afkaar-gen 1.0.0

package/references/security-checklist.md

@@ -0,0 +1,218 @@
+# Checklist sécurité pour sites générés
+
+## S-1 : Content-Security-Policy (CSP)
+
+Dans `.htaccess` :
+```
+Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://www.googletagmanager.com; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data: https://maps.googleapis.com; connect-src 'self' https://maps.googleapis.com; frame-src 'self' https://www.googletagmanager.com"
+```
+
+## S-2 : Rate limiting formulaire contact
+
+Dans `lead-handler.php`, avant traitement :
+```php
+$ip = $_SERVER['REMOTE_ADDR'] ?? '0';
+$limits = json_read('contact-limits');
+$rec = $limits[$ip] ?? ['count' => 0, 'time' => time()];
+if (time() - $rec['time'] > 900) $rec = ['count' => 0, 'time' => time()];
+if ($rec['count'] >= 5) respond(false, 'Trop de tentatives, réessayez plus tard.');
+$rec['count']++;
+$limits[$ip] = $rec;
+// Nettoyage IP expirées
+foreach ($limits as $k => $v) if (time() - ($v['time'] ?? 0) > 900) unset($limits[$k]);
+json_write('contact-limits', $limits);
+```
+
+## S-3 : Logging échecs login
+
+Dans `auth.php`, après échec :
+```php
+$log = date('Y-m-d H:i:s') . " | ÉCHEC | IP: $ip | User: $username\n";
+file_put_contents(DATA_DIR . '/login-attempts.log', $log, FILE_APPEND | LOCK_EX);
+```
+
+## S-4 : Password policy
+
+Dans `admin/settings.php`, changement mot de passe :
+```php
+if (!preg_match('/^(?=.*[A-Z])(?=.*[0-9]).{10,}$/', $new)) {
+    flash('Minimum 10 caractères, 1 majuscule, 1 chiffre.', 'err');
+}
+```
+
+## S-5 : Session timeout
+
+Dans `auth.php`, au début de chaque page admin :
+```php
+if (($admin_user) && (time() - ($_SESSION['last_activity'] ?? 0)) > 1800) {
+    admin_logout(); redirect('/admin/login.php');
+}
+$_SESSION['last_activity'] = time();
+```
+
+## S-6 : Upload validation renforcée
+
+Dans `core/functions.php` :
+```php
+function handle_image_upload(string $field, string $prefix = 'img'): ?string {
+    if (empty($_FILES[$field]['name']) || $_FILES[$field]['error'] !== UPLOAD_ERR_OK) return null;
+    // Sécurité : basename + regex pour éviter path traversal
+    $orig = basename((string)$_FILES[$field]['name']);
+    if (!preg_match('/^[a-zA-Z0-9._-]+$/', $orig)) return null;
+    $tmp = $_FILES[$field]['tmp_name'];
+    if (($_FILES[$field]['size'] ?? 0) > 4 * 1024 * 1024) return null;
+    $info = @getimagesize($tmp);
+    $allowed = [IMAGETYPE_JPEG => 'jpg', IMAGETYPE_PNG => 'png', IMAGETYPE_WEBP => 'webp', IMAGETYPE_GIF => 'gif'];
+    if (!$info || !isset($allowed[$info[2]])) return null;
+    $ext = $allowed[$info[2]];
+    $name = $prefix . '-' . date('Ymd-His') . '-' . bin2hex(random_bytes(4)) . '.' . $ext;
+    if (!is_dir(UPLOADS_DIR)) @mkdir(UPLOADS_DIR, 0755, true);
+    if (!move_uploaded_file($tmp, UPLOADS_DIR . '/' . $name)) return null;
+    return UPLOADS_URL . '/' . $name;
+}
+```
+
+## S-7 : Anti path traversal (général)
+
+Tous les paramètres de fichier :
+```php
+basename($input); // + regex alphanum + tirets
+```
+
+## S-8 : Cache-Control admin pages
+
+Dans `auth.php` ou `layout-top.php` :
+```php
+header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
+header('Pragma: no-cache');
+```
+
+## S-9 : Session cookie sécurisé
