nibula 1.6.0 → 1.6.2

package/src/backend/_core/index.php

@@ -1,161 +1,161 @@
-<?php
-
-declare(strict_types=1);
-
-define('CORE_ACCESS', true);
-define('CORE_PATH', __DIR__);
-
-/**
- * Load dependencies and initial configuration.
- */
-require_once __DIR__ . '/init.php';
-require_once __DIR__ . '/modules/Response.php';
-
-// =====================================================
-// 1. REQUEST PARSING
-// =====================================================
-
-$method = $_SERVER['REQUEST_METHOD'];
-$uri    = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-
-$uri    = rtrim(preg_replace('#^/api#', '', $uri), '/') ?: '/';
-$parts  = array_values(array_filter(explode('/', $uri)));
-
-foreach ($parts as $part) {
-    if ($part === '..' || $part === '.') {
-        Response::error('Bad Request', 400);
-    }
-}
-
-// =====================================================
-// 2. ENDPOINT RESOLUTION (ROUTING WITH SUBDIRECTORIES)
-// =====================================================
-
-$basePublic    = __DIR__ . '/../api/public/';
-$baseProtected = __DIR__ . '/../api/protected/';
-
-$endpointFile  = null;
-$isProtected   = false;
-$requestParams = [];
-
-// Temporary variables for the lookup loop
-$checkParts = $parts;
-$params     = [];
-
-/**
- * Dynamic routing logic: find the deepest matching endpoint file.
- * At each iteration, the last URL segment is peeled off and stored
- * as a route parameter until a matching file is found.
- */
-while (count($checkParts) > 0) {
-    $relativePath = implode('/', $checkParts) . '.php';
-
-    // Check first whether this is a public route
-    if (file_exists($basePublic . $relativePath)) {
-        $endpointFile = $basePublic . $relativePath;
-        $isProtected  = false;
-        break;
-    }
-
-    // Then check whether this is a protected route
-    if (file_exists($baseProtected . $relativePath)) {
-        $endpointFile = $baseProtected . $relativePath;
-        $isProtected  = true;
-        break;
-    }
-
-    // No file matched: treat the last segment as a route parameter and try again
-    array_unshift($params, array_pop($checkParts));
-}
-
-/**
- * IF THE ENDPOINT DOES NOT EXIST, RETURN AN HTML 404 PAGE.
- */
-if (!$endpointFile) {
-    http_response_code(404);
-    header_remove('WWW-Authenticate');
-
-    /**
-     * In a Nibula build the backend lives at out/backend/, so the site root
-     * (out/) is two levels up from _core. DOCUMENT_ROOT is preferred when it
-     * resolves, but on shared hosting it often points elsewhere, so the
-     * relative path is used as a fallback. Same resolution as index.js.
-     */
-    $documentRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
-    $errorPage    = $documentRoot . '/404.html';
-
-    if (!file_exists($errorPage)) {
-        $errorPage = __DIR__ . '/../../404.html';
-    }
-
-    header('Content-Type: text/html; charset=UTF-8');
-
-    if (file_exists($errorPage)) {
-        echo file_get_contents($errorPage);
-    } else {
-        echo "<h1>404 Not Found</h1>";
-        echo "The requested URL was not found on this server.";
-    }
-    exit;
-}
-
-$base         = $isProtected ? $baseProtected : $basePublic;
-$base         = str_replace('\\', '/', $base);
-$endpointPath = str_replace('\\', '/', $endpointFile);
-$endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
-
-// =====================================================
-// 3. HEADERS AND CORS (Only if the endpoint exists)
-// =====================================================
-
-header('Content-Type: application/json; charset=UTF-8');
-header_remove('WWW-Authenticate');
-header('X-Content-Type-Options: nosniff');
-header('X-Frame-Options: DENY');
-header('Referrer-Policy: strict-origin-when-cross-origin');
-header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
-header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
-
-$originsForEndpoint = $config['CUSTOM_ENDPOINT_ORIGINS'][$endpointPath]
-    ?? $config['GENERAL_ALLOWED_ORIGINS']
-    ?? [];
-
-$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
-
-if ($origin !== '' && in_array($origin, $originsForEndpoint, true)) {
-    header('Access-Control-Allow-Origin: ' . $origin);
-    header('Vary: Origin');
-} elseif (in_array('*', $originsForEndpoint, true)) {
-    header('Access-Control-Allow-Origin: *');
-}
-
-if ($method === 'OPTIONS') {
-    http_response_code(204);
-    exit;
-}
-
-require_once __DIR__ . '/modules/RateLimiter.php';
-RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
-
-// =====================================================
-// 4. AUTHENTICATION GUARD
-// =====================================================
-
-if ($isProtected) {
-    $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
-    $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
-
-    if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
-        Response::error('Unauthorized. X_API_KEY is incorrect or missing', 403);
-    }
-}
-
-// =====================================================
-// 5. DISPATCH
-// =====================================================
-
-// Parameters are the remaining URL segments not consumed during endpoint resolution
-$requestParams = $params;
-
-// Load and execute the matched endpoint file
+<?php
+
+declare(strict_types=1);
+
+define('CORE_ACCESS', true);
+define('CORE_PATH', __DIR__);
+
+/**
+ * Load dependencies and initial configuration.
