create-berna-stencil 2.4.3 → 2.5.0

package/README.md

@@ -12,7 +12,7 @@ Building a website from scratch involves a lot of moving parts: templating engin
 - 📁 **Scalable structure** — a clean, opinionated project layout that grows with your needs
 - 🌍 **Open source** — free to use, free to modify, free to share
 
-![Version](https://img.shields.io/badge/version-2.4.3-blue)
+![Version](https://img.shields.io/badge/version-2.5.0-blue)
 ![License](https://img.shields.io/badge/license-Apache--2.0-blue)
 ![Eleventy](https://img.shields.io/badge/11ty-v3.1.2-black)
 

package/bin/create.js

@@ -121,7 +121,7 @@ src/backend/config.php
 
 const PROJECT_PACKAGE = {
     name:      path.basename(targetDir),
-    version:   '2.4.3',
+    version:   '2.5.0',
     private:   true,
     outputDir: 'out',
     "scripts": {

package/docs/Backend.md

@@ -32,13 +32,23 @@ Copy `config.example.php` to `config.php` and fill in your values:
 ### config.php <small>(`src/backend/`)</small>
 ```php
 return [
-    // Default key for protected endpoints that don't have a specific key in ENDPOINT_KEYS
-    'API_KEY' => 'default-key',
+    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
+    'GENERAL_API_KEY' => 'default-key',
 
-    // If you want restrict access to protected endpoints to specific clients, you can define custom keys for each endpoint
-    'ENDPOINT_KEYS' => [
-    // For subfolder endpoints, use the relative path ('subfolder/endpoint')
-    // 'subfolder/endpoint'    => 'example-key',
+    // Per-endpoint keys. For subfolder endpoints, use the relative path ('subfolder/endpoint')
+    'CUSTOM_ENDPOINT_KEYS' => [
+        // 'subfolder/endpoint' => 'example-key',
+    ],
+
+    // Default CORS origins applied to every endpoint
+    'GENERAL_ALLOWED_ORIGINS' => [
+        'https://example.com',
+    ],
+
+    // Per-endpoint CORS origins. Same path format as CUSTOM_ENDPOINT_KEYS.
+    // When an endpoint is listed here, these origins replace GENERAL_ALLOWED_ORIGINS for it.
+    'CUSTOM_ENDPOINT_ORIGINS' => [
+        // 'subfolder/endpoint' => ['https://app.example.com'],
     ],
 
     'DB_HOST' => '127.0.0.1',
@@ -48,7 +58,22 @@ return [
 ];
 ```
 
-`API_KEY` is the fallback key for all protected endpoints. Use `ENDPOINT_KEYS` to assign a different key to a specific endpoint — for subfolder endpoints, use the relative path as the key.
+### API keys
+
+`GENERAL_API_KEY` is the fallback key for all protected endpoints. Use `CUSTOM_ENDPOINT_KEYS` to assign a different key to a specific endpoint — for subfolder endpoints, use the relative path as the key.
+
+> ⚠️ The API key travels in the `X-Api-Key` header on every request. Use it only for server-to-server calls over HTTPS. Never embed it in frontend code, where it would be publicly visible.
+
+### CORS (allowed origins)
+
+Cross-origin access mirrors the API-key model:
+
+- `GENERAL_ALLOWED_ORIGINS` — the default list of origins allowed to call any endpoint from a browser.
+- `CUSTOM_ENDPOINT_ORIGINS` — overrides the default for a specific endpoint, keyed by the same relative path used in `CUSTOM_ENDPOINT_KEYS`.
+
+Origins must be exact (scheme + host, no trailing slash), e.g. `https://example.com`. When a request's `Origin` is in the resolved list, it is reflected back in `Access-Control-Allow-Origin` (with `Vary: Origin`). An empty list sends no CORS header — the most restrictive setting; same-origin requests still work. Use `'*'` as the only element to allow any origin (not recommended for protected endpoints).
+
+Resolution order for a given endpoint: `CUSTOM_ENDPOINT_ORIGINS[path]` if present, otherwise `GENERAL_ALLOWED_ORIGINS`.
 
 ## How routing works
 
@@ -102,7 +127,7 @@ Response::success(['visits' => 1024]);
 To assign a dedicated key, add it to `config.php`:
 
 ```php
-'ENDPOINT_KEYS' => [
+'CUSTOM_ENDPOINT_KEYS' => [
     'endpoint' => 'custom-key',
 ],
 ```

package/nginx.conf

@@ -1,3 +1,4 @@
+# Redirect all HTTP traffic to HTTPS
 server {
     listen 80;
     server_name _;
@@ -8,12 +9,21 @@ server {
     listen 443 ssl;
     server_name _;
 
