create-prisma-php-app 5.0.0-alpha.8 → 5.0.0

package/dist/bootstrap.php

@@ -31,8 +31,21 @@ use PP\Attributes\Exposed;
 use PP\Attributes\ExposedRegistry;
 use PP\Streaming\SSE;
 use PP\Security\RateLimiter;
+use PP\Security\Csrf;
 use PP\Env;
 
+/**
+ * An RPC failure meant for the wire: message plus HTTP status, serialized as
+ * `{"error": "..."}` — the shape the PulsePoint runtime reads.
+ */
+final class RpcError extends RuntimeException
+{
+    public function __construct(string $message, public readonly int $status)
+    {
+        parent::__construct($message);
+    }
+}
+
 final class Bootstrap extends RuntimeException
 {
     public static string $contentToInclude = '';
@@ -43,7 +56,6 @@ final class Bootstrap extends RuntimeException
     public static bool $isContentIncluded = false;
     public static bool $isChildContentIncluded = false;
     public static bool $isContentVariableIncluded = false;
-    public static bool $secondRequestC69CD = false;
     public static array $requestFilesData = [];
 
     private string $context;
@@ -60,6 +72,19 @@ final class Bootstrap extends RuntimeException
         );
     }
 
+    public static function isPathWithinApp(string $path): bool
+    {
+        $resolvedPath = realpath($path);
+        if ($resolvedPath === false) {
+            return false;
+        }
+
+        $appPath = rtrim(str_replace('\\', '/', APP_PATH), '/');
+        $normalizedResolvedPath = str_replace('\\', '/', $resolvedPath);
+
+        return str_starts_with($normalizedResolvedPath, $appPath . '/');
+    }
+
     public function __construct(string $message, string $context = '', int $code = 0, ?Throwable $previous = null)
     {
         $this->context = $context;
@@ -81,22 +106,7 @@ final class Bootstrap extends RuntimeException
         MainLayout::init();
         ErrorHandler::registerHandlers();
 
-        setcookie("pp_local_store_key", PrismaPHPSettings::$localStoreKey, [
-            'expires' => time() + 3600,
-            'path' => '/',
-            'domain' => '',
-            'secure' => self::isHttpsRequest(),
-            'httponly' => false,
-            'samesite' => 'Lax',
-        ]);
-
-        self::setCsrfCookie();
-
-        self::$secondRequestC69CD = Request::$data['secondRequestC69CD'] ?? false;
-
-        if (Request::$isWire && !self::$secondRequestC69CD) {
-            self::isLocalStoreCallback();
-        }
+        Csrf::ensureCookie();
 
         $contentInfo = self::determineContentToInclude();
         self::$contentToInclude = $contentInfo['path'] ?? '';
@@ -137,79 +147,94 @@ final class Bootstrap extends RuntimeException
         ErrorHandler::checkFatalError();
     }
 
-    private static function isLocalStoreCallback(): void
+    /**
+     * Anti-CSRF origin check for RPC calls. NOT authentication: a browser
+     * cannot forge the Origin header, so this blocks cross-site script-driven
+     * calls; raw clients are handled by the CSRF token and auth gates.
+     *
+     * @return string|null An error message, or null when the origin is fine.
+     */
+    private static function validateRpcOrigin(): ?string
     {
-        if (empty($_SERVER['HTTP_X_PP_FUNCTION'])) {
-            return;
+        $origin = rtrim(trim($_SERVER['HTTP_ORIGIN'] ?? ''), '/');
+        if ($origin === '') {
+            return null;
+        }
+
+        if (Env::string('APP_ENV', 'production') !== 'production') {
+            if (preg_match('#^http://(localhost|127\.0\.0\.1)(:\d+)?$#i', $origin)) {
+                return null;
+            }
         }
 
-        $callbackName = $_SERVER['HTTP_X_PP_FUNCTION'];
+        $allowedOrigins = [rtrim(Request::$protocol . Request::$domainName, '/')];
+
+        $baseUrl = rtrim(Env::string('APP_BASE_URL', ''), '/');
+        if ($baseUrl !== '') {
+            $allowedOrigins[] = $baseUrl;
+        }
 
