create-prisma-php-app 4.4.6-beta → 4.4.6

package/dist/bootstrap.php

@@ -8,7 +8,10 @@ require_once __DIR__ . '/settings/paths.php';
 use Dotenv\Dotenv;
 use Lib\Middleware\CorsMiddleware;
 
-Dotenv::createImmutable(DOCUMENT_PATH)->load();
+if (file_exists(DOCUMENT_PATH . '/.env')) {
+    Dotenv::createImmutable(DOCUMENT_PATH)->safeLoad();
+}
+
 CorsMiddleware::handle();
 
 if (session_status() === PHP_SESSION_NONE) {
@@ -24,9 +27,11 @@ use PP\MainLayout;
 use PP\PHPX\TemplateCompiler;
 use PP\CacheHandler;
 use PP\ErrorHandler;
-use Firebase\JWT\JWT;
-use Firebase\JWT\Key;
-use PP\PartialRenderer;
+use PP\Attributes\Exposed;
+use PP\Attributes\ExposedRegistry;
+use PP\Streaming\SSE;
+use PP\Security\RateLimiter;
+use PP\Env;
 
 final class Bootstrap extends RuntimeException
 {
@@ -40,8 +45,6 @@ final class Bootstrap extends RuntimeException
     public static bool $isContentVariableIncluded = false;
     public static bool $secondRequestC69CD = false;
     public static array $requestFilesData = [];
-    public static array $partialSelectors = [];
-    public static bool  $isPartialRequest = false;
 
     private string $context;
 
@@ -61,7 +64,7 @@ final class Bootstrap extends RuntimeException
 
     public static function run(): void
     {
-        date_default_timezone_set($_ENV['APP_TIMEZONE'] ?? 'UTC');
+        date_default_timezone_set(Env::string('APP_TIMEZONE', 'UTC'));
 
         PrismaPHPSettings::init();
         Request::init();
@@ -78,7 +81,7 @@ final class Bootstrap extends RuntimeException
             'samesite' => 'Lax',
         ]);
 
-        self::functionCallNameEncrypt();
+        self::setCsrfCookie();
 
         self::$secondRequestC69CD = Request::$data['secondRequestC69CD'] ?? false;
 
@@ -106,24 +109,20 @@ final class Bootstrap extends RuntimeException
         self::authenticateUserToken();
 
         self::$requestFilePath = APP_PATH . Request::$pathname;
-        self::$parentLayoutPath = APP_PATH . '/layout.php';
 
-        self::$isParentLayout = !empty(self::$layoutsToInclude)
-            && strpos(self::$layoutsToInclude[0], 'src/app/layout.php') !== false;
+        if (!empty(self::$layoutsToInclude)) {
+            self::$parentLayoutPath = self::$layoutsToInclude[0];
+            self::$isParentLayout = true;
+        } else {
+            self::$parentLayoutPath = APP_PATH . '/layout.php';
+            self::$isParentLayout = false;
+        }
 
         self::$isContentVariableIncluded = self::containsChildren(self::$parentLayoutPath);
         if (!self::$isContentVariableIncluded) {
             self::$isContentIncluded = true;
         }
 
-        self::$isPartialRequest =
-            !empty(Request::$data['ppSync71163'])
-            && !empty(Request::$data['selectors'])
-            && self::$secondRequestC69CD;
-
-        if (self::$isPartialRequest) {
-            self::$partialSelectors = (array)Request::$data['selectors'];
-        }
         self::$requestFilesData = PrismaPHPSettings::$includeFiles;
 
         ErrorHandler::checkFatalError();
@@ -131,66 +130,77 @@ final class Bootstrap extends RuntimeException
 
     private static function isLocalStoreCallback(): void
     {
-        $data = self::getRequestData();
-
-        if (empty($data['callback'])) {
-            self::jsonExit(['success' => false, 'error' => 'Callback not provided', 'response' => null]);
+        if (empty($_SERVER['HTTP_X_PP_FUNCTION'])) {
+            return;
         }
 
-        try {
-            $aesKey = self::getAesKeyFromJwt();
-        } catch (RuntimeException $e) {
-            self::jsonExit(['success' => false, 'error' => $e->getMessage()]);
-        }
-
-        try {
-            $callbackName = self::decryptCallback($data['callback'], $aesKey);
-        } catch (RuntimeException $e) {
-            self::jsonExit(['success' => false, 'error' => $e->getMessage()]);
-        }
+        $callbackName = $_SERVER['HTTP_X_PP_FUNCTION'];
 
         if ($callbackName === PrismaPHPSettings::$localStoreKey) {
+            self::validateCsrfToken();
             self::jsonExit(['success' => true, 'response' => 'localStorage updated']);
         }
     }
 
-    private static function functionCallNameEncrypt(): void
+    private static function setCsrfCookie(): void
     {
-        $hmacSecret = $_ENV['FUNCTION_CALL_SECRET'] ?? '';
-        if ($hmacSecret === '') {
-            throw new RuntimeException("FUNCTION_CALL_SECRET is not set");
-        }
+        $secret = Env::string('FUNCTION_CALL_SECRET', 'pp_default_insecure_secret');
+        $shouldRegenerate = true;
 