-    # ssl_certificate     /path/to/cert.pem;
-    # ssl_certificate_key /path/to/key.pem;
+    # SSL certificate — replace with your own paths.
+    # Let's Encrypt default shown below; adjust the domain.
+    ssl_certificate     /etc/letsencrypt/live/your-domain/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/your-domain/privkey.pem;
+
+    # Hide the nginx version from response headers
+    server_tokens off;
+
+    # Force HTTPS on future requests (applies site-wide, including /api)
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 
     root /var/www/html/out;
     index index.html;
 
+    # Disable directory listing
     autoindex off;
 
     error_page 403 404 /404.html;
@@ -21,25 +31,39 @@ server {
         internal;
     }
 
+    # Never expose the backend source directory
     location ^~ /backend/ {
         return 404;
     }
 
-    location ~* ^/(web\.config|llms\.txt|robots\.txt|sitemap\.xml)$ {
+    # Block server config files anywhere in the tree (.htaccess, web.config).
+    # return 404 is served internally as /404.html via error_page above.
+    location ~* (^|/)(\.htaccess|web\.config)$ {
         return 404;
     }
 
+    # Block dotfiles (.git, .env, etc.)
     location ~ /\. {
         return 404;
     }
 
+    # Route all /api/ requests to the PHP front controller.
+    # Security headers for API responses are set by the front controller (PHP).
     location ^~ /api/ {
+        try_files $uri =404;
         fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
         fastcgi_param SCRIPT_FILENAME $document_root/backend/_core/index.php;
         include fastcgi_params;
     }
 
+    # Serve static files, fall back to the 404 page.
+    # A location with add_header does not inherit server-level headers,
+    # so Strict-Transport-Security is repeated here.
     location / {
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
         try_files $uri $uri/ /404.html;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-berna-stencil",
-  "version": "2.4.3",
+  "version": "2.5.0",
   "description": "Eleventy boilerplate with per-page SCSS/JS pipeline, esbuild bundling, multi-framework CSS support and a built-in page management CLI",
   "keywords": [],
   "author": "Michele Garofalo",

package/src/backend/_core/index.php

@@ -87,14 +87,34 @@ if (!$endpointFile) {
     exit;
 }
 
+$base         = $isProtected ? $baseProtected : $basePublic;
+$base         = str_replace('\\', '/', $base);
+$endpointPath = str_replace('\\', '/', $endpointFile);
+$endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
+
 // =====================================================
 // 3. HEADERS AND CORS (Only if the endpoint exists)
 // =====================================================
 
 header('Content-Type: application/json; charset=UTF-8');
+header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: DENY');
+header('Referrer-Policy: strict-origin-when-cross-origin');
 header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
 header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
-header('Access-Control-Allow-Origin: *');
+
+$originsForEndpoint = $config['CUSTOM_ENDPOINT_ORIGINS'][$endpointPath]
+    ?? $config['GENERAL_ALLOWED_ORIGINS']
+    ?? [];
+
+$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+
+if ($origin !== '' && in_array($origin, $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: ' . $origin);
+    header('Vary: Origin');
+} elseif (in_array('*', $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: *');
+}
 
 if ($method === 'OPTIONS') {
     http_response_code(204);
@@ -109,11 +129,8 @@ RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
 // =====================================================
 
 if ($isProtected) {
-    $relPath   = str_replace($baseProtected, '', $endpointFile);
-    $relPath   = str_replace('.php', '', str_replace('\\', '/', $relPath));
-
-    $validKey  = $config['ENDPOINT_KEYS'][$relPath] ?? $config['API_KEY'] ?? '';
-    $apiKey    = $_SERVER['HTTP_X_API_KEY'] ?? '';
+    $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
+    $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
 
     if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
         Response::error('Unauthorized. X_API_KEY is incorrect or missing', 401);

package/src/backend/_core/vendor/composer/autoload_static.php

@@ -13,48 +13,48 @@ class ComposerStaticInit108be68e4e2b97fed51d36a10eed0849
     );
 
     public static $prefixLengthsPsr4 = array (
-        'S' => 
+        'S' =>
         array (
             'Symfony\\Polyfill\\Php80\\' => 23,
             'Symfony\\Polyfill\\Mbstring\\' => 26,
             'Symfony\\Polyfill\\Ctype\\' => 23,
         ),
-        'P' => 
+        'P' =>
         array (
             'PhpOption\\' => 10,
         ),
-        'G' => 
+        'G' =>
         array (
             'GrahamCampbell\\ResultType\\' => 26,
         ),
-        'D' => 
+        'D' =>
         array (
             'Dotenv\\' => 7,
         ),
     );
 