-        if ($callbackName === PrismaPHPSettings::$localStoreKey) {
-            self::validateCsrfToken();
-            self::jsonExit(['success' => true, 'response' => 'localStorage updated']);
+        foreach (self::parseOriginList(Env::string('CORS_ALLOWED_ORIGINS', '')) as $allowed) {
+            $allowedOrigins[] = $allowed;
         }
+
+        return in_array($origin, $allowedOrigins, true) ? null : 'Invalid origin';
     }
 
-    private static function setCsrfCookie(): void
+    /**
+     * Parse an origin list env value: CSV or a JSON array, the same formats
+     * CorsMiddleware accepts.
+     *
+     * @return string[]
+     */
+    private static function parseOriginList(string $raw): array
     {
-        $secret = Env::string('FUNCTION_CALL_SECRET', 'pp_default_insecure_secret');
-        $shouldRegenerate = true;
-
-        if (isset($_COOKIE['prisma_php_csrf'])) {
-            $parts = explode('.', $_COOKIE['prisma_php_csrf']);
-            if (count($parts) === 2) {
-                [$nonce, $signature] = $parts;
-                $expectedSignature = hash_hmac('sha256', $nonce, $secret);
+        $raw = trim($raw);
+        if ($raw === '' || $raw === '[]') {
+            return [];
+        }
 
-                if (hash_equals($expectedSignature, $signature)) {
-                    $shouldRegenerate = false;
-                }
+        $values = null;
+        if ($raw[0] === '[') {
+            $decoded = json_decode($raw, true);
+            if (is_array($decoded)) {
+                $values = array_map('strval', $decoded);
             }
         }
 
-        if ($shouldRegenerate) {
-            $nonce = bin2hex(random_bytes(16));
-            $signature = hash_hmac('sha256', $nonce, $secret);
-            $token = $nonce . '.' . $signature;
+        $values ??= explode(',', $raw);
 
-            setcookie('prisma_php_csrf', $token, [
-                'expires'  => time() + 3600,
-                'path'     => '/',
-                'secure'   => self::isHttpsRequest(),
-                'httponly' => false,
-                'samesite' => 'Lax',
-            ]);
-
-            $_COOKIE['prisma_php_csrf'] = $token;
+        $origins = [];
+        foreach ($values as $value) {
+            $value = rtrim(trim($value), '/');
+            if ($value !== '') {
+                $origins[] = $value;
+            }
         }
+
+        return $origins;
     }
 
-    private static function validateCsrfToken(): void
+    /**
+     * RPC bodies are JSON or multipart uploads; any other content type with a
+     * body is refused with 415, matching the runtime's error handling.
+     */
+    private static function isRpcContentTypeAllowed(): bool
     {
-        $headerToken = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-        $cookieToken = $_COOKIE['prisma_php_csrf'] ?? '';
-        $secret = Env::string('FUNCTION_CALL_SECRET', '');
-
-        if (empty($headerToken) || empty($cookieToken)) {
-            self::jsonExit(['success' => false, 'error' => 'CSRF token missing']);
-        }
-
-        if (!hash_equals($cookieToken, $headerToken)) {
-            self::jsonExit(['success' => false, 'error' => 'CSRF token mismatch']);
+        $contentType = strtolower(Request::$contentType);
+        if (
+            str_starts_with($contentType, 'application/json')
+            || str_starts_with($contentType, 'multipart/form-data')
+        ) {
+            return true;
         }
 
-        $parts = explode('.', $cookieToken);
-        if (count($parts) !== 2) {
-            self::jsonExit(['success' => false, 'error' => 'Invalid CSRF token format']);
+        $contentLength = $_SERVER['CONTENT_LENGTH'] ?? $_SERVER['HTTP_CONTENT_LENGTH'] ?? null;
+        if ($contentLength !== null) {
+            return (int) $contentLength <= 0;
         }
 
-        [$nonce, $signature] = $parts;
-        $expectedSignature = hash_hmac('sha256', $nonce, $secret);
-
-        if (!hash_equals($expectedSignature, $signature)) {
-            self::jsonExit(['success' => false, 'error' => 'Invalid CSRF token signature']);
-        }
+        return strtolower((string) ($_SERVER['HTTP_TRANSFER_ENCODING'] ?? '')) === '';
     }
 
     private static function fileExistsCached(string $path): bool
@@ -269,6 +294,11 @@ final class Bootstrap extends RuntimeException
             }
         }
 
