mime-db": "1.54.0.1",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25"
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34"
             },
             "suggest": {
                 "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
@@ -1574,7 +1574,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/2.9.0"
+                "source": "https://github.com/guzzle/psr7/tree/2.10.1"
             },
             "funding": [
                 {
@@ -1590,7 +1590,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-03-10T16:41:02+00:00"
+            "time": "2026-05-20T09:27:36+00:00"
         },
         {
             "name": "jean85/pretty-package-versions",
@@ -1839,16 +1839,16 @@
         },
         {
             "name": "martin-georgiev/postgresql-for-doctrine",
-            "version": "v4.4.0",
+            "version": "v4.5.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/martin-georgiev/postgresql-for-doctrine.git",
-                "reference": "cba0aaccc746ba2aefedc33c277b482e2ce139a0"
+                "reference": "98154bfecbb0d4d84386eec0ec5c0818280efa94"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/martin-georgiev/postgresql-for-doctrine/zipball/cba0aaccc746ba2aefedc33c277b482e2ce139a0",
+                "url": "https://api.github.com/repos/martin-georgiev/postgresql-for-doctrine/zipball/98154bfecbb0d4d84386eec0ec5c0818280efa94",
-                "reference": "cba0aaccc746ba2aefedc33c277b482e2ce139a0",
+                "reference": "98154bfecbb0d4d84386eec0ec5c0818280efa94",
                 "shasum": ""
             },
             "require": {
@@ -1864,12 +1864,12 @@
                 "doctrine/orm": "~2.14||~3.0",
                 "ekino/phpstan-banned-code": "^3.2.0",
                 "friendsofphp/php-cs-fixer": "^3.94.2",
-                "phpstan/phpstan": "^2.1.40",
+                "phpstan/phpstan": "^2.1.46",
                 "phpstan/phpstan-deprecation-rules": "^2.0.4",
                 "phpstan/phpstan-doctrine": "^2.0.20",
                 "phpstan/phpstan-phpunit": "^2.0.16",
                 "phpunit/phpunit": "^10.5.63||^11.5",
-                "rector/rector": "^2.3.8",
+                "rector/rector": "^2.4.1",
                 "symfony/cache": "^6.4||^7.0",
                 "symfony/var-exporter": "^6.4||^7.0"
             },
@@ -1924,6 +1924,7 @@
                 "ltree",
                 "macaddr",
                 "martin-georgiev",
+                "math-functions",
                 "money",
                 "multirange",
                 "network-types",
@@ -1938,6 +1939,7 @@
                 "soundex",
                 "spatial",
                 "text-search",
+                "trigonometry",
                 "tsquery",
                 "tsvector",
                 "uuid",
@@ -1947,7 +1949,7 @@
             ],
             "support": {
                 "issues": "https://github.com/martin-georgiev/postgresql-for-doctrine/issues",
-                "source": "https://github.com/martin-georgiev/postgresql-for-doctrine/tree/v4.4.0"
+                "source": "https://github.com/martin-georgiev/postgresql-for-doctrine/tree/v4.5.1"
             },
             "funding": [
                 {
@@ -1959,7 +1961,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-03-21T18:11:34+00:00"
+            "time": "2026-04-19T11:31:03+00:00"
         },
         {
             "name": "phpdocumentor/reflection-common",
@@ -2748,16 +2750,16 @@
         },
         {
             "name": "sentry/sentry",
-            "version": "4.22.0",
+            "version": "4.27.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/getsentry/sentry-php.git",
-                "reference": "ce6ab95a7021f976a27b4628a4072e481c8acf60"
+                "reference": "1f0544cff8443ac1d25d6521487118e28381a1c2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/getsentry/sentry-php/zipball/ce6ab95a7021f976a27b4628a4072e481c8acf60",
+                "url": "https://api.github.com/repos/getsentry/sentry-php/zipball/1f0544cff8443ac1d25d6521487118e28381a1c2",
-                "reference": "ce6ab95a7021f976a27b4628a4072e481c8acf60",
+                "reference": "1f0544cff8443ac1d25d6521487118e28381a1c2",
                 "shasum": ""
             },
             "require": {
@@ -2774,19 +2776,23 @@
                 "raven/raven": "*"
             },
             "require-dev": {
+                "carthage-software/mago": "^1.13.3",
                 "friendsofphp/php-cs-fixer": "^3.4",
                 "guzzlehttp/promises": "^2.0.3",
                 "guzzlehttp/psr7": "^1.8.4|^2.1.1",
                 "monolog/monolog": "^1.6|^2.0|^3.0",
                 "nyholm/psr7": "^1.8",
+                "open-telemetry/api": "^1.0",
+                "open-telemetry/exporter-otlp": "^1.0",
+                "open-telemetry/sdk": "^1.0",
                 "phpbench/phpbench": "^1.0",
