create-berna-stencil 1.0.19 → 1.0.21

package/src/api/core/init.php

@@ -2,16 +2,23 @@
 
 declare(strict_types=1);
 
+// Impedisce l'accesso diretto a questo file
 if (!defined('CORE_ACCESS')) {
-    http_response_code(403);
-    die('Accesso diretto non consentito.');
+    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    http_response_code(404);
+    if (file_exists($errorPage)) {
+        header('Content-Type: text/html; charset=UTF-8');
+        echo file_get_contents($errorPage);
+    } else {
+        echo "404 Not Found";
+    }
+    exit;
 }
 
 require_once __DIR__ . '/vendor/autoload.php';
 require_once __DIR__ . '/modules/Response.php';
 
 // --- GESTORE GLOBALE ERRORI E ECCEZIONI ---
-// Trasforma ogni errore PHP in una risposta JSON pulita
 set_exception_handler(function ($exception) {
     Response::error(
         $exception->getMessage(),
@@ -25,21 +32,12 @@ set_error_handler(function ($severity, $message, $file, $line) {
     throw new ErrorException($message, 0, $severity, $file, $line);
 });
 
-// --- CARICAMENTO DOTENV ---
-// dirname(__DIR__, 2) sale di un livello (da api/ a Berna-Stencil-out/)
-try {
-    $dotenv = Dotenv\Dotenv::createImmutable(dirname(__DIR__, 2));
-    $dotenv->load();
-} catch (Exception $e) {
-    Response::error("Impossibile caricare il file .env. Assicurati che esista nella root e si chiami esattamente .env", 500);
-}
-
-$dotenv->required([
-    'API_KEY',
-    'CORS_ALLOWED_ORIGINS',
-]);
+// --- CARICAMENTO CONFIGURAZIONE ---
+// dirname(__DIR__) punta alla cartella /api/ dove ora si trova config.php
+$config = require dirname(__DIR__) . '/config.php';
 
-if (($_ENV['APP_ENV'] ?? 'production') === 'production') {
+// --- CONFIGURAZIONE AMBIENTE ---
+if (($config['APP_ENV'] ?? 'production') === 'production') {
     ini_set('display_errors', '0');
     error_reporting(0);
 } else {

package/src/api/core/modules/Response.php

@@ -2,6 +2,18 @@
 
 declare(strict_types=1);
 
+if (!defined('CORE_ACCESS')) {
+    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    http_response_code(404);
+    if (file_exists($errorPage)) {
+        header('Content-Type: text/html; charset=UTF-8');
+        echo file_get_contents($errorPage);
+    } else {
+        echo "404 Not Found";
+    }
+    exit;
+}
+
 class Response
 {
     public static function success(mixed $data = null, int $code = 200): never

package/src/api/core/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'e4d3643e35a44fdeefbcfd5a5ca35bf44191fd6d',
+        'reference' => 'bb9aa8d8f7ee79e3cd88ebf5d61bf137732aa4f1',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'e4d3643e35a44fdeefbcfd5a5ca35bf44191fd6d',
+            'reference' => 'bb9aa8d8f7ee79e3cd88ebf5d61bf137732aa4f1',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

package/src/api/endpoints/protected/example-protected-endpoint.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+if (!defined('CORE_ACCESS')) {
+    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    http_response_code(404);
+    if (file_exists($errorPage)) {
+        header('Content-Type: text/html; charset=UTF-8');
+        echo file_get_contents($errorPage);
+    } else {
+        echo "404 Not Found";
+    }
+    exit;
+}
+
+require_once __DIR__ . '/../../core/modules/Response.php';
+
+if ($method !== 'GET') {
+    Response::error('Method not allowed', 405);
+}
+
+Response::success([
+    'message'    => 'Protected endpoint is working',
+    'endpoint'   => 'example-protected-endpoint',
+    'visibility' => 'protected',
+    'params'     => $requestParams,
+]);

package/src/api/endpoints/public/example-public-endpoint.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+if (!defined('CORE_ACCESS')) {
+    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    http_response_code(404);
+    if (file_exists($errorPage)) {
+        header('Content-Type: text/html; charset=UTF-8');
+        echo file_get_contents($errorPage);
+    } else {
+        echo "404 Not Found";
+    }
+    exit;
+}
+
+require_once __DIR__ . '/../../core/modules/Response.php';
+
+if ($method !== 'GET') {
+    Response::error('Method not allowed', 405);
+}
+
+Response::success([
+    'message'     => 'Public endpoint is working',
+    'endpoint'    => 'example-public-endpoint',
+    'visibility'  => 'public',
+    'params'      => $requestParams,
+]);

package/src/api/index.php

@@ -60,7 +60,7 @@ header('Content-Type: application/json; charset=UTF-8');
 header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
 header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
 
-$allowedOrigins = array_filter(array_map('trim', explode(',', $_ENV['CORS_ALLOWED_ORIGINS'] ?? '')));
+$allowedOrigins = array_filter(array_map('trim', explode(',', $config['CORS_ALLOWED_ORIGINS'] ?? '')));
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
 
 if (in_array($origin, $allowedOrigins, true) || in_array('*', $allowedOrigins, true)) {
@@ -80,7 +80,7 @@ if ($method === 'OPTIONS') {
 
 if ($isProtected) {
     $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
-    $validKey = $_ENV['API_KEY'] ?? '';
+    $validKey = $config['API_KEY'] ?? '';
 
     if ($validKey === '' || $apiKey !== $validKey) {
         Response::error('Unauthorized', 401);

package/.env.example

@@ -1,8 +0,0 @@
-API_KEY=TOKEN
-CORS_ALLOWED_ORIGINS=*
-
-MAIL_HOST=smtp.gmail.com
-MAIL_PORT=587
-MAIL_USERNAME=YOUR_EMAIL
-MAIL_PASSWORD=APP_PASSWORD
-MAIL_TO_ADDRESS=EMAIL_TO_ADDRESS

package/src/api/core/.htaccess

@@ -1,2 +0,0 @@
-# Impedisce a chiunque di accedere a questa cartella tramite URL
-Require all denied

package/src/api/endpoints/protected/prova-chiusa.php

@@ -1,16 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-require_once __DIR__ . '/../../core/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-Response::success([
-    'message'    => 'Protected endpoint is working',
-    'endpoint'   => 'prova-chiusa',
-    'visibility' => 'protected',
-    'params'     => $requestParams,
-]);

package/src/api/endpoints/public/prova-aperta.php

@@ -1,16 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-require_once __DIR__ . '/../../core/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-Response::success([
-    'message'     => 'Public endpoint is working',
-    'endpoint'    => 'prova-aperta',
-    'visibility'  => 'public',
-    'params'      => $requestParams,
-]);