-        $existing = $_COOKIE['pp_function_call_jwt'] ?? null;
-        if ($existing) {
-            try {
-                $decoded = JWT::decode($existing, new Key($hmacSecret, 'HS256'));
-                if (isset($decoded->exp) && $decoded->exp > time() + 15) {
-                    return;
+        if (isset($_COOKIE['prisma_php_csrf'])) {
+            $parts = explode('.', $_COOKIE['prisma_php_csrf']);
+            if (count($parts) === 2) {
+                [$nonce, $signature] = $parts;
+                $expectedSignature = hash_hmac('sha256', $nonce, $secret);
+
+                if (hash_equals($expectedSignature, $signature)) {
+                    $shouldRegenerate = false;
                 }
-            } catch (Throwable) {
             }
         }
 
-        $aesKey  = random_bytes(32);
-        $payload = [
-            'k'   => base64_encode($aesKey),
-            'exp' => time() + 3600,
-            'iat' => time(),
-        ];
-        $jwt = JWT::encode($payload, $hmacSecret, 'HS256');
+        if ($shouldRegenerate) {
+            $nonce = bin2hex(random_bytes(16));
+            $signature = hash_hmac('sha256', $nonce, $secret);
+            $token = $nonce . '.' . $signature;
 
-        setcookie(
-            'pp_function_call_jwt',
-            $jwt,
-            [
-                'expires'  => $payload['exp'],
+            setcookie('prisma_php_csrf', $token, [
+                'expires'  => time() + 3600,
                 'path'     => '/',
                 'secure'   => true,
                 'httponly' => false,
-                'samesite' => 'Strict',
-            ]
-        );
+                'samesite' => 'Lax',
+            ]);
+
+            $_COOKIE['prisma_php_csrf'] = $token;
+        }
+    }
+
+    private static function validateCsrfToken(): void
+    {
+        $headerToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+        $cookieToken = $_COOKIE['prisma_php_csrf'] ?? '';
+        $secret = Env::string('FUNCTION_CALL_SECRET', '');
+
+        if (empty($headerToken) || empty($cookieToken)) {
+            self::jsonExit(['success' => false, 'error' => 'CSRF token missing']);
+        }
+
+        if (!hash_equals($cookieToken, $headerToken)) {
+            self::jsonExit(['success' => false, 'error' => 'CSRF token mismatch']);
+        }
+
+        $parts = explode('.', $cookieToken);
+        if (count($parts) !== 2) {
+            self::jsonExit(['success' => false, 'error' => 'Invalid CSRF token format']);
+        }
+
+        [$nonce, $signature] = $parts;
+        $expectedSignature = hash_hmac('sha256', $nonce, $secret);
+
+        if (!hash_equals($expectedSignature, $signature)) {
+            self::jsonExit(['success' => false, 'error' => 'Invalid CSRF token signature']);
+        }
     }
 
     private static function fileExistsCached(string $path): bool
@@ -212,12 +222,11 @@ final class Bootstrap extends RuntimeException
 
     private static function determineContentToInclude(): array
     {
-        $requestUri = $_SERVER['REQUEST_URI'];
-        $requestUri = empty($_SERVER['SCRIPT_URL']) ? trim(self::uriExtractor($requestUri)) : trim($requestUri);
+        $requestUri = $_SERVER['REQUEST_URI'] ?? '/';
+        $requestUri = trim(self::uriExtractor($requestUri));
 
         $scriptUrl = explode('?', $requestUri, 2)[0];
-        $pathname = $_SERVER['SCRIPT_URL'] ?? $scriptUrl;
-        $pathname = trim($pathname, '/');
+        $pathname = trim($scriptUrl, '/');
         $baseDir = APP_PATH;
         $includePath = '';
         $layoutsToInclude = [];
@@ -270,79 +279,252 @@ final class Bootstrap extends RuntimeException
                 }
             }
 
+            $layoutsToInclude = self::collectLayouts($pathname, $groupFolder, $dynamicRoute ?? null);
+        } else {
+            $contentData = self::getFilePrecedence();
+            $includePath = $baseDir . $contentData['file'];
+            $layoutsToInclude = self::collectRootLayouts($contentData['file']);
+        }
+
+        return [
+            'path' => $includePath,
+            'layouts' => $layoutsToInclude,
+            'pathname' => $pathname,
+            'uri' => $requestUri
+        ];
+    }
+
+    private static function collectLayouts(string $pathname, ?string $groupFolder, ?string $dynamicRoute): array
+    {
+        $layoutsToInclude = [];
+        $baseDir = APP_PATH;
+
+        $rootLayout = $baseDir . '/layout.php';
+        if (self::fileExistsCached($rootLayout)) {
+            $layoutsToInclude[] = $rootLayout;
+        }
+
+        $groupName = null;
+        $groupParentPath = '';
+        $pathAfterGroup = '';
+
+        if ($groupFolder) {
+            $normalizedGroupFolder = str_replace('\\', '/', $groupFolder);
+
+            if (preg_match('#^\.?/src/app/(.+)/\(([^)]+)\)/(.+)$#', $normalizedGroupFolder, $matches)) {
+                $groupParentPath = $matches[1];
+                $groupName = $matches[2];
+                $pathAfterGroup = dirname($matches[3]);
+                if ($pathAfterGroup === '.') {
+                    $pathAfterGroup = '';
+                }
+            } elseif (preg_match('#^\.?/src/app/\(([^)]+)\)/(.+)$#', $normalizedGroupFolder, $matches)) {
+                $groupName = $matches[1];
+                $pathAfterGroup = dirname($matches[2]);
+                if ($pathAfterGroup === '.') {
+                    $pathAfterGroup = '';
+                }
+            }
+        }
+
+        if ($groupName && $groupParentPath) {
             $currentPath = $baseDir;
-            $getGroupFolder = self::getGroupFolder($groupFolder);
-            $modifiedPathname = $pathname;
-            if (!empty($getGroupFolder)) {
-                $modifiedPathname = trim($getGroupFolder, "/src/app/");
+            foreach (explode('/', $groupParentPath) as $segment) {
+                if (empty($segment)) continue;
+
+                $currentPath .= '/' . $segment;
+                $potentialLayoutPath = $currentPath . '/layout.php';
+
+                if (self::fileExistsCached($potentialLayoutPath) && !in_array($potentialLayoutPath, $layoutsToInclude, true)) {
+                    $layoutsToInclude[] = $potentialLayoutPath;
+                }
             }
 
