nibula 1.6.0 → 1.6.1

package/src/backend/_core/modules/RateLimiter.php

@@ -1,31 +1,31 @@
-<?php
-
-declare(strict_types=1);
-
-class RateLimiter {
-    public static function check(string $ip, int $maxRequests = 60, int $windowSeconds = 60): void {
-        $cacheDir = __DIR__ . '/../../cache';
-        
-        if (!is_dir($cacheDir)) {
-            mkdir($cacheDir, 0755, true);
-        }
-
-        $cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
-        $now = time();
-        $data = [];
-
-        if (file_exists($cacheFile)) {
-            $data = json_decode(file_get_contents($cacheFile), true) ?: [];
-        }
-
-        $data = array_filter($data, fn($ts) => $ts > ($now - $windowSeconds));
-        $data[] = $now;
-
-        file_put_contents($cacheFile, json_encode(array_values($data)), LOCK_EX);
-
-        if (count($data) > $maxRequests) {
-            header('Retry-After: ' . $windowSeconds);
-            Response::error('Too Many Requests', 429);
-        }
-    }
+<?php
+
+declare(strict_types=1);
+
+class RateLimiter {
+    public static function check(string $ip, int $maxRequests = 60, int $windowSeconds = 60): void {
+        $cacheDir = __DIR__ . '/../../cache';
+        
+        if (!is_dir($cacheDir)) {
+            mkdir($cacheDir, 0755, true);
+        }
+
+        $cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
+        $now = time();
+        $data = [];
+
+        if (file_exists($cacheFile)) {
+            $data = json_decode(file_get_contents($cacheFile), true) ?: [];
+        }
+
+        $data = array_filter($data, fn($ts) => $ts > ($now - $windowSeconds));
+        $data[] = $now;
+
+        file_put_contents($cacheFile, json_encode(array_values($data)), LOCK_EX);
+
+        if (count($data) > $maxRequests) {
+            header('Retry-After: ' . $windowSeconds);
+            Response::error('Too Many Requests', 429);
+        }
+    }
 }

package/src/backend/_core/modules/Response.js

@@ -1,59 +1,59 @@
-'use strict';
-
-/**
- * Mirror of src/backend/_core/modules/Response.php
- *
- * In PHP the Response helper writes JSON and calls exit() to stop execution.
- * Node has no per-request exit, so each method writes to the response and then
- * throws the HALT sentinel. The front controller catches HALT and stops the
- * dispatch, reproducing the same "the endpoint stops here" behaviour.
- *
- * A fresh, response-bound helper is created per request via createResponse(res)
- * so overlapping async requests never clash (PHP was process-per-request).
- */
-
-// Sentinel thrown to unwind execution after a response has been sent (≈ PHP exit).
-const HALT = Symbol('RESPONSE_HALT');
-
-function jsonEncode(obj) {
-    // JSON.stringify already leaves unicode unescaped and does not escape slashes,
-    // matching PHP's JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES.
-    return JSON.stringify(obj);
-}
-
-function createResponse(res) {
-    return {
-        success(data = null, code = 200) {
-            res.statusCode = code;
-            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
-            res.end(jsonEncode({
-                status: 'success',
-                data: data,
-            }));
-            throw HALT;
-        },
-
-        error(message, code = 400, details = null) {
-            res.statusCode = code;
-            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
-            const body = {
-                status: 'error',
-                message: message,
-                code: code,
-            };
-            if (details !== null) {
-                body.details = details;
-            }
-            res.end(jsonEncode(body));
-            throw HALT;
-        },
-
-        noContent() {
-            res.statusCode = 204;
-            res.end();
-            throw HALT;
-        },
-    };
-}
-
-module.exports = { createResponse, HALT };
+'use strict';
+
+/**
+ * Mirror of src/backend/_core/modules/Response.php
+ *
+ * In PHP the Response helper writes JSON and calls exit() to stop execution.
+ * Node has no per-request exit, so each method writes to the response and then
+ * throws the HALT sentinel. The front controller catches HALT and stops the
+ * dispatch, reproducing the same "the endpoint stops here" behaviour.
+ *
+ * A fresh, response-bound helper is created per request via createResponse(res)
+ * so overlapping async requests never clash (PHP was process-per-request).
+ */
+
+// Sentinel thrown to unwind execution after a response has been sent (≈ PHP exit).
+const HALT = Symbol('RESPONSE_HALT');
+
+function jsonEncode(obj) {
+    // JSON.stringify already leaves unicode unescaped and does not escape slashes,
+    // matching PHP's JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES.
+    return JSON.stringify(obj);
+}
+
+function createResponse(res) {
+    return {
+        success(data = null, code = 200) {
+            res.statusCode = code;
+            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
+            res.end(jsonEncode({
+                status: 'success',
+                data: data,
+            }));
+            throw HALT;
+        },
+
+        error(message, code = 400, details = null) {
+            res.statusCode = code;
+            res.setHeader('Content-Type', 'application/json; charset=UTF-8');
+            const body = {
+                status: 'error',
+                message: message,
+                code: code,
+            };
+            if (details !== null) {
+                body.details = details;
+            }
+            res.end(jsonEncode(body));
+            throw HALT;
+        },
+
+        noContent() {
+            res.statusCode = 204;
+            res.end();
+            throw HALT;
+        },
+    };
+}
+
+module.exports = { createResponse, HALT };

