create-berna-stencil 1.0.12 → 1.0.14

package/.eleventy.js

@@ -4,7 +4,7 @@ const Image = require("@11ty/eleventy-img");
 const fs = require("fs");
 const path = require("path");
 
-const OUTPUT_DIR = "out";
+const OUTPUT_DIR = "c:/laragon/www/Berna-Stencil-out";
 
 module.exports = function (eleventyConfig) {
 

package/bin/create.js

@@ -18,7 +18,7 @@ const COPY_TARGETS = [
 
 const PROJECT_PACKAGE = {
     name: path.basename(targetDir),
-    version: '1.0.12',
+    version: '1.0.14',
     private: true,
     scripts: {
         'build:css': 'sass src/scss:out/css --no-source-map --style=compressed --quiet',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-berna-stencil",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "Eleventy boilerplate with per-page SCSS/JS pipeline, esbuild bundling, multi-framework CSS support and a built-in page management CLI",
   "keywords": [
     "eleventy",
@@ -58,12 +58,12 @@
     "sass": "^1.77.0"
   },
   "scripts": {
-    "build:css": "sass src/scss:out/css --no-source-map --style=compressed --quiet",
-    "build:js": "esbuild \"src/js/pages/*.js\" --bundle --outdir=out/js/pages --minify",
+    "build:css": "sass src/scss:c:/laragon/www/Berna-Stencil-out/css --no-source-map --style=compressed --quiet",
+    "build:js": "esbuild \"src/js/pages/*.js\" --bundle --outdir=c:/laragon/www/Berna-Stencil-out/js/pages --minify",
     "build:11ty": "eleventy",
     "build": "npm run build:css && npm run build:js && npm run build:11ty",
-    "serve:css": "sass --watch src/scss:out/css --no-source-map --quiet",
-    "serve:js": "esbuild \"src/js/pages/*.js\" --bundle --outdir=out/js/pages --watch",
+    "serve:css": "sass --watch src/scss:c:/laragon/www/Berna-Stencil-out/css --no-source-map --quiet",
+    "serve:js": "esbuild \"src/js/pages/*.js\" --bundle --outdir=c:/laragon/www/Berna-Stencil-out/js/pages --watch",
     "serve:11ty": "eleventy --serve --quiet",
     "clean": "node _tools/cleanOutput.js",
     "serve": "npm run clean && concurrently \"npm run serve:11ty\" \"npm run serve:css\" \"npm run serve:js\"",

package/src/api/.htaccess

@@ -2,11 +2,17 @@
     RewriteEngine On
     RewriteBase /api/
 
-    # Non processare file reali (immagini, vendor, ecc.)
-    RewriteCond %{REQUEST_FILENAME} -f [OR]
-    RewriteCond %{REQUEST_FILENAME} -d
-    RewriteRule ^ - [L]
+    # 1. Proteggi i file sensibili (come .env o file di log)
+    <FilesMatch "^\.env|composer\.(json|lock)$">
+        Require all denied
+    </FilesMatch>
 
-    # Tutto il resto va a index.php
+    # 2. Impedisce l'accesso diretto alla cartella core e endpoints
+    # Se qualcuno cerca di navigare in queste cartelle, becca un 403
+    RewriteRule ^(core|endpoints|modules)($|/) - [F,L]
+
+    # 3. Regola standard per il routing verso il motore
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
     RewriteRule ^(.*)$ index.php [QSA,L]
 </IfModule>

package/src/api/core/.htaccess

@@ -0,0 +1,2 @@
+# Impedisce a chiunque di accedere a questa cartella tramite URL
+Require all denied

package/src/api/{init.php → core/init.php}

@@ -2,6 +2,11 @@
 
 declare(strict_types=1);
 
+if (!defined('CORE_ACCESS')) {
+    http_response_code(403);
+    die('Accesso diretto non consentito.');
+}
+
 require_once __DIR__ . '/vendor/autoload.php';
 require_once __DIR__ . '/modules/Response.php';
 
@@ -21,9 +26,9 @@ set_error_handler(function ($severity, $message, $file, $line) {
 });
 