-            foreach (explode('/', $modifiedPathname) as $segment) {
-                if (empty($segment)) {
-                    continue;
+            $groupLayoutPath = $baseDir . '/' . $groupParentPath . "/($groupName)/layout.php";
+            if (self::fileExistsCached($groupLayoutPath)) {
+                $layoutsToInclude[] = $groupLayoutPath;
+            }
+
+            if (!empty($pathAfterGroup)) {
+                $currentPath = $baseDir . '/' . $groupParentPath . "/($groupName)";
+                foreach (explode('/', $pathAfterGroup) as $segment) {
+                    if (empty($segment)) continue;
+
+                    $currentPath .= '/' . $segment;
+                    $potentialLayoutPath = $currentPath . '/layout.php';
+
+                    if (self::fileExistsCached($potentialLayoutPath) && !in_array($potentialLayoutPath, $layoutsToInclude, true)) {
+                        $layoutsToInclude[] = $potentialLayoutPath;
+                    }
+                }
+            }
+        } elseif ($groupName && !$groupParentPath) {
+            $groupLayoutPath = $baseDir . "/($groupName)/layout.php";
+            if (self::fileExistsCached($groupLayoutPath)) {
+                $layoutsToInclude[] = $groupLayoutPath;
+            }
+
+            if (!empty($pathAfterGroup)) {
+                $currentPath = $baseDir . "/($groupName)";
+                foreach (explode('/', $pathAfterGroup) as $segment) {
+                    if (empty($segment)) continue;
+
+                    $currentPath .= '/' . $segment;
+                    $potentialLayoutPath = $currentPath . '/layout.php';
+
+                    if (self::fileExistsCached($potentialLayoutPath) && !in_array($potentialLayoutPath, $layoutsToInclude, true)) {
+                        $layoutsToInclude[] = $potentialLayoutPath;
+                    }
                 }
+            }
+        } else {
+            $currentPath = $baseDir;
+            foreach (explode('/', $pathname) as $segment) {
+                if (empty($segment)) continue;
 
                 $currentPath .= '/' . $segment;
                 $potentialLayoutPath = $currentPath . '/layout.php';
+
+                if ($potentialLayoutPath === $rootLayout) {
+                    continue;
+                }
+
                 if (self::fileExistsCached($potentialLayoutPath) && !in_array($potentialLayoutPath, $layoutsToInclude, true)) {
                     $layoutsToInclude[] = $potentialLayoutPath;
                 }
             }
+        }
 
-            if (isset($dynamicRoute) && !empty($dynamicRoute)) {
-                $currentDynamicPath = $baseDir;
-                foreach (explode('/', $dynamicRoute) as $segment) {
-                    if (empty($segment)) {
-                        continue;
-                    }
-                    if ($segment === 'src' || $segment === 'app') {
+        if (isset($dynamicRoute) && !empty($dynamicRoute)) {
+            $currentDynamicPath = $baseDir;
+            foreach (explode('/', $dynamicRoute) as $segment) {
+                if (empty($segment) || $segment === 'src' || $segment === 'app') {
+                    continue;
+                }
+
+                $currentDynamicPath .= '/' . $segment;
+                $potentialDynamicRoute = $currentDynamicPath . '/layout.php';
+                if (self::fileExistsCached($potentialDynamicRoute) && !in_array($potentialDynamicRoute, $layoutsToInclude, true)) {
+                    $layoutsToInclude[] = $potentialDynamicRoute;
+                }
+            }
+        }
+
+        if (empty($layoutsToInclude)) {
+            $layoutsToInclude = self::findFirstGroupLayout();
+        }
+
+        return $layoutsToInclude;
+    }
+
+    private static function collectRootLayouts(?string $matchedContentFile = null): array
+    {
+        $layoutsToInclude = [];
+        $baseDir = APP_PATH;
+        $rootLayout = $baseDir . '/layout.php';
+
+        if (self::fileExistsCached($rootLayout)) {
+            $layoutsToInclude[] = $rootLayout;
+        } else {
+            $layoutsToInclude = self::findFirstGroupLayout($matchedContentFile);
+
+            if (empty($layoutsToInclude)) {
+                return [];
+            }
+        }
+
+        return $layoutsToInclude;
+    }
+
+    private static function findFirstGroupLayout(?string $matchedContentFile = null): array
+    {
+        $baseDir = APP_PATH;
+        $layoutsToInclude = [];
+
+        if (is_dir($baseDir)) {
+            $items = scandir($baseDir);
+
+            if ($matchedContentFile) {
+                foreach ($items as $item) {
+                    if ($item === '.' || $item === '..') {
                         continue;
                     }
 