package/src/backend/_core/modules/Response.php

@@ -1,49 +1,49 @@
-<?php
-
-declare(strict_types=1);
-
-if (!defined('CORE_ACCESS')) {
-    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
-    http_response_code(404);
-    if (file_exists($errorPage)) {
-        header('Content-Type: text/html; charset=UTF-8');
-        echo file_get_contents($errorPage);
-    } else {
-        echo "404 Not Found";
-    }
-    exit;
-}
-
-class Response
-{
-    public static function success(mixed $data = null, int $code = 200): never
-    {
-        http_response_code($code);
-        echo json_encode([
-            'status' => 'success',
-            'data'   => $data,
-        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-        exit;
-    }
-
-    public static function error(string $message, int $code = 400, mixed $details = null): never
-    {
-        http_response_code($code);
-        $body = [
-            'status'  => 'error',
-            'message' => $message,
-            'code'    => $code,
-        ];
-        if ($details !== null) {
-            $body['details'] = $details;
-        }
-        echo json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
-        exit;
-    }
-
-    public static function noContent(): never
-    {
-        http_response_code(204);
-        exit;
-    }
+<?php
+
+declare(strict_types=1);
+
+if (!defined('CORE_ACCESS')) {
+    $errorPage = $_SERVER['DOCUMENT_ROOT'] . '/404.html';
+    http_response_code(404);
+    if (file_exists($errorPage)) {
+        header('Content-Type: text/html; charset=UTF-8');
+        echo file_get_contents($errorPage);
+    } else {
+        echo "404 Not Found";
+    }
+    exit;
+}
+
+class Response
+{
+    public static function success(mixed $data = null, int $code = 200): never
+    {
+        http_response_code($code);
+        echo json_encode([
+            'status' => 'success',
+            'data'   => $data,
+        ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+        exit;
+    }
+
+    public static function error(string $message, int $code = 400, mixed $details = null): never
+    {
+        http_response_code($code);
+        $body = [
+            'status'  => 'error',
+            'message' => $message,
+            'code'    => $code,
+        ];
+        if ($details !== null) {
+            $body['details'] = $details;
+        }
+        echo json_encode($body, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
+        exit;
+    }
+
+    public static function noContent(): never
+    {
+        http_response_code(204);
+        exit;
+    }
 }

package/src/backend/api/protected/example-protected.js

@@ -1,23 +1,23 @@
-'use strict';
-
-/**
- * Mirror of src/backend/api/protected/example-protected.php
- *
- * Protected endpoint: the API key check (X-Api-Key header) runs automatically in
- * the front controller before this file is loaded, so here we just handle logic.
- */
-
-module.exports = ({ method, requestParams, Response }) => {
-    if (method !== 'GET') {
-        Response.error('Method not allowed', 405);
-    }
-
-    //
-    // Your endpoint logic here. You can access route parameters in requestParams
-    //
-
-    Response.success({
-        message: 'Protected endpoint is working',
-        params: requestParams,
-    });
-};
+'use strict';
+
+/**
+ * Mirror of src/backend/api/protected/example-protected.php
+ *
+ * Protected endpoint: the API key check (X-Api-Key header) runs automatically in
+ * the front controller before this file is loaded, so here we just handle logic.
+ */
+
+module.exports = ({ method, requestParams, Response }) => {
+    if (method !== 'GET') {
+        Response.error('Method not allowed', 405);
+    }
+
+    //
+    // Your endpoint logic here. You can access route parameters in requestParams
+    //
+
+    Response.success({
+        message: 'Protected endpoint is working',
+        params: requestParams,
+    });
+};

package/src/backend/api/protected/example-protected.php

@@ -1,17 +1,17 @@
-<?php
-declare(strict_types=1);
-
-require_once CORE_PATH . '/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-//
-// Your endpoint logic here. You can access route parameters in $requestParams array
-//
-
-Response::success([
-    'message'    => 'Protected endpoint is working',
-    'params'     => $requestParams,
+<?php
+declare(strict_types=1);
+
+require_once CORE_PATH . '/modules/Response.php';
+
+if ($method !== 'GET') {
+    Response::error('Method not allowed', 405);
+}
+
+//
+// Your endpoint logic here. You can access route parameters in $requestParams array
+//
+
+Response::success([
+    'message'    => 'Protected endpoint is working',
+    'params'     => $requestParams,
 ]);