+ */
+require_once __DIR__ . '/init.php';
+require_once __DIR__ . '/modules/Response.php';
+
+// =====================================================
+// 1. REQUEST PARSING
+// =====================================================
+
+$method = $_SERVER['REQUEST_METHOD'];
+$uri    = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
+
+$uri    = rtrim(preg_replace('#^/api#', '', $uri), '/') ?: '/';
+$parts  = array_values(array_filter(explode('/', $uri)));
+
+foreach ($parts as $part) {
+    if ($part === '..' || $part === '.') {
+        Response::error('Bad Request', 400);
+    }
+}
+
+// =====================================================
+// 2. ENDPOINT RESOLUTION (ROUTING WITH SUBDIRECTORIES)
+// =====================================================
+
+$basePublic    = __DIR__ . '/../api/public/';
+$baseProtected = __DIR__ . '/../api/protected/';
+
+$endpointFile  = null;
+$isProtected   = false;
+$requestParams = [];
+
+// Temporary variables for the lookup loop
+$checkParts = $parts;
+$params     = [];
+
+/**
+ * Dynamic routing logic: find the deepest matching endpoint file.
+ * At each iteration, the last URL segment is peeled off and stored
+ * as a route parameter until a matching file is found.
+ */
+while (count($checkParts) > 0) {
+    $relativePath = implode('/', $checkParts) . '.php';
+
+    // Check first whether this is a public route
+    if (file_exists($basePublic . $relativePath)) {
+        $endpointFile = $basePublic . $relativePath;
+        $isProtected  = false;
+        break;
+    }
+
+    // Then check whether this is a protected route
+    if (file_exists($baseProtected . $relativePath)) {
+        $endpointFile = $baseProtected . $relativePath;
+        $isProtected  = true;
+        break;
+    }
+
+    // No file matched: treat the last segment as a route parameter and try again
+    array_unshift($params, array_pop($checkParts));
+}
+
+/**
+ * IF THE ENDPOINT DOES NOT EXIST, RETURN AN HTML 404 PAGE.
+ */
+if (!$endpointFile) {
+    http_response_code(404);
+    header_remove('WWW-Authenticate');
+
+    /**
+     * In a Nibula build the backend lives at out/backend/, so the site root
+     * (out/) is two levels up from _core. DOCUMENT_ROOT is preferred when it
+     * resolves, but on shared hosting it often points elsewhere, so the
+     * relative path is used as a fallback. Same resolution as index.js.