+        $exactContentInfo = self::getExactContentInfo($requestUri, $pathname);
+        if ($exactContentInfo !== null) {
+            return $exactContentInfo;
+        }
+
         if ($pathname) {
             $groupFolder = self::findGroupFolder($pathname);
             if ($groupFolder) {
@@ -303,6 +333,139 @@ final class Bootstrap extends RuntimeException
         ];
     }
 
+    private static function getExactContentInfo(string $requestUri, string $pathname): ?array
+    {
+        $requestData = self::findExactRequestData($requestUri, $pathname);
+        if ($requestData === null) {
+            return null;
+        }
+
+        $includedFiles = $requestData['includedFiles'] ?? null;
+        if (!is_array($includedFiles) || empty($includedFiles)) {
+            return null;
+        }
+
+        $includePath = '';
+        $layoutsToInclude = [];
+
+        foreach ($includedFiles as $file) {
+            if (!is_string($file) || $file === '') {
+                continue;
+            }
+
+            $normalizedFile = str_replace('\\', '/', $file);
+
+            if (str_ends_with($normalizedFile, '/layout.php')) {
+                if (self::fileExistsCached($file) && !in_array($file, $layoutsToInclude, true)) {
+                    $layoutsToInclude[] = $file;
+                }
+
+                continue;
+            }
+
+            if ($includePath === '' && self::fileExistsCached($file)) {
+                $includePath = $file;
+            }
+        }
+
+        if ($includePath === '') {
+            return null;
+        }
+
+        self::hydrateDynamicParamsFromIncludePath($pathname, $includePath);
+
+        usort($layoutsToInclude, static function (string $left, string $right): int {
+            return substr_count(str_replace('\\', '/', $left), '/')
+                <=> substr_count(str_replace('\\', '/', $right), '/');
+        });
+
+        return [
+            'path' => $includePath,
+            'layouts' => $layoutsToInclude,
+            'pathname' => $pathname,
+            'uri' => $requestUri,
+        ];
+    }
+
+    private static function findExactRequestData(string $requestUri, string $pathname): ?array
+    {
+        $candidates = [];
+        $decodedRequestUri = Request::getDecodedUrl($requestUri);
+
+        if ($decodedRequestUri !== '') {
+            $candidates[] = $decodedRequestUri;
+
+            $trimmedDecodedRequestUri = ltrim($decodedRequestUri, '/');
+            if ($trimmedDecodedRequestUri !== '') {
+                $candidates[] = $trimmedDecodedRequestUri;
+            }
+        }
+
+        if ($pathname === '') {
+            $candidates[] = '/';
+        } else {
+            $candidates[] = $pathname;
+            $candidates[] = '/' . $pathname;
+        }
+
+        foreach (array_values(array_unique($candidates)) as $candidate) {
+            $requestData = PrismaPHPSettings::$includeFiles[$candidate] ?? null;
+
+            if (is_array($requestData)) {
+                return $requestData;
+            }
+        }
+
+        return null;
+    }
+
+    private static function hydrateDynamicParamsFromIncludePath(string $pathname, string $includePath): void
+    {
+        $normalizedIncludePath = str_replace('\\', '/', $includePath);
+        $normalizedAppPath = str_replace('\\', '/', APP_PATH);
+
+        if (!str_starts_with($normalizedIncludePath, $normalizedAppPath . '/')) {
+            return;
+        }
+
+        $relativeRoutePath = ltrim(substr($normalizedIncludePath, strlen($normalizedAppPath)), '/');
+        $routeSegments = array_values(array_filter(
+            explode('/', $relativeRoutePath),
+            static function (string $segment): bool {
+                return $segment !== '' && !preg_match('/^\([^)]+\)$/', $segment);
+            }
+        ));
+
+        if (!empty($routeSegments) && in_array(end($routeSegments), ['index.php', 'route.php'], true)) {
+            array_pop($routeSegments);
+        }
+
+        $pathnameSegments = $pathname === '' ? [] : explode('/', $pathname);
+        $dynamicParams = [];
+        $pathnameIndex = 0;
+
+        foreach ($routeSegments as $routeSegment) {
+            if (preg_match('/^\[\.\.\.(.+)\]$/', $routeSegment, $matches)) {
+                $dynamicParams[$matches[1]] = array_slice($pathnameSegments, $pathnameIndex);
+                break;
+            }
+
+            if (!array_key_exists($pathnameIndex, $pathnameSegments)) {
+                break;
+            }
+
+            if (preg_match('/^\[(.+)\]$/', $routeSegment, $matches)) {
+                $dynamicParams[$matches[1]] = $pathnameSegments[$pathnameIndex];
+            }
+
+            $pathnameIndex++;
+        }
+
+        if (!empty($dynamicParams)) {
+            Request::$dynamicParams = new ArrayObject($dynamicParams, ArrayObject::ARRAY_AS_PROPS);
+        }
+    }
+
     private static function collectLayouts(string $pathname, ?string $groupFolder, ?string $dynamicRoute): array
     {
         $layoutsToInclude = [];
@@ -818,21 +981,35 @@ final class Bootstrap extends RuntimeException
         $callbackName = $_SERVER['HTTP_X_PP_FUNCTION'] ?? null;
 