                 "phpstan/phpstan": "^1.3",
                 "phpunit/phpunit": "^8.5.52|^9.6.34",
                 "spiral/roadrunner-http": "^3.6",
-                "spiral/roadrunner-worker": "^3.6",
+                "spiral/roadrunner-worker": "^3.6"
-                "vimeo/psalm": "^4.17"
             },
             "suggest": {
+                "ext-excimer": "Enable Sentry profiling with the Excimer PHP extension.",
                 "monolog/monolog": "Allow sending log messages to Sentry by using the included Monolog handler."
             },
             "type": "library",
@@ -2823,7 +2829,7 @@
             ],
             "support": {
                 "issues": "https://github.com/getsentry/sentry-php/issues",
-                "source": "https://github.com/getsentry/sentry-php/tree/4.22.0"
+                "source": "https://github.com/getsentry/sentry-php/tree/4.27.0"
             },
             "funding": [
                 {
@@ -2835,27 +2841,27 @@
                     "type": "custom"
                 }
             ],
-            "time": "2026-03-16T13:03:46+00:00"
+            "time": "2026-05-06T14:32:16+00:00"
         },
         {
             "name": "sentry/sentry-symfony",
-            "version": "5.9.0",
+            "version": "5.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/getsentry/sentry-symfony.git",
-                "reference": "75a73de23b9af414b3c8b15c26187a4ae6c65732"
+                "reference": "6f49255f4cdcfc43a3a283bd3a1f65d483e9192f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/getsentry/sentry-symfony/zipball/75a73de23b9af414b3c8b15c26187a4ae6c65732",
+                "url": "https://api.github.com/repos/getsentry/sentry-symfony/zipball/6f49255f4cdcfc43a3a283bd3a1f65d483e9192f",
-                "reference": "75a73de23b9af414b3c8b15c26187a4ae6c65732",
+                "reference": "6f49255f4cdcfc43a3a283bd3a1f65d483e9192f",
                 "shasum": ""
             },
             "require": {
                 "guzzlehttp/psr7": "^2.1.1",
                 "jean85/pretty-package-versions": "^1.5||^2.0",
                 "php": "^7.2||^8.0",
-                "sentry/sentry": "^4.20.0",
+                "sentry/sentry": "^4.23.0",
                 "symfony/cache-contracts": "^1.1||^2.4||^3.0",
                 "symfony/config": "^4.4.20||^5.0.11||^6.0||^7.0||^8.0",
                 "symfony/console": "^4.4.20||^5.0.11||^6.0||^7.0||^8.0",
@@ -2925,7 +2931,7 @@
             ],
             "support": {
                 "issues": "https://github.com/getsentry/sentry-symfony/issues",
-                "source": "https://github.com/getsentry/sentry-symfony/tree/5.9.0"
+                "source": "https://github.com/getsentry/sentry-symfony/tree/5.10.0"
             },
             "funding": [
                 {
@@ -2937,7 +2943,7 @@
                     "type": "custom"
                 }
             ],
-            "time": "2026-02-23T12:32:36+00:00"
+            "time": "2026-04-01T14:50:32+00:00"
         },
         {
             "name": "stof/doctrine-extensions-bundle",
@@ -8082,16 +8088,16 @@
         },
         {
             "name": "symfonycasts/sass-bundle",
-            "version": "v0.9.0",
+            "version": "v0.10.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/SymfonyCasts/sass-bundle.git",
-                "reference": "3472f2018417b4f7258095089b327a7ba79018ad"
+                "reference": "eedf6ace11e5323344726d2b6e0ba1635cf12bb5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SymfonyCasts/sass-bundle/zipball/3472f2018417b4f7258095089b327a7ba79018ad",
+                "url": "https://api.github.com/repos/SymfonyCasts/sass-bundle/zipball/eedf6ace11e5323344726d2b6e0ba1635cf12bb5",
-                "reference": "3472f2018417b4f7258095089b327a7ba79018ad",
+                "reference": "eedf6ace11e5323344726d2b6e0ba1635cf12bb5",
                 "shasum": ""
             },
             "require": {
@@ -8099,6 +8105,7 @@
                 "symfony/asset-mapper": "^6.3|^7.0|^8.0",
                 "symfony/console": "^5.4|^6.3|^7.0|^8.0",
                 "symfony/filesystem": "^5.4|^6.3|^7.0|^8.0",
+                "symfony/finder": "^5.4|^6.3|^7.0|^8.0",
                 "symfony/http-client": "^5.4|^6.3|^7.0|^8.0",
                 "symfony/process": "^5.4|^6.3|^7.0|^8.0"
             },
@@ -8131,9 +8138,9 @@
             ],
             "support": {
                 "issues": "https://github.com/SymfonyCasts/sass-bundle/issues",
-                "source": "https://github.com/SymfonyCasts/sass-bundle/tree/v0.9.0"
+                "source": "https://github.com/SymfonyCasts/sass-bundle/tree/v0.10.0"
             },
-            "time": "2025-11-29T13:44:16+00:00"
+            "time": "2026-04-09T11:29:28+00:00"
         },
         {
             "name": "symfonycasts/verify-email-bundle",