-                    $currentDynamicPath .= '/' . $segment;
-                    $potentialDynamicRoute = $currentDynamicPath . '/layout.php';
-                    if (self::fileExistsCached($potentialDynamicRoute) && !in_array($potentialDynamicRoute, $layoutsToInclude, true)) {
-                        $layoutsToInclude[] = $potentialDynamicRoute;
+                    if (preg_match('/^\([^)]+\)$/', $item)) {
+                        if (strpos($matchedContentFile, "/$item/") === 0) {
+                            $groupLayoutPath = $baseDir . '/' . $item . '/layout.php';
+                            if (self::fileExistsCached($groupLayoutPath)) {
+                                $layoutsToInclude[] = $groupLayoutPath;
+                                return $layoutsToInclude;
+                            }
+                        }
                     }
                 }
             }
 
-            if (empty($layoutsToInclude)) {
-                $layoutsToInclude[] = $baseDir . '/layout.php';
+            foreach ($items as $item) {
+                if ($item === '.' || $item === '..') {
+                    continue;
+                }
+
+                if (preg_match('/^\([^)]+\)$/', $item)) {
+                    $groupLayoutPath = $baseDir . '/' . $item . '/layout.php';
+                    if (self::fileExistsCached($groupLayoutPath)) {
+                        $layoutsToInclude[] = $groupLayoutPath;
+                        break;
+                    }
+                }
             }
-        } else {
-            $includePath = $baseDir . self::getFilePrecedence();
         }
 
-        return [
-            'path' => $includePath,
-            'layouts' => $layoutsToInclude,
-            'pathname' => $pathname,
-            'uri' => $requestUri
-        ];
+        return $layoutsToInclude;
     }
 
-    private static function getFilePrecedence(): ?string
+    private static function getFilePrecedence(): array
     {
+        $baseDir = APP_PATH;
+        $result = ['file' => null];
+
         foreach (PrismaPHPSettings::$routeFiles as $route) {
             if (pathinfo($route, PATHINFO_EXTENSION) !== 'php') {
                 continue;
             }
             if (preg_match('/^\.\/src\/app\/route\.php$/', $route)) {
-                return '/route.php';
+                return ['file' => '/route.php'];
             }
             if (preg_match('/^\.\/src\/app\/index\.php$/', $route)) {
-                return '/index.php';
+                return ['file' => '/index.php'];
+            }
+        }
+
+        if (is_dir($baseDir)) {
+            $items = scandir($baseDir);
+            foreach ($items as $item) {
+                if ($item === '.' || $item === '..') {
+                    continue;
+                }
+
+                if (preg_match('/^\([^)]+\)$/', $item)) {
+                    $groupDir = $baseDir . '/' . $item;
+
+                    if (file_exists($groupDir . '/route.php')) {
+                        return ['file' => '/' . $item . '/route.php'];
+                    }
+                    if (file_exists($groupDir . '/index.php')) {
+                        return ['file' => '/' . $item . '/index.php'];
+                    }
+                }
             }
         }
-        return null;
+
+        return $result;
     }
 
     private static function uriExtractor(string $scriptUrl): string
     {
         $projectName = PrismaPHPSettings::$option->projectName ?? '';
         if (empty($projectName)) {
-            return "/";
+            return $scriptUrl;
         }
 
         $escapedIdentifier = preg_quote($projectName, '/');
@@ -350,7 +532,7 @@ final class Bootstrap extends RuntimeException
             return rtrim(ltrim($matches[1], '/'), '/');
         }
 
-        return "/";
+        return $scriptUrl;
     }
 
     private static function findGroupFolder(string $pathname): string
@@ -484,6 +666,7 @@ final class Bootstrap extends RuntimeException
             if (pathinfo($route, PATHINFO_EXTENSION) !== 'php') {
                 continue;
             }
+
             $normalizedRoute = trim(str_replace('\\', '/', $route), '.');
             $cleanedRoute = preg_replace('/\/\([^)]+\)/', '', $normalizedRoute);
 
@@ -495,22 +678,26 @@ final class Bootstrap extends RuntimeException
             }
         }
 
-        return $bestMatch;
-    }
+        if (!$bestMatch) {
+            foreach (PrismaPHPSettings::$routeFiles as $route) {
+                if (pathinfo($route, PATHINFO_EXTENSION) !== 'php') {
+                    continue;
+                }
 
-    private static function getGroupFolder($pathname): string
-    {
-        $lastSlashPos = strrpos($pathname, '/');
-        if ($lastSlashPos === false) {
-            return "";
-        }
+                $normalizedRoute = trim(str_replace('\\', '/', $route), '.');
+
+                if (preg_match('/\/\(([^)]+)\)\//', $normalizedRoute, $matches)) {
+                    $cleanedRoute = preg_replace('/\/\([^)]+\)/', '', $normalizedRoute);
 
-        $pathWithoutFile = substr($pathname, 0, $lastSlashPos);
-        if (preg_match('/\(([^)]+)\)[^()]*$/', $pathWithoutFile, $matches)) {
-            return $pathWithoutFile;
+                    if ($cleanedRoute === $routeFile || $cleanedRoute === $indexFile) {
+                        $bestMatch = $normalizedRoute;
+                        break;
+                    }
+                }
+            }
         }
 
-        return "";
+        return $bestMatch;
     }
 
     private static function singleDynamicRoute($pathnameSegments, $routeSegments)
@@ -530,7 +717,7 @@ final class Bootstrap extends RuntimeException
 
     private static function checkForDuplicateRoutes(): void
     {
-        if (isset($_ENV['APP_ENV']) && $_ENV['APP_ENV'] === 'production') {
+        if (Env::string('APP_ENV', 'production') === 'production') {
             return;
         }
 
@@ -579,7 +766,7 @@ final class Bootstrap extends RuntimeException
         }
     }
 