+     */
+    $documentRoot = $_SERVER['DOCUMENT_ROOT'] ?? '';
+    $errorPage    = $documentRoot . '/404.html';
+
+    if (!file_exists($errorPage)) {
+        $errorPage = __DIR__ . '/../../404.html';
+    }
+
+    header('Content-Type: text/html; charset=UTF-8');
+
+    if (file_exists($errorPage)) {
+        echo file_get_contents($errorPage);
+    } else {
+        echo "<h1>404 Not Found</h1>";
+        echo "The requested URL was not found on this server.";
+    }
+    exit;
+}
+
+$base         = $isProtected ? $baseProtected : $basePublic;
+$base         = str_replace('\\', '/', $base);
+$endpointPath = str_replace('\\', '/', $endpointFile);
+$endpointPath = preg_replace('#\.php$#', '', str_replace($base, '', $endpointPath));
+
+// =====================================================
+// 3. HEADERS AND CORS (Only if the endpoint exists)
+// =====================================================
+
+header('Content-Type: application/json; charset=UTF-8');
+header_remove('WWW-Authenticate');
+header('X-Content-Type-Options: nosniff');
+header('X-Frame-Options: DENY');
+header('Referrer-Policy: strict-origin-when-cross-origin');
+header('Access-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS');
+header('Access-Control-Allow-Headers: Content-Type, X-Api-Key');
+
+$originsForEndpoint = $config['CUSTOM_ENDPOINT_ORIGINS'][$endpointPath]
+    ?? $config['GENERAL_ALLOWED_ORIGINS']
+    ?? [];
+
+$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+
+if ($origin !== '' && in_array($origin, $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: ' . $origin);
+    header('Vary: Origin');
+} elseif (in_array('*', $originsForEndpoint, true)) {
+    header('Access-Control-Allow-Origin: *');
+}
+
+if ($method === 'OPTIONS') {
+    http_response_code(204);
+    exit;
+}
+
+require_once __DIR__ . '/modules/RateLimiter.php';
+RateLimiter::check($_SERVER['REMOTE_ADDR'] ?? '', 60, 60);
+
+// =====================================================
+// 4. AUTHENTICATION GUARD
+// =====================================================
+
+if ($isProtected) {
+    $validKey = $config['CUSTOM_ENDPOINT_KEYS'][$endpointPath] ?? $config['GENERAL_API_KEY'] ?? '';
+    $apiKey   = $_SERVER['HTTP_X_API_KEY'] ?? '';
+
+    if ($validKey === '' || !hash_equals($validKey, $apiKey)) {
+        Response::error('Unauthorized. X_API_KEY is incorrect or missing', 403);
+    }
+}
+
+// =====================================================
+// 5. DISPATCH
+// =====================================================
+
+// Parameters are the remaining URL segments not consumed during endpoint resolution
+$requestParams = $params;
+
+// Load and execute the matched endpoint file
 require $endpointFile;

package/src/backend/_core/init.js

@@ -1,52 +1,52 @@
-'use strict';
-
-/**
- * Mirror of src/backend/_core/init.php
- *
- * init.php did three things:
- *   1. registered a global exception handler that turns any throwable into a
- *      500 JSON response (verbose in debug, generic in production);
- *   2. registered an error handler that promoted PHP warnings to exceptions;
- *   3. loaded config.php.
- *
- * In Node there is no per-request global handler, so the exception-to-500
- * translation lives in the front controller (index.js), which calls
- * handleException() below. Here we expose config loading and that helper.
- */
-
-const fs = require('fs');
-const path = require('path');
-
-/**
- * Load configuration. dirname(__dirname) in PHP pointed at the folder holding
- * config.php (the backend root). Here that is the parent of _core.
- * If config.js is missing (e.g. fresh clone) we fall back to example.config.js,
- * mirroring the "copy example.config to config" guidance.
- */
-function loadConfig() {
-    const backendRoot = path.join(__dirname, '..');
-    const configPath = path.join(backendRoot, 'config.js');
-    const examplePath = path.join(backendRoot, 'example.config.js');
-
-    if (fs.existsSync(configPath)) {
-        return require(configPath);
-    }
-    return require(examplePath);
-}
-
-/**
- * Turn any thrown error into a 500 response, mirroring set_exception_handler.
- * @param {Error} exception
- * @param {object} config
- * @param {object} Response request-bound helper
- */
-function handleException(exception, config, Response) {
-    const isDebug = (config.APP_ENV || 'production') !== 'production';
-    Response.error(
-        isDebug ? exception.message : 'Internal server error',
-        500,
-        isDebug ? { stack: exception.stack } : null
-    );
-}
-
-module.exports = { loadConfig, handleException };
+'use strict';
+
+/**
+ * Mirror of src/backend/_core/init.php
+ *
+ * init.php did three things:
+ *   1. registered a global exception handler that turns any throwable into a
+ *      500 JSON response (verbose in debug, generic in production);
+ *   2. registered an error handler that promoted PHP warnings to exceptions;
+ *   3. loaded config.php.