config/reference.php

@@ -1309,6 +1309,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         traces_sampler?: scalar|Param|null,
  *         profiles_sample_rate?: float|Param, // The sampling factor to apply to profiles. A value of 0 will deny sending any profiles, and a value of 1 will send all profiles. Profiles are sampled in relation to traces_sample_rate
  *         enable_logs?: bool|Param,
+ *         log_flush_threshold?: mixed, // Default: null
  *         enable_metrics?: bool|Param, // Default: true
  *         attach_stacktrace?: bool|Param,
  *         attach_metric_code_locations?: bool|Param,
@@ -1318,6 +1319,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         spotlight?: bool|Param,
  *         spotlight_url?: scalar|Param|null,
  *         release?: scalar|Param|null, // Default: "%env(default::SENTRY_RELEASE)%"
+ *         org_id?: int|Param,
  *         server_name?: scalar|Param|null,
  *         ignore_exceptions?: list<scalar|Param|null>,
  *         ignore_transactions?: list<scalar|Param|null>,
@@ -1328,6 +1330,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         before_send_log?: scalar|Param|null,
  *         before_send_metric?: scalar|Param|null,
  *         trace_propagation_targets?: mixed,
+ *         strict_trace_continuation?: bool|Param,
  *         tags?: array<string, scalar|Param|null>,
  *         error_types?: scalar|Param|null,
  *         max_breadcrumbs?: int|Param,
@@ -1352,11 +1355,13 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         enabled?: bool|Param, // Default: false
  *         capture_soft_fails?: bool|Param, // Default: true
  *         isolate_breadcrumbs_by_message?: bool|Param, // Default: false
+ *         isolate_context_by_message?: bool|Param, // Default: false
  *     },
  *     tracing?: bool|array{
  *         enabled?: bool|Param, // Default: true
  *         dbal?: bool|array{
  *             enabled?: bool|Param, // Default: true
+ *             ignore_prepare_spans?: bool|Param, // Default: false
  *             connections?: list<scalar|Param|null>,
  *         },
  *         twig?: bool|array{
@@ -1376,6 +1381,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  * @psalm-type SymfonycastsSassConfig = array{
  *     root_sass?: list<scalar|Param|null>,
  *     binary?: scalar|Param|null, // The Sass binary to use // Default: null
+ *     search_for_binary?: scalar|Param|null, // Whether to search for the Sass binary in the system PATH // Default: true
  *     sass_options?: array{
  *         style?: "compressed"|"expanded"|Param, // The style of the generated CSS: compressed or expanded. // Default: "expanded"
  *         charset?: bool|Param, // Whether to include the charset declaration in the generated Sass.

migrations/Version20260524135246.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260524135246 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add unique constraint for quiz_candidate with deleted_at filter';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_ced2ffa291bd8781853cd175');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_CED2FFA291BD8781853CD175 ON quiz_candidate (candidate_id, quiz_id) WHERE (deleted_at IS NULL)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX UNIQ_CED2FFA291BD8781853CD175');
+        $this->addSql('CREATE UNIQUE INDEX uniq_ced2ffa291bd8781853cd175 ON quiz_candidate (candidate_id, quiz_id)');
+    }
+}

src/Controller/Backoffice/PrepareEliminationController.php

@@ -10,6 +10,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Tvdt\Controller\AbstractController;
 use Tvdt\Entity\Elimination;
 use Tvdt\Entity\Quiz;
@@ -20,10 +21,12 @@ final class PrepareEliminationController extends AbstractController
 {
     public function __construct(private readonly EliminationFactory $eliminationFactory, private readonly EntityManagerInterface $em) {}
 
+    #[IsCsrfTokenValid('prepare_elimination')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/elimination/prepare',
         name: 'tvdt_prepare_elimination',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function index(Season $season, Quiz $quiz): RedirectResponse
     {
@@ -32,18 +35,16 @@ final class PrepareEliminationController extends AbstractController
         return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
     }
 