-    public static function containsChildLayoutChildren($filePath): bool
+    public static function containsChildren($filePath): bool
     {
         if (!self::fileExistsCached($filePath)) {
             return false;
@@ -590,118 +777,76 @@ final class Bootstrap extends RuntimeException
             return false;
         }
 
-        $pattern = '/\<\?=\s*MainLayout::\$childLayoutChildren\s*;?\s*\?>|echo\s*MainLayout::\$childLayoutChildren\s*;?/';
+        $pattern = '/\<\?=\s*MainLayout::\$children\s*;?\s*\?>|echo\s*MainLayout::\$children\s*;?/';
         return (bool) preg_match($pattern, $fileContent);
     }
 
-    private static function containsChildren($filePath): bool
+    private static function convertToArrayObject($data)
     {
-        if (!self::fileExistsCached($filePath)) {
-            return false;
+        if (!is_array($data)) {
+            return $data;
         }
 
-        $fileContent = @file_get_contents($filePath);
-        if ($fileContent === false) {
-            return false;
+        if (empty($data)) {
+            return $data;
         }
 
-        $pattern = '/\<\?=\s*MainLayout::\$children\s*;?\s*\?>|echo\s*MainLayout::\$children\s*;?/';
-        return (bool) preg_match($pattern, $fileContent);
-    }
+        $isAssoc = array_keys($data) !== range(0, count($data) - 1);
 
-    private static function convertToArrayObject($data)
-    {
-        return is_array($data) ? (object) $data : $data;
+        if ($isAssoc) {
+            $obj = new stdClass();
+            foreach ($data as $key => $value) {
+                $obj->$key = self::convertToArrayObject($value);
+            }
+            return $obj;
+        } else {
+            return array_map([self::class, 'convertToArrayObject'], $data);
+        }
     }
 
     public static function wireCallback(): void
     {
-        $data = self::getRequestData();
+        $callbackName = $_SERVER['HTTP_X_PP_FUNCTION'] ?? null;
 
-        if (empty($data['callback'])) {
-            self::jsonExit(['success' => false, 'error' => 'Callback not provided', 'response' => null]);
+        if (empty($callbackName)) {
+            self::jsonExit(['success' => false, 'error' => 'Callback header not provided', 'response' => null]);
         }
 
-        try {
-            $aesKey = self::getAesKeyFromJwt();
-        } catch (RuntimeException $e) {
-            self::jsonExit(['success' => false, 'error' => $e->getMessage()]);
-        }
+        self::validateCsrfToken();
 
-        try {
-            $callbackName = self::decryptCallback($data['callback'], $aesKey);
-        } catch (RuntimeException $e) {
-            self::jsonExit(['success' => false, 'error' => $e->getMessage()]);
+        if (!preg_match('/^[a-zA-Z0-9_:\->]+$/', $callbackName)) {
+            self::jsonExit(['success' => false, 'error' => 'Invalid callback format']);
         }
 
+        $data = self::getRequestData();
         $args = self::convertToArrayObject($data);
-        $out  = str_contains($callbackName, '->') || str_contains($callbackName, '::')
+
+        $out = str_contains($callbackName, '->') || str_contains($callbackName, '::')
             ? self::dispatchMethod($callbackName, $args)
             : self::dispatchFunction($callbackName, $args);
 
-        if ($out !== null) {
-            self::jsonExit($out);
-        }
-        exit;
-    }
-
-    private static function getAesKeyFromJwt(): string
-    {
-        $token     = $_COOKIE['pp_function_call_jwt'] ?? null;
-        $jwtSecret = $_ENV['FUNCTION_CALL_SECRET'] ?? null;
-
-        if (!$token || !$jwtSecret) {
-            throw new RuntimeException('Missing session key or secret');
+        if ($out instanceof SSE) {
+            $out->send();
+            exit;
         }
 
-        try {
-            $decoded = JWT::decode($token, new Key($jwtSecret, 'HS256'));
-        } catch (Throwable) {
-            throw new RuntimeException('Invalid session key');
+        if ($out instanceof Generator) {
+            (new SSE($out))->send();
+            exit;
         }
 
-        $aesKey = base64_decode($decoded->k, true);
-        if ($aesKey === false || strlen($aesKey) !== 32) {
-            throw new RuntimeException('Bad key length');
+        if ($out !== null) {
+            self::jsonExit($out);
         }
-
-        return $aesKey;
+        exit;
     }
 
-    private static function jsonExit(array $payload): void
+    private static function jsonExit(mixed $payload): void
     {
         echo json_encode($payload, JSON_UNESCAPED_UNICODE);
         exit;
     }
 
-    private static function decryptCallback(string $encrypted, string $aesKey): string
-    {
-        $parts = explode(':', $encrypted, 2);
-        if (count($parts) !== 2) {
-            throw new RuntimeException('Malformed callback payload');
-        }
-        [$ivB64, $ctB64] = $parts;
-
-        $iv = base64_decode($ivB64, true);
-        $ct = base64_decode($ctB64, true);
-
-        if ($iv === false || strlen($iv) !== 16 || $ct === false) {
-            throw new RuntimeException('Invalid callback payload');
-        }
-
-        $plain = openssl_decrypt($ct, 'AES-256-CBC', $aesKey, OPENSSL_RAW_DATA, $iv);
-        if ($plain === false) {
-            throw new RuntimeException('Decryption failed');
-        }
-
-        $callback = preg_replace('/[^a-zA-Z0-9_:\->]/', '', $plain);
-        if ($callback === '' || $callback[0] === '_') {
-            throw new RuntimeException('Invalid callback');
-        }
-
-        return $callback;
-    }
-
     private static function getRequestData(): array
     {
         if (!empty($_FILES)) {
@@ -729,17 +874,140 @@ final class Bootstrap extends RuntimeException
         return (json_last_error() === JSON_ERROR_NONE) ? $json : $_POST;
     }
 