+ *
+ * In Node there is no per-request global handler, so the exception-to-500
+ * translation lives in the front controller (index.js), which calls
+ * handleException() below. Here we expose config loading and that helper.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Load configuration. dirname(__dirname) in PHP pointed at the folder holding
+ * config.php (the backend root). Here that is the parent of _core.
+ * If config.js is missing (e.g. fresh clone) we fall back to example.config.js,
+ * mirroring the "copy example.config to config" guidance.
+ */
+function loadConfig() {
+    const backendRoot = path.join(__dirname, '..');
+    const configPath = path.join(backendRoot, 'config.js');
+    const examplePath = path.join(backendRoot, 'example.config.js');
+
+    if (fs.existsSync(configPath)) {
+        return require(configPath);
+    }
+    return require(examplePath);
+}
+
+/**
+ * Turn any thrown error into a 500 response, mirroring set_exception_handler.
+ * @param {Error} exception
+ * @param {object} config
+ * @param {object} Response request-bound helper
+ */
+function handleException(exception, config, Response) {
+    const isDebug = (config.APP_ENV || 'production') !== 'production';
+    Response.error(
+        isDebug ? exception.message : 'Internal server error',
+        500,
+        isDebug ? { stack: exception.stack } : null
+    );
+}
+
+module.exports = { loadConfig, handleException };

package/src/backend/_core/init.php

@@ -1,34 +1,34 @@
-<?php
-
-declare(strict_types=1);
-
-require_once __DIR__ . '/vendor/autoload.php';
-require_once __DIR__ . '/modules/Response.php';
-
-// --- GESTORE GLOBALE ERRORI E ECCEZIONI ---
-set_exception_handler(function ($exception) use (&$config) {
-    $isDebug = ($config['APP_ENV'] ?? 'production') !== 'production';
-    Response::error(
-        $isDebug ? $exception->getMessage() : 'Internal server error',
-        500,
-        $isDebug ? ['file' => $exception->getFile(), 'line' => $exception->getLine()] : null
-    );
-});
-
-set_error_handler(function ($severity, $message, $file, $line) {
-    if (!(error_reporting() & $severity)) return;
-    throw new ErrorException($message, 0, $severity, $file, $line);
-});
-
-// --- CARICAMENTO CONFIGURAZIONE ---
-// dirname(__DIR__) punta alla cartella /api/ dove ora si trova config.php
-$config = require dirname(__DIR__) . '/config.php';
-
-// --- CONFIGURAZIONE AMBIENTE ---
-if (($config['APP_ENV'] ?? 'production') === 'production') {
-    ini_set('display_errors', '0');
-    error_reporting(0);
-} else {
-    ini_set('display_errors', '1');
-    error_reporting(E_ALL);
+<?php
+
+declare(strict_types=1);
+
+require_once __DIR__ . '/vendor/autoload.php';
+require_once __DIR__ . '/modules/Response.php';
+
+// --- GESTORE GLOBALE ERRORI E ECCEZIONI ---
+set_exception_handler(function ($exception) use (&$config) {
+    $isDebug = ($config['APP_ENV'] ?? 'production') !== 'production';
+    Response::error(
+        $isDebug ? $exception->getMessage() : 'Internal server error',
+        500,
+        $isDebug ? ['file' => $exception->getFile(), 'line' => $exception->getLine()] : null
+    );
+});
+
+set_error_handler(function ($severity, $message, $file, $line) {
+    if (!(error_reporting() & $severity)) return;
+    throw new ErrorException($message, 0, $severity, $file, $line);
+});
+
+// --- CARICAMENTO CONFIGURAZIONE ---
+// dirname(__DIR__) punta alla cartella /api/ dove ora si trova config.php
+$config = require dirname(__DIR__) . '/config.php';
+
+// --- CONFIGURAZIONE AMBIENTE ---
+if (($config['APP_ENV'] ?? 'production') === 'production') {
+    ini_set('display_errors', '0');
+    error_reporting(0);
+} else {
+    ini_set('display_errors', '1');
+    error_reporting(E_ALL);
 }

package/src/backend/_core/modules/RateLimiter.js

@@ -1,58 +1,58 @@
-'use strict';
-
-/**
- * Mirror of src/backend/_core/modules/RateLimiter.php
- *
- * Same algorithm and same on-disk format: one JSON file per IP under ../../cache,
- * holding an array of request timestamps. Old timestamps outside the window are
- * pruned, the current one appended, and if the count exceeds the limit a 429 is
- * returned (with a Retry-After header) through the request-bound Response helper.