+    #[IsCsrfTokenValid('prepare_elimination', methods: ['POST'])]
     #[Route(
         '/backoffice/elimination/{elimination}',
         name: 'tvdt_prepare_elimination_view',
         requirements: ['elimination' => Requirement::UUID],
+        methods: ['GET', 'POST'],
     )]
     public function viewElimination(Elimination $elimination, Request $request): Response
     {
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
-            if (!$this->isCsrfTokenValid('prepare_elimination', $request->request->get('_token'))) {
-                throw $this->createAccessDeniedException();
-            }
-
             $elimination->updateFromInputBag($request->request);
             $this->em->flush();
 
@@ -52,6 +53,8 @@ final class PrepareEliminationController extends AbstractController
             }
 
             $this->addFlash('success', 'Elimination updated');
+
+            return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
         }
 
         return $this->render('backoffice/prepare_elimination/index.html.twig', [

src/Controller/Backoffice/QuizController.php

@@ -10,9 +10,9 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Controller\AbstractController;
@@ -184,6 +184,7 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('candidate_answer')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/candidates/{question}',
@@ -193,10 +194,6 @@ class QuizController extends AbstractController
     )]
     public function saveCandidateAnswers(Season $season, Quiz $quiz, Question $question, Request $request): RedirectResponse
     {
-        if (!$this->isCsrfTokenValid('candidate_answer', $request->request->get('_token'))) {
-            throw $this->createAccessDeniedException();
-        }
-
         if (false === $season->quizzes->contains($quiz)
             || false === $quiz->questions->contains($question)) {
             throw new BadRequestHttpException('Invalid quiz or question');
@@ -245,11 +242,13 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('enable_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/enable',
         name: 'tvdt_backoffice_enable',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID.'|null'],
+        methods: ['POST'],
     )]
     public function enableQuiz(Season $season, ?Quiz $quiz): RedirectResponse
     {
@@ -263,11 +262,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('clear_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/clear',
         name: 'tvdt_backoffice_quiz_clear',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function clearQuiz(Quiz $quiz): RedirectResponse
     {
@@ -281,11 +282,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('delete_quiz')]
     #[IsGranted(SeasonVoter::DELETE, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/delete',
         name: 'tvdt_backoffice_quiz_delete',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function deleteQuiz(Quiz $quiz): RedirectResponse
     {
@@ -296,22 +299,16 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $quiz->season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('candidate_correction')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_correction',
         name: 'tvdt_backoffice_modify_correction',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyCorrection(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
-        if (!$this->isCsrfTokenValid('candidate_correction', $request->request->get('_token'))) {
-            throw $this->createAccessDeniedException();
-        }
-
         $corrections = (float) $request->request->get('corrections');
 
         $this->quizCandidateRepository->setCorrectionsForCandidate($quiz, $candidate, $corrections);
@@ -319,22 +316,16 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('candidate_penalty')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_penalty',
         name: 'tvdt_backoffice_modify_penalty',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyPenalty(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
-        if (!$this->isCsrfTokenValid('candidate_penalty', $request->request->get('_token'))) {
-            throw $this->createAccessDeniedException();
-        }
-
         $penalty = (int) $request->request->get('penalty');
 
         $this->quizCandidateRepository->setPenaltyForCandidate($quiz, $candidate, $penalty);
@@ -342,12 +333,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('toggle_candidate')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/toggle',
         name: 'tvdt_backoffice_toggle_candidate',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
-        methods: ['GET'],
+        methods: ['POST'],
     )]
     public function toggleCandidate(Quiz $quiz, Candidate $candidate): RedirectResponse
     {

src/Controller/QuizController.php

@@ -9,6 +9,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Entity\Answer;
 use Tvdt\Entity\Candidate;
@@ -70,10 +71,12 @@ final class QuizController extends AbstractController
         return $this->render('quiz/enter_name.twig', ['season' => $season, 'form' => $form]);
     }
 
+    #[IsCsrfTokenValid('question', tokenKey: 'token', methods: ['POST'])]
     #[Route(
         path: '/{seasonCode:season}/{nameHash}',
         name: 'tvdt_quiz_quiz_page',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'nameHash' => self::CANDIDATE_HASH_REGEX],
+        methods: ['GET', 'POST'],
     )]
     public function quizPage(
         Season $season,
@@ -96,11 +99,7 @@ final class QuizController extends AbstractController
             return $this->redirectToRoute('tvdt_quiz_enter_name', ['seasonCode' => $season->seasonCode]);
         }
 