+
+Dans `auth.php` (début) :
+```php
+session_name(SESSION_NAME);
+session_set_cookie_params([
+    'lifetime' => 0,
+    'path' => '/',
+    'domain' => '',
+    'secure' => !empty($_SERVER['HTTPS']),
+    'httponly' => true,
+    'samesite' => 'Strict',
+]);
+session_start();
+```
+
+## S-10 : Protection brute-force login
+
+Dans `auth.php` :
+```php
+// Session : 5 tentatives / 10 min
+$attempts = $_SESSION['login_attempts'] ?? ['count' => 0, 'time' => time()];
+if (time() - $attempts['time'] > 600) $attempts = ['count' => 0, 'time' => time()];
+if ($attempts['count'] >= 5) return false;
+
+// IP : 12 tentatives / 15 min
+$ip = $_SERVER['REMOTE_ADDR'] ?? '0';
+$limits = json_read('login-limits');
+$rec = $limits[$ip] ?? ['count' => 0, 'time' => time()];
+if (time() - $rec['time'] > 900) $rec = ['count' => 0, 'time' => time()];
+if ($rec['count'] >= 12) return false;
+```
+
+## S-11 : XSS — helper e()
+
+Toujours utiliser, jamais de `echo $_POST[...]` ou `<?= $_GET[...]` :
+```php
+function e(?string $s): string {
+    return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8');
+}
+```
+
+## S-12 : CSRF sur tous les formulaires
+
+```php
+// Génération
+function csrf_token(): string {
+    if (session_status() !== PHP_SESSION_ACTIVE) session_start();
+    if (empty($_SESSION[CSRF_KEY]))
+        $_SESSION[CSRF_KEY] = bin2hex(random_bytes(32));
+    return $_SESSION[CSRF_KEY];
+}
+// Validation
+function csrf_check(): bool {
+    if (session_status() !== PHP_SESSION_ACTIVE) session_start();
+    return isset($_POST['csrf'], $_SESSION[CSRF_KEY])
+        && hash_equals($_SESSION[CSRF_KEY], (string)$_POST['csrf']);
+}
+```
+
+## S-13 : Honeypot anti-spam
+
+Dans le formulaire contact :
+```html
+<input type="text" name="website" tabindex="-1" autocomplete="off"
+       style="position:absolute;left:-9999px" aria-hidden="true">
+```
+Dans `lead-handler.php` :
+```php
+if (!empty($_POST['website'])) respond(true, 'Merci !');
+```
+
+## S-14 : Timer anti-spam (3s)
+
+```html
+<input type="hidden" name="_ts" value="<?= time() ?>">
+```
+```php
+$ts = (int)($_POST['_ts'] ?? 0);
+if ($ts > 0 && (time() - $ts) < 3) respond(false, 'Envoi trop rapide.');
+```
+
+## S-15 : Validation email + téléphone
+
+```php
+if (!filter_var($email, FILTER_VALIDATE_EMAIL)) respond(false, 'Email invalide.');
+if (!preg_match('/^[0-9 +().-]{6,20}$/', $phone)) respond(false, 'Téléphone invalide.');
+```
+
+## S-16 : Anti header injection email
+
+```php
+$safeName = preg_replace('/[\r\n]+/', ' ', $name);
+```
+
+## S-17 : Audit trail admin
+
+Logger chaque action CRUD :
+```php
+$log = date('Y-m-d H:i:s') . " | ADMIN | {$_SESSION['admin_user']['username']} | Action: $action | Target: $id\n";
+file_put_contents(DATA_DIR . '/audit.log', $log, FILE_APPEND | LOCK_EX);
+```
+
+## S-18 : Blocage exécution PHP dans uploads/
+
+`assets/uploads/.htaccess` :
+```
+<FilesMatch "\.(?i:php|phtml|phar)$">
+  Require all denied
+</FilesMatch>
+```
+
+## S-19 : Session regenerée après login
+
+```php
+session_regenerate_id(true);
+```
+
+## S-20 : Validation slug (anti injection JSON)
+
+```php
+function slugify(string $text): string {
+    $text = mb_strtolower(trim($text), 'UTF-8');