         if (empty($callbackName)) {
-            self::jsonExit(['success' => false, 'error' => 'Callback header not provided', 'response' => null]);
+            self::jsonExit(['error' => 'Missing function name'], 400);
         }
 
-        self::validateCsrfToken();
-
         if (!preg_match('/^[a-zA-Z0-9_:\->]+$/', $callbackName)) {
-            self::jsonExit(['success' => false, 'error' => 'Invalid callback format']);
+            self::jsonExit(['error' => 'Invalid function name'], 400);
+        }
+
+        if (($error = self::validateRpcOrigin()) !== null) {
+            self::jsonExit(['error' => $error], 403);
+        }
+
+        if (!self::isRpcContentTypeAllowed()) {
+            self::jsonExit(['error' => 'Invalid content type'], 415);
+        }
+
+        if (($error = Csrf::validateHeaderToken($_SERVER['HTTP_X_CSRF_TOKEN'] ?? '')) !== null) {
+            self::jsonExit(['error' => $error], 403);
         }
 
         $data = self::getRequestData();
         $args = self::convertToArrayObject($data);
 
-        $out = str_contains($callbackName, '->') || str_contains($callbackName, '::')
-            ? self::dispatchMethod($callbackName, $args)
-            : self::dispatchFunction($callbackName, $args);
+        try {
+            $out = str_contains($callbackName, '->') || str_contains($callbackName, '::')
+                ? self::dispatchMethod($callbackName, $args)
+                : self::dispatchFunction($callbackName, $args);
+        } catch (RpcError $e) {
+            self::jsonExit(['error' => $e->getMessage()], $e->status);
+        }
 
         if ($out instanceof SSE) {
             $out->send();
@@ -844,14 +1021,18 @@ final class Bootstrap extends RuntimeException
             exit;
         }
 
-        if ($out !== null) {
-            self::jsonExit($out);
-        }
-        exit;
+        // Always emit valid JSON — the runtime parses every non-stream RPC
+        // response, so a null result must arrive as the JSON literal `null`.
+        self::jsonExit($out);
     }
 
-    private static function jsonExit(mixed $payload): void
+    private static function jsonExit(mixed $payload, int $status = 200): void
     {
+        if (!headers_sent()) {
+            http_response_code($status);
+            header('Content-Type: application/json; charset=UTF-8');
+        }
+
         echo json_encode($payload, JSON_UNESCAPED_UNICODE);
         exit;
     }
@@ -859,7 +1040,18 @@ final class Bootstrap extends RuntimeException
     private static function getRequestData(): array
     {
         if (!empty($_FILES)) {
-            $data = $_POST;
+            // Non-file values in an RPC multipart body are JSON-encoded by
+            // the runtime (objects/arrays) or stringified scalars; decode
+            // what parses so `{count: 2}` arrives as a number, not "2".
+            $data = [];
+            foreach ($_POST as $key => $value) {
+                if (is_string($value)) {
+                    $decoded = json_decode($value, true);
+                    $data[$key] = json_last_error() === JSON_ERROR_NONE ? $decoded : $value;
+                } else {
+                    $data[$key] = $value;
+                }
+            }
             foreach ($_FILES as $key => $file) {
                 $data[$key] = is_array($file['name'])
                     ? array_map(
@@ -883,69 +1075,41 @@ final class Bootstrap extends RuntimeException
         return (json_last_error() === JSON_ERROR_NONE) ? $json : $_POST;
     }
 