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
-            if (!$this->isCsrfTokenValid('question', $request->request->get('token'))) {
-                throw $this->createAccessDeniedException();
-            }
-
             // TODO: Extract saving answer logic to a service
             // Check if candidate is inactive for this quiz
             $quizCandidate = $this->quizCandidateRepository->findOneBy(['quiz' => $quiz, 'candidate' => $candidate]);

src/Entity/Elimination.php

@@ -20,6 +20,7 @@ class Elimination
 {
     use SoftDeleteableEntity;
     use TimestampableEntity;
+
     public const string SCREEN_GREEN = 'green';
 
     public const string SCREEN_RED = 'red';

src/Entity/QuizCandidate.php

@@ -14,10 +14,11 @@ use Tvdt\Repository\QuizCandidateRepository;
 
 #[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: QuizCandidateRepository::class)]
-#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'])]
+#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'], options: ['where' => '(deleted_at IS NULL)'])]
 class QuizCandidate
 {
     use SoftDeleteableEntity;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]

templates/backoffice/quiz/tab_candidates_list.html.twig

@@ -35,14 +35,16 @@
                     {% endif %}
                 </td>
                 <td>
-                    <a href="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}"
+                    <form action="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST">
-                       class="btn btn-sm btn-outline-secondary">
+                        <input type="hidden" name="_token" value="{{ csrf_token('toggle_candidate') }}">
-                        {% if quizCandidate == null or quizCandidate.active %}
+                        <button type="submit" class="btn btn-sm btn-outline-secondary">
-                            {{ 'Deactivate'|trans }}
+                            {% if quizCandidate == null or quizCandidate.active %}
-                        {% else %}
+                                {{ 'Deactivate'|trans }}
-                            {{ 'Activate'|trans }}
+                            {% else %}
-                        {% endif %}
+                                {{ 'Activate'|trans }}
-                    </a>
+                            {% endif %}
+                        </button>
+                    </form>
                 </td>
             </tr>
         {% endfor %}

templates/backoffice/quiz/tab_overview.html.twig

@@ -3,16 +3,24 @@
     <div class="mb-3 btn-group">
 
         {% if quiz is same as (season.activeQuiz) %}
-            <a class="btn btn-secondary"
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}" method="POST">
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}">{{ 'Deactivate Quiz'|trans }}</a>
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <button type="submit" class="btn btn-secondary rounded-0 rounded-start">
+                    {{ 'Deactivate Quiz'|trans }}
+                </button>
+            </form>
         {% else %}
-            <a class="btn btn-primary"
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">{{ 'Make active'|trans }}</a>
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <button type="submit" class="btn btn-primary rounded-0 rounded-start">
+                    {{ 'Make active'|trans }}
+                </button>
+            </form>
         {% endif %}
         <button class="btn btn-danger" data-action="click->bo--quiz#clearQuiz">
             {{ 'Clear Quiz...'|trans }}
         </button>
-        <button class="btn btn-danger" data-action="click->bo--quiz#deleteQuiz">
+        <button class="btn btn-danger rounded-0 rounded-end" data-action="click->bo--quiz#deleteQuiz">
             {{ 'Delete Quiz...'|trans }}
         </button>
     </div>
@@ -74,8 +82,10 @@
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}) }}"
+                    <form action="{{ path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}) }}" method="POST">
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
+                        <input type="hidden" name="_token" value="{{ csrf_token('clear_quiz') }}">
+                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                    </form>
                 </div>
             </div>
         </div>
@@ -97,8 +107,10 @@
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}) }}"
+                    <form action="{{ path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}) }}" method="POST">
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
+                        <input type="hidden" name="_token" value="{{ csrf_token('delete_quiz') }}">
+                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                    </form>
                 </div>
             </div>
         </div>

templates/backoffice/quiz/tab_result.html.twig

@@ -2,8 +2,10 @@
 <div class="btn-toolbar mb-3" role="toolbar">
     <div class="btn-group me-2">
         {# <a class="btn btn-primary">{{ 'Start Elimination'|trans }}</a> #}
-        <a href="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}"
+        <form action="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
-           class="btn btn-secondary">{{ 'Prepare Custom Elimination'|trans }}</a>
+            <input type="hidden" name="_token" value="{{ csrf_token('prepare_elimination') }}">
+            <button type="submit" class="btn btn-secondary rounded-0 rounded-start">{{ 'Prepare Custom Elimination'|trans }}</button>
+        </form>
         {%~ if not quiz.eliminations.empty %}
             <button class="btn btn-secondary dropdown-toggle"
                     data-bs-toggle="dropdown">{{ 'Load Prepared Elimination'|trans }}</button>