+    $map = ['à'=>'a','â'=>'a','ä'=>'a','é'=>'e','è'=>'e','ê'=>'e','ë'=>'e','î'=>'i','ï'=>'i','ô'=>'o','ö'=>'o','ù'=>'u','û'=>'u','ü'=>'u','ç'=>'c','œ'=>'oe'];
+    $text = strtr($text, $map);
+    $text = preg_replace('/[^a-z0-9]+/', '-', $text);
+    return trim((string)$text, '-') ?: 'item';
+}
+```

package/references/seo-guide.md

@@ -0,0 +1,183 @@
+# SEO guide pour sites générés
+
+## Sitemap.xml dynamique
+
+Route dans `index.php` :
+```php
+if ($path === '/sitemap.xml') {
+    header('Content-Type: application/xml; charset=utf-8');
+    $urls = [APP_URL . '/', APP_URL . '/references', APP_URL . '/blog', APP_URL . '/contact'];
+    foreach (json_read('services') as $s) if (!empty($s['active'])) $urls[] = APP_URL . '/services/' . $s['slug'];
+    foreach (json_read('references') as $r) if (!empty($r['active'])) $urls[] = APP_URL . '/references/' . $r['slug'];
+    foreach (json_read('posts') as $p) if (!empty($p['active'])) $urls[] = APP_URL . '/blog/' . $p['slug'];
+    echo '<?xml version="1.0" encoding="UTF-8"?>' . "\n";
+    echo '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">' . "\n";
+    foreach ($urls as $u) echo "  <url><loc>" . e($u) . "</loc></url>\n";
+    echo '</urlset>';
+    exit;
+}
+```
+
+## robots.txt
+
+```txt
+User-agent: *
+Allow: /
+Sitemap: https://monsite.tn/sitemap.xml
+```
+
+## JSON-LD Organization (header.php)
+
+```html
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "ProfessionalService",
+  "name": "Mon Site",
+  "url": "https://monsite.tn",
+  "logo": "https://monsite.tn/assets/img/logo.svg",
+  "email": "contact@monsite.tn",
+  "telephone": "+216 XX XXX XXX",
+  "address": {
+    "@type": "PostalAddress",
+    "streetAddress": "Adresse",
+    "addressLocality": "Ville",
+    "addressRegion": "Région",
+    "addressCountry": "TN"
+  },
+  "sameAs": ["https://facebook.com/...", "https://instagram.com/..."]
+}
+</script>
+```
+
+## JSON-LD Service (page service)
+
+```php
+$pageSchemas[] = [
+    '@context' => 'https://schema.org', '@type' => 'Service',
+    'name' => $found['title'],
+    'description' => strip_tags($found['excerpt'] ?? ''),
+    'url' => APP_URL . '/services/' . $found['slug'],
+    'areaServed' => ['@type' => 'Country', 'name' => 'Tunisie'],
+    'provider' => ['@type' => 'ProfessionalService', 'name' => APP_NAME, 'url' => APP_URL],
+];
+```
+
+## JSON-LD Article (page blog)
+
+```php
+$pageSchemas[] = [
+    '@context' => 'https://schema.org', '@type' => 'Article',
+    'headline' => $found['title'],
+    'description' => strip_tags($found['excerpt'] ?? ''),
+    'datePublished' => $found['date'] ?? '',
+    'inLanguage' => 'fr',
+    'image' => !empty($found['image']) ? APP_URL . $found['image'] : null,
+    'author' => ['@type' => 'Organization', 'name' => APP_NAME, 'url' => APP_URL],
+    'publisher' => ['@type' => 'Organization', 'name' => APP_NAME, 'url' => APP_URL],
+    'mainEntityOfPage' => APP_URL . '/blog/' . $found['slug'],
+];
+```
+
+## JSON-LD BreadcrumbList
+
+```php
+$pageSchemas[] = [
+    '@context' => 'https://schema.org', '@type' => 'BreadcrumbList',
+    'itemListElement' => [
+        ['@type' => 'ListItem', 'position' => 1, 'name' => 'Accueil', 'item' => APP_URL . '/'],