-    private static function validateAccess(Exposed $attribute): bool
+    /**
+     * Authorize the caller for one exposed function, mirroring the reference
+     * server: 401 when auth is required and missing, 403 on a role mismatch.
+     */
+    private static function authorizeAccess(Exposed $attribute): void
     {
-        if ($attribute->requiresAuth || !empty($attribute->allowedRoles)) {
-            $auth = Auth::getInstance();
-
-            if (!$auth->isAuthenticated()) {
-                return false;
-            }
-
-            if (!empty($attribute->allowedRoles)) {
-                $payload = $auth->getPayload();
-                $currentRole = null;
-
-                if (is_scalar($payload)) {
-                    $currentRole = $payload;
-                } else {
-                    $roleKey = !empty(Auth::ROLE_NAME) ? Auth::ROLE_NAME : 'role';
+        if (!$attribute->requiresAuth && empty($attribute->allowedRoles)) {
+            return;
+        }
 
-                    if (is_object($payload)) {
-                        $currentRole = $payload->$roleKey ?? null;
-                    } elseif (is_array($payload)) {
-                        $currentRole = $payload[$roleKey] ?? null;
-                    }
-                }
+        $auth = Auth::getInstance();
 
-                if ($currentRole === null || !in_array($currentRole, $attribute->allowedRoles)) {
-                    return false;
-                }
-            }
+        if (!$auth->isAuthenticated()) {
+            throw new RpcError('Authentication required', 401);
         }
 
-        return true;
-    }
+        if (!empty($attribute->allowedRoles)) {
+            $payload = $auth->getPayload();
+            $currentRole = null;
 
-    private static function isFunctionAllowed(string $fn): bool
-    {
-        try {
-            $ref = new ReflectionFunction($fn);
-            $attrs = $ref->getAttributes(Exposed::class);
+            if (is_scalar($payload)) {
+                $currentRole = $payload;
+            } else {
+                $roleKey = !empty(Auth::ROLE_NAME) ? Auth::ROLE_NAME : 'role';
 
-            if (empty($attrs)) {
-                return false;
+                if (is_object($payload)) {
+                    $currentRole = $payload->$roleKey ?? null;
+                } elseif (is_array($payload)) {
+                    $currentRole = $payload[$roleKey] ?? null;
+                }
             }
 
-            return self::validateAccess($attrs[0]->newInstance());
-        } catch (Throwable) {
-            return false;
-        }
-    }
-
-    private static function isMethodAllowed(string $class, string $method): bool
-    {
-        try {
-            $ref = new ReflectionMethod($class, $method);
-            $attrs = $ref->getAttributes(Exposed::class);
-
-            if (empty($attrs)) {
-                return false;
+            if ($currentRole === null || !in_array($currentRole, $attribute->allowedRoles)) {
+                throw new RpcError('Permission denied', 403);
             }
-
-            return self::validateAccess($attrs[0]->newInstance());
-        } catch (Throwable) {
-            return false;
         }
     }
 
@@ -978,7 +1142,33 @@ final class Bootstrap extends RuntimeException
         }
 
         if ($limits) {
-            RateLimiter::verify($identifier, $limits);
+            try {
+                RateLimiter::verify($identifier, $limits);
+            } catch (Throwable $e) {
+                throw new RpcError('Rate limit exceeded. Try again later.', 429);
+            }
+        }
+    }
+
+    /**
+     * Run one exposed callable and translate its failures onto the wire:
+     * `InvalidArgumentException` is a message meant for the caller (400, the
+     * validation convention), anything else is a 500.
+     */
+    private static function invokeExposed(callable $callable, mixed $args): mixed
+    {
+        try {
+            return call_user_func($callable, $args);
+        } catch (RpcError $e) {
+            throw $e;
+        } catch (InvalidArgumentException $e) {
+            throw new RpcError($e->getMessage(), 400);
+        } catch (Throwable $e) {
+            if (Env::string('SHOW_ERRORS', 'false') === 'false') {
+                throw new RpcError('Internal server error', 500);
+            }
+
+            throw new RpcError("Function error: {$e->getMessage()}", 500);
         }
     }
 