+    private static function validateAccess(Exposed $attribute): bool
+    {
+        if ($attribute->requiresAuth || !empty($attribute->allowedRoles)) {
+            $auth = Auth::getInstance();
+
+            if (!$auth->isAuthenticated()) {
+                return false;
+            }
+
+            if (!empty($attribute->allowedRoles)) {
+                $payload = $auth->getPayload();
+                $currentRole = null;
+
+                if (is_scalar($payload)) {
+                    $currentRole = $payload;
+                } else {
+                    $roleKey = !empty(Auth::ROLE_NAME) ? Auth::ROLE_NAME : 'role';
+
+                    if (is_object($payload)) {
+                        $currentRole = $payload->$roleKey ?? null;
+                    } elseif (is_array($payload)) {
+                        $currentRole = $payload[$roleKey] ?? null;
+                    }
+                }
+
+                if ($currentRole === null || !in_array($currentRole, $attribute->allowedRoles)) {
+                    return false;
+                }
+            }
+        }
+
+        return true;
+    }
+
+    private static function isFunctionAllowed(string $fn): bool
+    {
+        try {
+            $ref = new ReflectionFunction($fn);
+            $attrs = $ref->getAttributes(Exposed::class);
+
+            if (empty($attrs)) {
+                return false;
+            }
+
+            return self::validateAccess($attrs[0]->newInstance());
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    private static function isMethodAllowed(string $class, string $method): bool
+    {
+        try {
+            $ref = new ReflectionMethod($class, $method);
+            $attrs = $ref->getAttributes(Exposed::class);
+
+            if (empty($attrs)) {
+                return false;
+            }
+
+            return self::validateAccess($attrs[0]->newInstance());
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
+    private static function getExposedAttribute(string $classOrFn, ?string $method = null): ?Exposed
+    {
+        try {
+            if ($method) {
+                $ref = new ReflectionMethod($classOrFn, $method);
+            } else {
+                $ref = new ReflectionFunction($classOrFn);
+            }
+
+            $attrs = $ref->getAttributes(Exposed::class);
+            return !empty($attrs) ? $attrs[0]->newInstance() : null;
+        } catch (Throwable) {
+            return null;
+        }
+    }
+
+    private static function enforceRateLimit(Exposed $attribute, string $identifier): void
+    {
+        $limits = $attribute->limits;
+
+        if (empty($limits)) {
+            if ($attribute->requiresAuth) {
+                $limits = Env::string('RATE_LIMIT_AUTH', '60/minute');
+            } else {
+                $limits = Env::string('RATE_LIMIT_RPC', '60/minute');
+            }
+        }
+
+        if ($limits) {
+            RateLimiter::verify($identifier, $limits);
+        }
+    }
+
     private static function dispatchFunction(string $fn, mixed $args)
     {
+        if (!function_exists($fn)) {
+            $resolved = ExposedRegistry::resolveFunction($fn);
+            if ($resolved) {
+                $fn = $resolved;
+            }
+        }
+
+        if (!self::isFunctionAllowed($fn)) {
+            return ['success' => false, 'error' => 'Function not callable from client'];
+        }
+
+        $attribute = self::getExposedAttribute($fn);
+        if (!self::validateAccess($attribute)) {
+            return ['success' => false, 'error' => 'Permission denied'];
+        }
+
         if (function_exists($fn) && is_callable($fn)) {
             try {
+                self::enforceRateLimit($attribute, "fn:$fn");
+
                 $res = call_user_func($fn, $args);
-                if ($res !== null) {
-                    return ['success' => true, 'error' => null, 'response' => $res];
+
+                if ($res instanceof Generator || $res instanceof SSE) {
+                    return $res;
                 }
+
                 return $res;
             } catch (Throwable $e) {
-                if (isset($_ENV['SHOW_ERRORS']) && $_ENV['SHOW_ERRORS'] === 'false') {
+                if ($e->getMessage() === 'Rate limit exceeded. Try again later.') {
+                    return ['success' => false, 'error' => $e->getMessage()];
+                }
+
+                if (Env::string('SHOW_ERRORS', 'false') === 'false') {
                     return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
                 } else {
                     return ['success' => false, 'error' => "Function error: {$e->getMessage()}"];
@@ -752,14 +1020,15 @@ final class Bootstrap extends RuntimeException
     private static function dispatchMethod(string $call, mixed $args)
     {
         if (strpos($call, '->') !== false) {
-            list($requested, $method) = explode('->', $call, 2);
+            [$requested, $method] = explode('->', $call, 2);
             $isStatic = false;
         } else {
-            list($requested, $method) = explode('::', $call, 2);
+            [$requested, $method] = explode('::', $call, 2);
             $isStatic = true;
         }
 
         $class = $requested;
+
         if (!class_exists($class)) {
             if ($import = self::resolveClassImport($requested)) {
                 require_once $import['file'];
@@ -767,47 +1036,52 @@ final class Bootstrap extends RuntimeException
             }
         }
 