+        ['@type' => 'ListItem', 'position' => 2, 'name' => 'Catégorie', 'item' => APP_URL . '/blog'],
+        ['@type' => 'ListItem', 'position' => 3, 'name' => $found['title']],
+    ],
+];
+```
+
+## JSON-LD FAQPage (page accueil)
+
+```php
+$pageSchemas[] = [
+    '@context' => 'https://schema.org', '@type' => 'FAQPage',
+    'mainEntity' => array_map(fn($q) => [
+        '@type' => 'Question', 'name' => $q[0],
+        'acceptedAnswer' => ['@type' => 'Answer', 'text' => $q[1]],
+    ], $faq),
+];
+```
+
+## Open Graph (header.php)
+
+```html
+<meta property="og:type" content="website">
+<meta property="og:title" content="<?= e($seo['title']) ?>">
+<meta property="og:description" content="<?= e($seo['description']) ?>">
+<meta property="og:url" content="<?= e($seo['canonical']) ?>">
+<meta property="og:image" content="https://monsite.tn/assets/img/og-cover.png">
+<meta name="twitter:card" content="summary_large_image">
+```
+
+## SEO data management
+
+Dans `data/seo.json` :
+```json
+{
+  "global": {
+    "default_title": "Titre par défaut",
+    "default_description": "Description par défaut",
+    "default_keywords": "mots, clés, SEO",
+    "og_image": "/assets/img/og-cover.png",
+    "gtm_id": "GTM-XXXXXXX",
+    "google_verification": ""
+  },
+  "pages": {
+    "home": { "title": "...", "description": "...", "noindex": false },
+    "contact": { "title": "...", "description": "...", "noindex": false },
+    "references": { "title": "...", "description": "...", "noindex": false },
+    "service:slug": { "title": "...", "description": "..." },
+    "post:slug": { "title": "...", "description": "..." },
+    "reference:slug": { "title": "...", "description": "..." },
+    "404": { "title": "Page introuvable", "noindex": true }
+  }
+}
+```
+
+## Fonction seo_for()
+
+```php
+function seo_for(string $pageKey, array $fallback = []): array {
+    $seo = json_read('seo');
+    $page = $seo['pages'][$pageKey] ?? [];
+    $global = $seo['global'] ?? [];
+    return [
+        'title'       => ($page['title'] ?? '') ?: ($fallback['title'] ?? ($global['default_title'] ?? APP_NAME)),
+        'description' => ($page['description'] ?? '') ?: ($fallback['description'] ?? ($global['default_description'] ?? '')),
+        'keywords'    => ($page['keywords'] ?? '') ?: ($global['default_keywords'] ?? ''),
+        'og_image'    => ($page['og_image'] ?? '') ?: ($global['og_image'] ?? ''),
+        'canonical'   => APP_URL . ($fallback['path'] ?? '/'),
+        'noindex'     => !empty($page['noindex']),
+    ];
+}
+```
+
+## Google Analytics (GTM)
+
+Dans `header.php`, si `gtm_id` est défini :
+```html
+<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;
+j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;
+f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-XXXX');</script>
+```
+Google Search Console via balise meta :
+```html
+<meta name="google-site-verification" content="...">
+```
+
+## Lazy loading images
+
+Toute balise `<img>` générée DOIT avoir :
+```html
+<img src="..." alt="..." loading="lazy" decoding="async">
+```
+
+Exceptions : hero image principale (au-dessus-de-la-pli) peut avoir `loading="eager"`.