@@ -991,39 +1181,21 @@ final class Bootstrap extends RuntimeException
             }
         }
 
-        if (!self::isFunctionAllowed($fn)) {
-            return ['success' => false, 'error' => 'Function not callable from client'];
+        if (!function_exists($fn) || !is_callable($fn)) {
+            throw new RpcError('Function not found', 404);
         }
 
         $attribute = self::getExposedAttribute($fn);
-        if (!self::validateAccess($attribute)) {
-            return ['success' => false, 'error' => 'Permission denied'];
+        if ($attribute === null) {
+            // Existing but not #[Exposed]: indistinguishable from absent, on
+            // purpose — the wire must not reveal which functions exist.
+            throw new RpcError('Function not found', 404);
         }
 
-        if (function_exists($fn) && is_callable($fn)) {
-            try {
-                self::enforceRateLimit($attribute, "fn:$fn");
-
-                $res = call_user_func($fn, $args);
-
-                if ($res instanceof Generator || $res instanceof SSE) {
-                    return $res;
-                }
-
-                return $res;
-            } catch (Throwable $e) {
-                if ($e->getMessage() === 'Rate limit exceeded. Try again later.') {
-                    return ['success' => false, 'error' => $e->getMessage()];
-                }
+        self::authorizeAccess($attribute);
+        self::enforceRateLimit($attribute, "fn:$fn");
 
-                if (Env::string('SHOW_ERRORS', 'false') === 'false') {
-                    return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
-                } else {
-                    return ['success' => false, 'error' => "Function error: {$e->getMessage()}"];
-                }
-            }
-        }
-        return ['success' => false, 'error' => 'Invalid callback'];
+        return self::invokeExposed($fn, $args);
     }
 
     private static function dispatchMethod(string $call, mixed $args)
@@ -1046,56 +1218,36 @@ final class Bootstrap extends RuntimeException
         }
 
         if (!class_exists($class)) {
-            return ['success' => false, 'error' => "Class '$requested' not found"];
-        }
-
-        if (!self::isMethodAllowed($class, $method)) {
-            return ['success' => false, 'error' => 'Method not callable from client'];
+            throw new RpcError('Function not found', 404);
         }
 
         $attribute = self::getExposedAttribute($class, $method);
-        if (!$attribute) {
-            return ['success' => false, 'error' => 'Method not callable from client'];
+        if ($attribute === null) {
+            throw new RpcError('Function not found', 404);
         }
 
-        if (!self::validateAccess($attribute)) {
-            return ['success' => false, 'error' => 'Permission denied'];
-        }
-
-        try {
-            self::enforceRateLimit($attribute, "method:$class::$method");
-
-            $res = null;
-            if (!$isStatic) {
-                $instance = new $class();
-                if (!is_callable([$instance, $method])) throw new Exception("Method not callable");
-                $res = call_user_func([$instance, $method], $args);
-            } else {
-                if (!is_callable([$class, $method])) throw new Exception("Static method invalid");
-                $res = call_user_func([$class, $method], $args);
-            }
+        self::authorizeAccess($attribute);
+        self::enforceRateLimit($attribute, "method:$class::$method");
 
-            if ($res instanceof Generator || $res instanceof SSE) {
-                return $res;
+        if ($isStatic) {
+            if (!is_callable([$class, $method])) {
+                throw new RpcError('Function not found', 404);
             }
 
-            return $res;
-        } catch (Throwable $e) {
-            if ($e->getMessage() === 'Rate limit exceeded. Try again later.') {
-                return ['success' => false, 'error' => $e->getMessage()];
-            }
+            return self::invokeExposed([$class, $method], $args);
+        }
 
-            if (Env::string('SHOW_ERRORS', 'false') === 'false') {
-                return ['success' => false, 'error' => 'An error occurred. Please try again later.'];
-            } else {
-                return ['success' => false, 'error' => "Call error: {$e->getMessage()}"];
-            }
+        $instance = new $class();
+        if (!is_callable([$instance, $method])) {
+            throw new RpcError('Function not found', 404);
         }
+
+        return self::invokeExposed([$instance, $method], $args);
     }
 
     private static function resolveClassImport(string $simpleClassKey): ?array
     {
-        $logs = PrismaPHPSettings::$classLogFiles[$simpleClassKey] ?? [];
+        $logs = PrismaPHPSettings::getClassLogFiles()[$simpleClassKey] ?? [];
         if (!is_array($logs) || empty($logs)) {
             return null;
         }
@@ -1178,19 +1330,35 @@ final class Bootstrap extends RuntimeException
             }
         }
 