-        if (!$isStatic) {
-            if (!class_exists($class)) {
-                return ['success' => false, 'error' => "Class '$requested' not found"];
-            }
-            $instance = new $class();
-            if (!is_callable([$instance, $method])) {
-                return ['success' => false, 'error' => "Method '$method' not callable on $class"];
-            }
-            try {
+        if (!class_exists($class)) {
+            return ['success' => false, 'error' => "Class '$requested' not found"];
+        }
+
+        if (!self::isMethodAllowed($class, $method)) {
+            return ['success' => false, 'error' => 'Method not callable from client'];
+        }
+
+        $attribute = self::getExposedAttribute($class, $method);
+        if (!$attribute) {
+            return ['success' => false, 'error' => 'Method not callable from client'];
+        }
+
+        if (!self::validateAccess($attribute)) {
+            return ['success' => false, 'error' => 'Permission denied'];
+        }
+
+        try {
+            self::enforceRateLimit($attribute, "method:$class::$method");
+
+            $res = null;
+            if (!$isStatic) {
+                $instance = new $class();
+                if (!is_callable([$instance, $method])) throw new Exception("Method not callable");
                 $res = call_user_func([$instance, $method], $args);
-                if ($res !== null) {
-                    return ['success' => true, 'error' => null, 'response' => $res];
-                }
+            } else {
+                if (!is_callable([$class, $method])) throw new Exception("Static method invalid");
+                $res = call_user_func([$class, $method], $args);
+            }
+
+            if ($res instanceof Generator || $res instanceof SSE) {
                 return $res;
-            } catch (Throwable $e) {
-                if (isset($_ENV['SHOW_ERRORS']) && $_ENV['SHOW_ERRORS'] === 'false') {
-                    return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
-                } else {
-                    return ['success' => false, 'error' => "Instance call error: {$e->getMessage()}"];
-                }
             }
-        } else {
-            if (!class_exists($class) || !is_callable([$class, $method])) {
-                return ['success' => false, 'error' => "Static method '$requested::$method' invalid"];
+
+            return $res;
+        } catch (Throwable $e) {
+            if ($e->getMessage() === 'Rate limit exceeded. Try again later.') {
+                return ['success' => false, 'error' => $e->getMessage()];
             }
-            try {
-                $res = call_user_func([$class, $method], $args);
-                if ($res !== null) {
-                    return ['success' => true, 'error' => null, 'response' => $res];
-                }
-                return $res;
-            } catch (Throwable $e) {
-                if (isset($_ENV['SHOW_ERRORS']) && $_ENV['SHOW_ERRORS'] === 'false') {
-                    return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
-                } else {
-                    return ['success' => false, 'error' => "Static call error: {$e->getMessage()}"];
-                }
+
+            if (Env::string('SHOW_ERRORS', 'false') === 'false') {
+                return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
+            } else {
+                return ['success' => false, 'error' => "Call error: {$e->getMessage()}"];
             }
         }
-
-        return ['success' => false, 'error' => 'Invalid callback'];
     }
 
     private static function resolveClassImport(string $simpleClassKey): ?array
@@ -950,6 +1224,22 @@ final class Bootstrap extends RuntimeException
 
         return Request::$isAjax || Request::$isXFileRequest || Request::$fileToInclude === 'route.php';
     }
+
+    public static function applyRootLayoutId(string $html): string
+    {
+        $rootLayoutPath = self::$layoutsToInclude[0] ?? self::$parentLayoutPath;
+        $rootLayoutId = !empty($rootLayoutPath) ? md5($rootLayoutPath) : 'default-root';
+
+        header('X-PP-Root-Layout: ' . $rootLayoutId);
+
+        $rootLayoutMeta = '<meta name="pp-root-layout" content="' . $rootLayoutId . '">';
+
+        if (strpos($html, '<head>') !== false) {
+            return preg_replace('/<head>/', "<head>\n    $rootLayoutMeta", $html, 1);
+        }
+
+        return $rootLayoutMeta . $html;
+    }
 }
 
 Bootstrap::run();
@@ -990,40 +1280,32 @@ try {
     }
 
     if (!empty(Bootstrap::$contentToInclude) && !empty(Request::$fileToInclude)) {
-        if (!Bootstrap::$isParentLayout) {
-            ob_start();
-            require_once Bootstrap::$contentToInclude;
-            MainLayout::$childLayoutChildren = ob_get_clean();
-        }
+        ob_start();
+        require_once Bootstrap::$contentToInclude;
+        MainLayout::$children = ob_get_clean();
 
-        foreach (array_reverse(Bootstrap::$layoutsToInclude) as $layoutPath) {
-            if (Bootstrap::$parentLayoutPath === $layoutPath) {
-                continue;
-            }
+        if (count(Bootstrap::$layoutsToInclude) > 1) {
+            $nestedLayouts = array_slice(Bootstrap::$layoutsToInclude, 1);
 
-            if (!Bootstrap::containsChildLayoutChildren($layoutPath)) {
-                Bootstrap::$isChildContentIncluded = true;
-            }
+            foreach (array_reverse($nestedLayouts) as $layoutPath) {
+                if (!Bootstrap::containsChildren($layoutPath)) {
+                    Bootstrap::$isChildContentIncluded = true;
+                }
 