     public static $prefixDirsPsr4 = array (
-        'Symfony\\Polyfill\\Php80\\' => 
+        'Symfony\\Polyfill\\Php80\\' =>
         array (
             0 => __DIR__ . '/..' . '/symfony/polyfill-php80',
         ),
-        'Symfony\\Polyfill\\Mbstring\\' => 
+        'Symfony\\Polyfill\\Mbstring\\' =>
         array (
             0 => __DIR__ . '/..' . '/symfony/polyfill-mbstring',
         ),
-        'Symfony\\Polyfill\\Ctype\\' => 
+        'Symfony\\Polyfill\\Ctype\\' =>
         array (
             0 => __DIR__ . '/..' . '/symfony/polyfill-ctype',
         ),
-        'PhpOption\\' => 
+        'PhpOption\\' =>
         array (
             0 => __DIR__ . '/..' . '/phpoption/phpoption/src/PhpOption',
         ),
-        'GrahamCampbell\\ResultType\\' => 
+        'GrahamCampbell\\ResultType\\' =>
         array (
             0 => __DIR__ . '/..' . '/graham-campbell/result-type/src',
         ),
-        'Dotenv\\' => 
+        'Dotenv\\' =>
         array (
             0 => __DIR__ . '/..' . '/vlucas/phpdotenv/src',
         ),

package/src/backend/_core/vendor/composer/installed.json

@@ -24,7 +24,7 @@
             },
             "time": "2025-12-27T19:43:20+00:00",
             "type": "library",
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "psr-4": {
                     "GrahamCampbell\\ResultType\\": "src/"
@@ -98,7 +98,7 @@
                     "dev-master": "1.9-dev"
                 }
             },
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "psr-4": {
                     "PhpOption\\": "src/PhpOption/"
@@ -175,7 +175,7 @@
                     "name": "symfony/polyfill"
                 }
             },
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "files": [
                     "bootstrap.php"
@@ -262,7 +262,7 @@
                     "name": "symfony/polyfill"
                 }
             },
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "files": [
                     "bootstrap.php"
@@ -343,7 +343,7 @@
                     "name": "symfony/polyfill"
                 }
             },
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "files": [
                     "bootstrap.php"
@@ -447,7 +447,7 @@
                     "dev-master": "5.6-dev"
                 }
             },
-            "installation-source": "source",
+            "installation-source": "dist",
             "autoload": {
                 "psr-4": {
                     "Dotenv\\": "src/"

package/src/backend/_core/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => '4da27b8f50bb1a801f88ad46a9e9eafa51c1bb34',
+        'reference' => '9bbb36794fc27d6938523db2d4076661ad9ddab9',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => '4da27b8f50bb1a801f88ad46a9e9eafa51c1bb34',
+            'reference' => '9bbb36794fc27d6938523db2d4076661ad9ddab9',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

package/src/backend/_core/vendor/graham-campbell/result-type/LICENSE

@@ -1,21 +1,21 @@
-The MIT License (MIT)
-
-Copyright (c) 2020-2024 Graham Campbell <hello@gjcampbell.co.uk>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+The MIT License (MIT)
+
+Copyright (c) 2020-2024 Graham Campbell <hello@gjcampbell.co.uk>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/src/backend/_core/vendor/graham-campbell/result-type/composer.json

@@ -1,33 +1,33 @@
-{
-    "name": "graham-campbell/result-type",
-    "description": "An Implementation Of The Result Type",
-    "keywords": ["result", "result-type", "Result", "Result Type", "Result-Type", "Graham Campbell", "GrahamCampbell"],
-    "license": "MIT",
-    "authors": [
-        {
-            "name": "Graham Campbell",
-            "email": "hello@gjcampbell.co.uk",
-            "homepage": "https://github.com/GrahamCampbell"
-        }
-    ],
-    "require": {
-        "php": "^7.2.5 || ^8.0",
-        "phpoption/phpoption": "^1.9.5"
-    },
-    "require-dev": {
-        "phpunit/phpunit": "^8.5.41 || ^9.6.22 || ^10.5.45 || ^11.5.7"
-    },
-    "autoload": {
-        "psr-4": {
-            "GrahamCampbell\\ResultType\\": "src/"
-        }
-    },
-    "autoload-dev": {
-        "psr-4": {
-            "GrahamCampbell\\Tests\\ResultType\\": "tests/"
-        }
-    },
-    "config": {
-        "preferred-install": "dist"
-    }
-}
+{
+    "name": "graham-campbell/result-type",
+    "description": "An Implementation Of The Result Type",
+    "keywords": ["result", "result-type", "Result", "Result Type", "Result-Type", "Graham Campbell", "GrahamCampbell"],
+    "license": "MIT",
+    "authors": [
+        {
+            "name": "Graham Campbell",
+            "email": "hello@gjcampbell.co.uk",
+            "homepage": "https://github.com/GrahamCampbell"
+        }
+    ],
+    "require": {
+        "php": "^7.2.5 || ^8.0",
+        "phpoption/phpoption": "^1.9.5"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^8.5.41 || ^9.6.22 || ^10.5.45 || ^11.5.7"
+    },
+    "autoload": {
+        "psr-4": {
+            "GrahamCampbell\\ResultType\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "GrahamCampbell\\Tests\\ResultType\\": "tests/"
+        }
+    },
+    "config": {
+        "preferred-install": "dist"
+    }
+}