Files
breadcrumb-the-shire/bin/module-build.php
fs 476f688bd8 harden: web/index.php — runtime fingerprint, API channel isolation, extract() safety
Three robustness improvements to the request entry point:

P1a: Module runtime stale-detection via fingerprint
- ModuleRuntimePageBuilder gains writeFingerprint/readFingerprint/expectedFingerprint
- module-build.php writes storage/runtime/.module-fingerprint after each build
- web/index.php validates fingerprint on every request; throws RuntimeException
  with actionable message if stale (replaces silent auto-build in request path)
- Eliminates P2 (concurrency) by removing build from hot path entirely

P1b: API requests skip session/auth/cookie flows
- Channel detection (isApiRequest) moved before Session::start()
- Session::start(), remember-me, session timeout, tenant refresh and locale
  resolution wrapped in if-not-API guard
- API endpoints no longer set cookies or trigger login redirects
- Default locale set separately for API so t() works in error responses

P3: extract(Router::getParameters(), EXTR_SKIP)
- Prevents URL parameters from overwriting existing scope variables

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 22:41:59 +01:00

84 lines
2.8 KiB
PHP

#!/usr/bin/env php
<?php
/**
* Builds the runtime page root by symlinking module pages into storage/runtime/pages/.
*
* Usage: php bin/module-build.php
*
* The runtime page root mirrors the core pages/ directory and adds symlinks for
* each enabled module's pages. MintyPHP Router::$pageRoot points to this directory.
*
* This script is idempotent and uses a lock file to prevent concurrent builds.
*
* Exit codes:
* 0 — build successful (or nothing to do)
* 1 — error during build
*/
declare(strict_types=1);
use MintyPHP\App\Module\ModuleRegistry;
use MintyPHP\App\Module\ModuleRuntimePageBuilder;
require_once __DIR__ . '/module-cli-bootstrap.php';
function moduleBuildRun(): int
{
$warningsBefore = moduleCliVendorWarningsIgnoredTotal();
moduleCliBootstrapApp();
$exitCode = 0;
$runtimeDir = __DIR__ . '/../storage/runtime/pages';
$lockFile = __DIR__ . '/../storage/runtime/.module-build.lock';
try {
// Ensure runtime directory exists
$runtimeParent = dirname($runtimeDir);
if (!is_dir($runtimeParent) && !mkdir($runtimeParent, 0775, true) && !is_dir($runtimeParent)) {
throw new \RuntimeException("Failed to create runtime directory: {$runtimeParent}");
}
// Lock to prevent concurrent builds
$lock = fopen($lockFile, 'c');
if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) {
fwrite(STDERR, "module-build: another build is in progress, skipping.\n");
return 0;
}
$registry = app(ModuleRegistry::class);
$modules = $registry->getModules();
$builder = new ModuleRuntimePageBuilder();
$result = $builder->build($runtimeDir, __DIR__ . '/../pages', $modules);
ModuleRuntimePageBuilder::writeFingerprint($runtimeDir, $modules);
if (count($modules) === 0) {
fwrite(STDOUT, "module-build: no modules, runtime → core pages (symlink).\n");
} else {
fwrite(STDOUT, sprintf(
"module-build: runtime pages built — %d core entries + %d module entries.\n",
(int) ($result['core_entries'] ?? 0),
(int) ($result['module_entries'] ?? 0)
));
}
} catch (Throwable $exception) {
fwrite(STDERR, sprintf("module-build: FAILED: %s\n", $exception->getMessage()));
$exitCode = 1;
} finally {
if (isset($lock) && is_resource($lock)) {
flock($lock, LOCK_UN);
fclose($lock);
}
}
$vendorWarningsIgnored = moduleCliVendorWarningsIgnoredSince($warningsBefore);
fwrite(STDOUT, sprintf("module-build: vendor_warnings_ignored=%d\n", $vendorWarningsIgnored));
return $exitCode;
}
if (PHP_SAPI === 'cli' && realpath((string) ($_SERVER['SCRIPT_FILENAME'] ?? '')) === __FILE__) {
exit(moduleBuildRun());
}