- */
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-
-class RateLimiter {
-    /**
-     * @param {string} ip
-     * @param {number} maxRequests
-     * @param {number} windowSeconds
-     * @param {object} Response  request-bound helper from createResponse(res)
-     * @param {object} res       raw http response (to set Retry-After)
-     */
-    static check(ip, maxRequests = 60, windowSeconds = 60, Response, res) {
-        const cacheDir = path.join(__dirname, '..', '..', 'cache');
-
-        if (!fs.existsSync(cacheDir)) {
-            fs.mkdirSync(cacheDir, { recursive: true, mode: 0o755 });
-        }
-
-        const hash = crypto.createHash('md5').update(ip).digest('hex');
-        const cacheFile = path.join(cacheDir, 'rl_' + hash + '.json');
-        const now = Math.floor(Date.now() / 1000);
-        let data = [];
-
-        if (fs.existsSync(cacheFile)) {
-            try {
-                data = JSON.parse(fs.readFileSync(cacheFile, 'utf8')) || [];
-            } catch (e) {
-                data = [];
-            }
-        }
-
-        data = data.filter((ts) => ts > (now - windowSeconds));
-        data.push(now);
-
-        // LOCK_EX equivalent: an exclusive write. Node's writeFileSync is atomic
-        // enough for this single-process model.
-        fs.writeFileSync(cacheFile, JSON.stringify(data));
-
-        if (data.length > maxRequests) {
-            res.setHeader('Retry-After', String(windowSeconds));
-            Response.error('Too Many Requests', 429);
-        }
-    }
-}
-
-module.exports = RateLimiter;
+'use strict';
+
+/**
+ * Mirror of src/backend/_core/modules/RateLimiter.php
+ *
+ * Same algorithm and same on-disk format: one JSON file per IP under ../../cache,
+ * holding an array of request timestamps. Old timestamps outside the window are
+ * pruned, the current one appended, and if the count exceeds the limit a 429 is
+ * returned (with a Retry-After header) through the request-bound Response helper.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+class RateLimiter {
+    /**
+     * @param {string} ip
+     * @param {number} maxRequests
+     * @param {number} windowSeconds
+     * @param {object} Response  request-bound helper from createResponse(res)
+     * @param {object} res       raw http response (to set Retry-After)
+     */
+    static check(ip, maxRequests = 60, windowSeconds = 60, Response, res) {
+        const cacheDir = path.join(__dirname, '..', '..', 'cache');
+
+        if (!fs.existsSync(cacheDir)) {
+            fs.mkdirSync(cacheDir, { recursive: true, mode: 0o755 });
+        }
+
+        const hash = crypto.createHash('md5').update(ip).digest('hex');
+        const cacheFile = path.join(cacheDir, 'rl_' + hash + '.json');
+        const now = Math.floor(Date.now() / 1000);
+        let data = [];
+
+        if (fs.existsSync(cacheFile)) {
+            try {
+                data = JSON.parse(fs.readFileSync(cacheFile, 'utf8')) || [];
+            } catch (e) {
+                data = [];
+            }
+        }
+
+        data = data.filter((ts) => ts > (now - windowSeconds));
+        data.push(now);
+
+        // LOCK_EX equivalent: an exclusive write. Node's writeFileSync is atomic
+        // enough for this single-process model.
+        fs.writeFileSync(cacheFile, JSON.stringify(data));
+
+        if (data.length > maxRequests) {
+            res.setHeader('Retry-After', String(windowSeconds));
+            Response.error('Too Many Requests', 429);
+        }
+    }
+}
+
+module.exports = RateLimiter;