 // --- CARICAMENTO DOTENV ---
-// dirname(__DIR__, 1) sale di un livello (da api/ a Berna-Stencil-out/)
+// dirname(__DIR__, 2) sale di un livello (da api/ a Berna-Stencil-out/)
 try {
-    $dotenv = Dotenv\Dotenv::createImmutable(dirname(__DIR__, 1));
+    $dotenv = Dotenv\Dotenv::createImmutable(dirname(__DIR__, 2));
     $dotenv->load();
 } catch (Exception $e) {
     Response::error("Impossibile caricare il file .env. Assicurati che esista nella root e si chiami esattamente .env", 500);

package/src/api/endpoints/protected/secret.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-require_once __DIR__ . '/../../modules/Response.php';
+require_once __DIR__ . '/../../core/modules/Response.php';
 
 if ($method !== 'GET') {
     Response::error('Method not allowed', 405);

package/src/api/endpoints/public/ping.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-require_once __DIR__ . '/../../modules/Response.php';
+require_once __DIR__ . '/../../core/modules/Response.php';
 
 if ($method !== 'GET') {
     Response::error('Method not allowed', 405);

package/src/api/index.php

@@ -2,11 +2,13 @@
 
 declare(strict_types=1);
 
+define('CORE_ACCESS', true);
+
 /**
  * Caricamento delle dipendenze e configurazione iniziale.
  */
-require_once __DIR__ . '/init.php';
-require_once __DIR__ . '/modules/Response.php';
+require_once __DIR__ . '/core/init.php';
+require_once __DIR__ . '/core/modules/Response.php';
 
 // =====================================================
 // 1. ANALISI DELLA RICHIESTA (REQUEST PARSING)

package/src/api/endpoints/protected/send-mail.php

@@ -1,75 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use PHPMailer\PHPMailer\PHPMailer;
-use PHPMailer\PHPMailer\Exception;
-
-/**
- * NOTA: Non serve require 'vendor/autoload.php' o 'init.php' 
- * perché questo file viene incluso da index.php che ha già caricato tutto.
- */
-
-// 1. Controllo Metodo (Vogliamo solo POST)
-if ($method !== 'POST') {
-    Response::error('Method not allowed', 405);
-}
-
-// 2. Funzioni di Sanitizzazione (Locali o spostabili in un helper)
-$clean = fn($v) => htmlspecialchars(trim((string)($v ?? '')), ENT_QUOTES, 'UTF-8');
-$safeNum = fn($v) => filter_var($v ?? '', FILTER_SANITIZE_NUMBER_INT);
-
-// 3. Recupero Dati (supporta sia $_POST standard che JSON)
-$input = $_POST;
-if (empty($input)) {
-    $input = json_decode(file_get_contents('php://input'), true) ?? [];
-}
-
-$formType    = $clean($input['formType'] ?? 'Contatto Generico');
-$name        = $clean($input['name'] ?? '');
-$phoneNumber = $safeNum($input['phoneNumber'] ?? '');
-
-// Validazione minima
-if (empty($name)) {
-    Response::error('Il campo nome è obbligatorio');
-}
-
-// 4. Configurazione PHPMailer
-$mail = new PHPMailer(true);
-
-try {
-    // Usiamo le variabili d'ambiente caricate da init.php
-    $mail->isSMTP();
-    $mail->Host       = $_ENV['MAIL_HOST'];
-    $mail->SMTPAuth   = true;
-    $mail->Username   = $_ENV['MAIL_USERNAME'];
-    $mail->Password   = $_ENV['MAIL_PASSWORD'];
-    $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
-    $mail->Port       = (int)$_ENV['MAIL_PORT'];
-    $mail->CharSet    = 'UTF-8';
-
-    $mail->setFrom($_ENV['MAIL_USERNAME'], $_ENV['MAIL_FROM_NAME'] ?? 'API Robot');
-    $mail->addAddress($_ENV['MAIL_TO_ADDRESS'], $_ENV['MAIL_TO_NAME'] ?? 'Admin');
-
-    $mail->isHTML(true);
-    $mail->Subject = "Nuovo invio modulo: {$formType}";
-
-    // Costruzione Body
-    $htmlBody = "<h2>Dettagli Richiesta</h2>";
-    $htmlBody .= "<p><strong>Nome:</strong> {$name}</p>";
-    if (!empty($phoneNumber)) {
-        $htmlBody .= "<p><strong>Telefono:</strong> {$phoneNumber}</p>";
-    }
-
-    $mail->Body    = $htmlBody;
-    $mail->AltBody = strip_tags(str_replace(['<br>', '</p>'], ["\n", "\n\n"], $htmlBody));
-
-    $mail->send();
-
-    // Risposta JSON di successo
-    Response::success(['message' => 'Email inviata con successo']);
-
-} catch (Exception $e) {
-    // Risposta JSON di errore
-    Response::error("Errore nell'invio della mail: {$mail->ErrorInfo}", 500);
-}