package/src/backend/api/public/example-public.js

@@ -1,24 +1,24 @@
-'use strict';
-
-/**
- * Mirror of src/backend/api/public/example-public.php
- *
- * Public endpoint: no API key required. Receives the request context and calls
- * the request-bound Response helper, exactly like the PHP file used the global
- * Response class and $method / $requestParams.
- */
-
-module.exports = ({ method, requestParams, Response }) => {
-    if (method !== 'GET') {
-        Response.error('Method not allowed', 405);
-    }
-
-    //
-    // Your endpoint logic here. You can access route parameters in requestParams
-    //
-
-    Response.success({
-        message: 'Public endpoint is working',
-        params: requestParams,
-    });
-};
+'use strict';
+
+/**
+ * Mirror of src/backend/api/public/example-public.php
+ *
+ * Public endpoint: no API key required. Receives the request context and calls
+ * the request-bound Response helper, exactly like the PHP file used the global
+ * Response class and $method / $requestParams.
+ */
+
+module.exports = ({ method, requestParams, Response }) => {
+    if (method !== 'GET') {
+        Response.error('Method not allowed', 405);
+    }
+
+    //
+    // Your endpoint logic here. You can access route parameters in requestParams
+    //
+
+    Response.success({
+        message: 'Public endpoint is working',
+        params: requestParams,
+    });
+};

package/src/backend/api/public/example-public.php

@@ -1,17 +1,17 @@
-<?php
-declare(strict_types=1);
-
-require_once CORE_PATH . '/modules/Response.php';
-
-if ($method !== 'GET') {
-    Response::error('Method not allowed', 405);
-}
-
-//
-// Your endpoint logic here. You can access route parameters in $requestParams array
-//
-
-Response::success([
-    'message'    => 'Public endpoint is working',
-    'params'     => $requestParams,
+<?php
+declare(strict_types=1);
+
+require_once CORE_PATH . '/modules/Response.php';
+
+if ($method !== 'GET') {
+    Response::error('Method not allowed', 405);
+}
+
+//
+// Your endpoint logic here. You can access route parameters in $requestParams array
+//
+
+Response::success([
+    'message'    => 'Public endpoint is working',
+    'params'     => $requestParams,
 ]);

package/src/backend/database/Database.js

@@ -1,46 +1,46 @@
-'use strict';
-
-/**
- * Mirror of src/backend/database/Database.php
- *
- * PDO singleton → a single shared mysql2 connection pool. Config is read from
- * ../config.js (same relative location as the PHP version's ../config.php).
- * Options map the PDO attributes as closely as mysql2 allows:
- *   - ERRMODE_EXCEPTION      → mysql2 rejects/throws on error by default
- *   - FETCH_ASSOC            → rowsAsArray:false (objects keyed by column) is default
- *   - EMULATE_PREPARES false → native prepared statements via pool.execute()
- *
- * Requires the "mysql2" package (npm install mysql2). getInstance() returns the
- * promise-based pool; use pool.execute(sql, params) for prepared statements.
- */
-
-const path = require('path');
-
-let instance = null;
-
-class Database {
-    static getInstance() {
-        if (instance === null) {
-            // Lazy require so the backend boots even without a DB configured.
-            // eslint-disable-next-line global-require
-            const mysql = require('mysql2/promise');
-
-            // eslint-disable-next-line global-require
-            const config = require(path.join(__dirname, '..', 'config.js'));
-
-            instance = mysql.createPool({
-                host: config.DB_HOST,
-                database: config.DB_NAME,
-                user: config.DB_USER,
-                password: config.DB_PASS,
-                charset: 'utf8mb4',
-                waitForConnections: true,
-                connectionLimit: 10,
-                namedPlaceholders: false,
-            });
-        }
-        return instance;
-    }
-}
-
-module.exports = Database;
+'use strict';
+
+/**
+ * Mirror of src/backend/database/Database.php
+ *
+ * PDO singleton → a single shared mysql2 connection pool. Config is read from
+ * ../config.js (same relative location as the PHP version's ../config.php).
+ * Options map the PDO attributes as closely as mysql2 allows:
+ *   - ERRMODE_EXCEPTION      → mysql2 rejects/throws on error by default
+ *   - FETCH_ASSOC            → rowsAsArray:false (objects keyed by column) is default
+ *   - EMULATE_PREPARES false → native prepared statements via pool.execute()
+ *
+ * Requires the "mysql2" package (npm install mysql2). getInstance() returns the
+ * promise-based pool; use pool.execute(sql, params) for prepared statements.
+ */
+
+const path = require('path');
+
+let instance = null;
+
+class Database {
+    static getInstance() {
+        if (instance === null) {
+            // Lazy require so the backend boots even without a DB configured.
+            // eslint-disable-next-line global-require
+            const mysql = require('mysql2/promise');
+
+            // eslint-disable-next-line global-require
+            const config = require(path.join(__dirname, '..', 'config.js'));
+
+            instance = mysql.createPool({
+                host: config.DB_HOST,
+                database: config.DB_NAME,
+                user: config.DB_USER,
+                password: config.DB_PASS,
+                charset: 'utf8mb4',
+                waitForConnections: true,
+                connectionLimit: 10,
+                namedPlaceholders: false,
+            });
+        }
+        return instance;
+    }
+}
+
+module.exports = Database;