-        $currentUrl = Request::getDecodedUrl(Request::$uri);
+        $currentUrl = self::normalizeRequestDataKey(Request::getDecodedUrl(Request::$uri));
+        $legacyUrl = $currentUrl === '/' ? null : '/' . $currentUrl;
+
+        if ($legacyUrl !== null && isset($currentData[$legacyUrl])) {
+            $legacyEntry = $currentData[$legacyUrl];
+            unset($currentData[$legacyUrl]);
+
+            if (!isset($currentData[$currentUrl])) {
+                $currentData[$currentUrl] = $legacyEntry;
+            } elseif (isset($legacyEntry['includedFiles']) && is_array($legacyEntry['includedFiles'])) {
+                $currentData[$currentUrl]['includedFiles'] = array_values(array_unique(array_merge(
+                    $currentData[$currentUrl]['includedFiles'] ?? [],
+                    $legacyEntry['includedFiles']
+                )));
+            }
+        }
 
         if (isset($currentData[$currentUrl])) {
+            $currentData[$currentUrl]['url'] = $currentUrl;
             $currentData[$currentUrl]['includedFiles'] = array_values(array_unique(
                 array_merge($currentData[$currentUrl]['includedFiles'], $srcAppFiles)
             ));
 
-            if (!Request::$isWire && !self::$secondRequestC69CD) {
+            if (!Request::$isRpc) {
                 $currentData[$currentUrl]['isCacheable'] = CacheHandler::$isCacheable;
             }
         } else {
             $currentData[$currentUrl] = [
-                'url'         => Request::$uri,
+                'url'         => $currentUrl,
                 'fileName'    => self::convertUrlToFileName($currentUrl),
                 'isCacheable' => CacheHandler::$isCacheable,
                 'cacheTtl' => CacheHandler::$ttl,
@@ -1213,6 +1381,17 @@ final class Bootstrap extends RuntimeException
         return $fileName ? mb_strtolower($fileName, 'UTF-8') : 'index';
     }
 
+    private static function normalizeRequestDataKey(string $url): string
+    {
+        $trimmedUrl = trim($url, '/');
+
+        if ($trimmedUrl === '') {
+            return '/';
+        }
+
+        return $trimmedUrl;
+    }
+
     private static function authenticateUserToken(): void
     {
         $token = Request::getBearerToken();
@@ -1237,7 +1416,17 @@ final class Bootstrap extends RuntimeException
     public static function applyRootLayoutId(string $html): string
     {
         $rootLayoutPath = self::$layoutsToInclude[0] ?? self::$parentLayoutPath;
-        $rootLayoutId = !empty($rootLayoutPath) ? md5($rootLayoutPath) : 'default-root';
+
+        if (!empty($rootLayoutPath)) {
+            $resolvedRootLayoutPath = realpath($rootLayoutPath);
+            $canonicalRootLayoutPath = $resolvedRootLayoutPath !== false
+                ? $resolvedRootLayoutPath
+                : $rootLayoutPath;
+
+            $rootLayoutId = md5(str_replace('\\', '/', $canonicalRootLayoutPath));
+        } else {
+            $rootLayoutId = 'default-root';
+        }
 
         header('X-PP-Root-Layout: ' . $rootLayoutId);
 