-            ob_start();
-            require_once $layoutPath;
-            MainLayout::$childLayoutChildren = ob_get_clean();
+                ob_start();
+                require_once $layoutPath;
+                MainLayout::$children = ob_get_clean();
+            }
         }
     } else {
         ob_start();
         require_once APP_PATH . '/not-found.php';
-        MainLayout::$childLayoutChildren = ob_get_clean();
+        MainLayout::$children = ob_get_clean();
 
         http_response_code(404);
         CacheHandler::$isCacheable = false;
     }
 
-    if (Bootstrap::$isParentLayout && !empty(Bootstrap::$contentToInclude)) {
-        ob_start();
-        require_once Bootstrap::$contentToInclude;
-        MainLayout::$childLayoutChildren = ob_get_clean();
-    }
-
     if (!Bootstrap::$isContentIncluded && !Bootstrap::$isChildContentIncluded) {
         if (!Bootstrap::$secondRequestC69CD) {
             Bootstrap::createUpdateRequestData();
@@ -1035,69 +1317,63 @@ try {
                     if (file_exists($file)) {
                         ob_start();
                         require_once $file;
-                        MainLayout::$childLayoutChildren .= ob_get_clean();
+                        MainLayout::$children .= ob_get_clean();
                     }
                 }
             }
         }
 
         if (Request::$isWire && !Bootstrap::$secondRequestC69CD) {
-            ob_end_clean();
+            while (ob_get_level() > 0) {
+                ob_end_clean();
+            }
             Bootstrap::wireCallback();
         }
 
         if ((!Request::$isWire && !Bootstrap::$secondRequestC69CD) && isset(Bootstrap::$requestFilesData[Request::$decodedUri])) {
-            if ($_ENV['CACHE_ENABLED'] === 'true') {
-                CacheHandler::serveCache(Request::$decodedUri, intval($_ENV['CACHE_TTL']));
+            $cacheEnabled = (Env::string('CACHE_ENABLED', 'false') === 'true');
+
+            $shouldCache = CacheHandler::$isCacheable === true
+                || (CacheHandler::$isCacheable === null && $cacheEnabled);
+
+            if ($shouldCache) {
+                CacheHandler::serveCache(Request::$decodedUri, intval(Env::string('CACHE_TTL', '600')));
             }
         }
 
-        MainLayout::$children = MainLayout::$childLayoutChildren . Bootstrap::getLoadingsFiles();
+        MainLayout::$children .= Bootstrap::getLoadingsFiles();
 
         ob_start();
-        require_once APP_PATH . '/layout.php';
+        if (file_exists(Bootstrap::$parentLayoutPath)) {
+            require_once Bootstrap::$parentLayoutPath;
+        } else {
+            echo MainLayout::$children;
+        }
+
         MainLayout::$html = ob_get_clean();
         MainLayout::$html = TemplateCompiler::compile(MainLayout::$html);
         MainLayout::$html = TemplateCompiler::injectDynamicContent(MainLayout::$html);
+        MainLayout::$html = Bootstrap::applyRootLayoutId(MainLayout::$html);
+
         MainLayout::$html = "<!DOCTYPE html>\n" . MainLayout::$html;
 
         if (
-            http_response_code() === 200 && isset(Bootstrap::$requestFilesData[Request::$decodedUri]['fileName']) && $_ENV['CACHE_ENABLED'] === 'true' && (!Request::$isWire && !Bootstrap::$secondRequestC69CD)
+            http_response_code() === 200
+            && isset(Bootstrap::$requestFilesData[Request::$decodedUri]['fileName'])
+            && $shouldCache
+            && (!Request::$isWire && !Bootstrap::$secondRequestC69CD)
         ) {
             CacheHandler::saveCache(Request::$decodedUri, MainLayout::$html);
         }
 
-        if (Bootstrap::$isPartialRequest) {
-            $parts = PartialRenderer::extract(
-                MainLayout::$html,
-                Bootstrap::$partialSelectors
-            );
-
-            if (count($parts) === 1) {
-                echo reset($parts);
-            } else {
-                header('Content-Type: application/json');
-                echo json_encode(
-                    ['success' => true, 'fragments' => $parts],
-                    JSON_UNESCAPED_UNICODE
-                );
-            }
-            exit;
-        }
-
         echo MainLayout::$html;
     } else {
         $layoutPath = Bootstrap::$isContentIncluded
             ? Bootstrap::$parentLayoutPath
             : (Bootstrap::$layoutsToInclude[0] ?? '');
 
-        $message = "The layout file does not contain &lt;?php echo MainLayout::\$childLayoutChildren; ?&gt; or &lt;?= MainLayout::\$childLayoutChildren ?&gt;\n<strong>$layoutPath</strong>";
-        $htmlMessage = "<div class='error'>The layout file does not contain &lt;?php echo MainLayout::\$childLayoutChildren; ?&gt; or &lt;?= MainLayout::\$childLayoutChildren ?&gt;<br><strong>$layoutPath</strong></div>";
-
-        if (Bootstrap::$isContentIncluded) {
-            $message = "The parent layout file does not contain &lt;?php echo MainLayout::\$children; ?&gt; Or &lt;?= MainLayout::\$children ?&gt;<br><strong>$layoutPath</strong>";
-            $htmlMessage = "<div class='error'>The parent layout file does not contain &lt;?php echo MainLayout::\$children; ?&gt; Or &lt;?= MainLayout::\$children ?&gt;<br><strong>$layoutPath</strong></div>";
-        }
+        $message = "The layout file does not contain &lt;?php echo MainLayout::\$children; ?&gt; or &lt;?= MainLayout::\$children ?&gt;\n<strong>$layoutPath</strong>";
+        $htmlMessage = "<div class='error'>The layout file does not contain &lt;?php echo MainLayout::\$children; ?&gt; or &lt;?= MainLayout::\$children ?&gt;<br><strong>$layoutPath</strong></div>";
 
         $errorDetails = Bootstrap::isAjaxOrXFileRequestOrRouteFile() ? $message : $htmlMessage;