refactor: rename lib/ to core/ for clearer core-module separation

Rename the top-level lib/ directory to core/ so the project root immediately communicates which code is core platform and which lives in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the Composer PSR-4 path mapping moves from lib/ to core/. Module-internal lib/ directories (modules/*/lib/) are untouched. Updated across the full stack: - composer.json PSR-4 mapping - bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php) - tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer) - 26 architecture contract tests - enforcement-policy, guard-catalog, quality-gates - all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/) - bin/qa-extended.sh search paths - .claude/settings.local.json permission paths Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner → Executor → Code Review (4 findings fixed) → Security Review → Acceptance Test → Finalizer) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-13 23:20:05 +02:00
parent 7c10fadcb9
commit 0e86925464
371 changed files with 191 additions and 192 deletions
--- a/core/Service/Access/SettingsAuthorizationPolicy.php
+++ b/core/Service/Access/SettingsAuthorizationPolicy.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace MintyPHP\Service\Access;
+
+class SettingsAuthorizationPolicy implements AuthorizationPolicyInterface
+{
+    use AuthorizationPolicyContextTrait;
+
+    public const ABILITY_ADMIN_SETTINGS_VIEW = 'admin.settings.view';
+    public const ABILITY_ADMIN_SETTINGS_UPDATE = 'admin.settings.update';
+    public const ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE = 'admin.settings.branding.update';
+    public const ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE = 'admin.settings.tokens.revoke';
+    public const ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN = 'admin.settings.user_lifecycle.run';
+
+    public function __construct(
+        private readonly PermissionService $permissionService
+    ) {
+    }
+
+    public function supports(string $ability): bool
+    {
+        return in_array($ability, [
+            self::ABILITY_ADMIN_SETTINGS_VIEW,
+            self::ABILITY_ADMIN_SETTINGS_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
+            self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN,
+        ], true);
+    }
+
+    public function authorize(string $ability, array $context = []): AuthorizationDecision
+    {
+        return match ($ability) {
+            self::ABILITY_ADMIN_SETTINGS_VIEW => $this->authorizeAdminSettingsView($context),
+            self::ABILITY_ADMIN_SETTINGS_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
+            self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN => $this->authorizeSettingsUpdatePermission($context),
+            default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
+        };
+    }
+
+    private function authorizeAdminSettingsView(array $context): AuthorizationDecision
+    {
+        $actorUserId = $this->actorUserId($context);
+        if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_VIEW)) {
+            return AuthorizationDecision::deny(403, 'forbidden');
+        }
+
+        return AuthorizationDecision::allow([
+            'capabilities' => [
+                'can_view_page' => true,
+                'can_update_settings' => $this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE),
+            ],
+        ]);
+    }
+
+    private function authorizeSettingsUpdatePermission(array $context): AuthorizationDecision
+    {
+        $actorUserId = $this->actorUserId($context);
+        if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE)) {
+            return AuthorizationDecision::deny(403, 'forbidden');
+        }
+
+        return AuthorizationDecision::allow();
+    }
+
+}