@@ -1267,11 +1456,18 @@ try {
 
         if (is_file(Bootstrap::$requestFilePath)) {
             if (file_exists(Bootstrap::$requestFilePath) && Request::$isXFileRequest) {
+                if (!Bootstrap::isPathWithinApp(Bootstrap::$requestFilePath)) {
+                    http_response_code(403);
+                    exit;
+                }
+
+                $resolvedRequestFilePath = realpath(Bootstrap::$requestFilePath);
+
                 if (pathinfo(Bootstrap::$requestFilePath, PATHINFO_EXTENSION) === 'php') {
-                    include Bootstrap::$requestFilePath;
+                    include $resolvedRequestFilePath ?: Bootstrap::$requestFilePath;
                 } else {
-                    header('Content-Type: ' . mime_content_type(Bootstrap::$requestFilePath));
-                    readfile(Bootstrap::$requestFilePath);
+                    header('Content-Type: ' . mime_content_type($resolvedRequestFilePath ?: Bootstrap::$requestFilePath));
+                    readfile($resolvedRequestFilePath ?: Bootstrap::$requestFilePath);
                 }
                 exit;
             }
@@ -1293,6 +1489,13 @@ try {
         require_once Bootstrap::$contentToInclude;
         MainLayout::$children = ob_get_clean();
 
+        if (Request::$fileToInclude === 'index.php') {
+            MainLayout::$children = TemplateCompiler::scopeRouteRoot(
+                MainLayout::$children,
+                Bootstrap::$contentToInclude
+            );
+        }
+
         if (count(Bootstrap::$layoutsToInclude) > 1) {
             $nestedLayouts = array_slice(Bootstrap::$layoutsToInclude, 1);
 
@@ -1304,6 +1507,7 @@ try {
                 ob_start();
                 require_once $layoutPath;
                 MainLayout::$children = ob_get_clean();
+                MainLayout::$children = TemplateCompiler::scopeRouteRoot(MainLayout::$children, $layoutPath);
             }
         }
     } else {
@@ -1316,7 +1520,7 @@ try {
     }
 
     if (!Bootstrap::$isContentIncluded && !Bootstrap::$isChildContentIncluded) {
-        if (Request::$isWire && !Bootstrap::$secondRequestC69CD) {
+        if (Request::$isRpc) {
             if (isset(Bootstrap::$requestFilesData[Request::$decodedUri])) {
                 foreach (Bootstrap::$requestFilesData[Request::$decodedUri]['includedFiles'] as $file) {
                     if (file_exists($file)) {
@@ -1328,14 +1532,14 @@ try {
             }
         }
 
-        if (Request::$isWire && !Bootstrap::$secondRequestC69CD) {
+        if (Request::$isRpc) {
             while (ob_get_level() > 0) {
                 ob_end_clean();
             }
             Bootstrap::wireCallback();
         }
 
-        if ((!Request::$isWire && !Bootstrap::$secondRequestC69CD) && isset(Bootstrap::$requestFilesData[Request::$decodedUri])) {
+        if (!Request::$isRpc && isset(Bootstrap::$requestFilesData[Request::$decodedUri])) {
             $cacheEnabled = (Env::string('CACHE_ENABLED', 'false') === 'true');
 
             $shouldCache = CacheHandler::$isCacheable === true
@@ -1356,25 +1560,34 @@ try {
         }
 
         MainLayout::$html = ob_get_clean();
+
+        if (file_exists(Bootstrap::$parentLayoutPath)) {
+            TemplateCompiler::validateSingleRootHtml(
+                MainLayout::$html,
+                Bootstrap::$parentLayoutPath,
+                'Layout file'
+            );
+        }
+
         MainLayout::$html = TemplateCompiler::compile(MainLayout::$html);
         MainLayout::$html = TemplateCompiler::injectDynamicContent(MainLayout::$html);
         MainLayout::$html = Bootstrap::applyRootLayoutId(MainLayout::$html);
+        MainLayout::$html = TemplateCompiler::deferComponentRoots(MainLayout::$html);
 
         MainLayout::$html = "<!DOCTYPE html>\n" . MainLayout::$html;
 
-        if (!Bootstrap::$secondRequestC69CD) {
-            Bootstrap::createUpdateRequestData();
-        }
+        Bootstrap::createUpdateRequestData();
 
         if (
             http_response_code() === 200
             && isset(Bootstrap::$requestFilesData[Request::$decodedUri]['fileName'])
             && $shouldCache
-            && (!Request::$isWire && !Bootstrap::$secondRequestC69CD)
+            && !Request::$isRpc
         ) {
             CacheHandler::saveCache(Request::$decodedUri, MainLayout::$html);
         }
 
+        header('Content-Type: text/html; charset=UTF-8');
         echo MainLayout::$html;
     } else {
         $layoutPath = Bootstrap::$isContentIncluded