package/src/backend/database/Database.php

@@ -1,24 +1,24 @@
-<?php
-declare(strict_types=1);
-
-class Database {
-    private static ?PDO $instance = null;
-
-    private function __construct() {}
-
-    public static function getInstance(): PDO {
-        if (self::$instance === null) {
-            $config = require __DIR__ . '/../config.php';
-            
-            $dsn = "mysql:host={$config['DB_HOST']};dbname={$config['DB_NAME']};charset=utf8mb4";
-            $options = [
-                PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-                PDO::ATTR_EMULATE_PREPARES   => false,
-            ];
-
-            self::$instance = new PDO($dsn, $config['DB_USER'], $config['DB_PASS'], $options);
-        }
-        return self::$instance;
-    }
+<?php
+declare(strict_types=1);
+
+class Database {
+    private static ?PDO $instance = null;
+
+    private function __construct() {}
+
+    public static function getInstance(): PDO {
+        if (self::$instance === null) {
+            $config = require __DIR__ . '/../config.php';
+            
+            $dsn = "mysql:host={$config['DB_HOST']};dbname={$config['DB_NAME']};charset=utf8mb4";
+            $options = [
+                PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+                PDO::ATTR_EMULATE_PREPARES   => false,
+            ];
+
+            self::$instance = new PDO($dsn, $config['DB_USER'], $config['DB_PASS'], $options);
+        }
+        return self::$instance;
+    }
 }

package/src/backend/example.config.js

@@ -1,37 +1,37 @@
-'use strict';
-
-/**
- * Mirror of src/backend/example.config.php
- *
- * Versioned, secret-free template. On setup, copy this file to config.js and
- * fill in real values. config.js is git-ignored and stays local.
- */
-
-module.exports = {
-    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
-    GENERAL_API_KEY: 'DEFAULT_KEY',
-
-    // If you want to restrict access to protected endpoints to specific clients, define custom keys per endpoint.
-    // For subfolder endpoints, use the relative path ('subfolder/endpoint')
-    CUSTOM_ENDPOINT_KEYS: {
-        'subfolder/example-protected': 'custom-key',
-    },
-
-    GENERAL_ALLOWED_ORIGINS: [
-        '*',
-        // 'https://example.com',
-    ],
-
-    CUSTOM_ENDPOINT_ORIGINS: {
-        'subfolder/example-protected': ['https://app.example.com'],
-    },
-
-    // Database configuration
-    DB_HOST: '127.0.0.1',
-    DB_NAME: 'example_db',
-    DB_USER: 'root',
-    DB_PASS: '',
-
-    // Environment: 'production' hides error details; anything else = debug.
-    APP_ENV: 'production',
-};
+'use strict';
+
+/**
+ * Mirror of src/backend/example.config.php
+ *
+ * Versioned, secret-free template. On setup, copy this file to config.js and
+ * fill in real values. config.js is git-ignored and stays local.
+ */
+
+module.exports = {
+    // Default key for protected endpoints that don't have a specific key in CUSTOM_ENDPOINT_KEYS
+    GENERAL_API_KEY: 'DEFAULT_KEY',
+
+    // If you want to restrict access to protected endpoints to specific clients, define custom keys per endpoint.
+    // For subfolder endpoints, use the relative path ('subfolder/endpoint')
+    CUSTOM_ENDPOINT_KEYS: {
+        'subfolder/example-protected': 'custom-key',
+    },
+
+    GENERAL_ALLOWED_ORIGINS: [
+        '*',
+        // 'https://example.com',
+    ],
+
+    CUSTOM_ENDPOINT_ORIGINS: {
+        'subfolder/example-protected': ['https://app.example.com'],
+    },
+
+    // Database configuration
+    DB_HOST: '127.0.0.1',
+    DB_NAME: 'example_db',
+    DB_USER: 'root',
+    DB_PASS: '',
+
+    // Environment: 'production' hides error details; anything else = debug.
+    APP_ENV: 'production',
+};