fs
545bcc789b
Most German docs were written with `ue`/`ae`/`oe`/`ss` ASCII fallbacks (`fuer`, `aenderung`, `koennen`, `gemaess`) — relic from older toolchain constraints. Replaced 237 occurrences across 38 .md files with proper umlauts and ß so the docs read naturally. Substitutions are constrained to plain prose: fenced code blocks (```...```), inline code spans (`...`), markdown link targets `[..](..)`, and HTML comments are preserved verbatim. Path references like `docs/howto-erste-aenderung.md` keep their original (umlaut-replaced) filenames — only the surrounding prose is normalised. Tool: bin/fix-md-umlauts.py (idempotent — no-op on already-clean files). Re-runnable if ASCII fallbacks creep back in via copy-paste. Doc-link-check + doc-drift-check stay green. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2.0 KiB
2.0 KiB
Core Boundaries (MUST / MUST NOT)
Schichtgrenzen
- MUST SQL nur in
core/Repository/**halten. - MUST Business-Logik in
core/Service/**halten. - MUST
pages/**auf Input, Auth/AuthZ, Orchestrierung, Response begrenzen. - MUST NOT Business- oder Permission-Logik in
templates/**legen.
Instanziierung
- MUST in Actions/Helpern/Templates nur
app(Foo::class)verwenden. - MUST NOT in
pages/**direktnew ...Service|Gateway|Repositorynutzen. - MUST NOT in
core/Service/**(ausser*Factory.php) direktnew ...Factory|Service|Gateway|Repositorynutzen. - MUST NOT in
pages/admin/**Factory::classreferenzieren oderapp(...Factory::class)->create...nutzen.
Input / Validation
- MUST Input in
pages/**überrequestInput()lesen. - MUST NOT
$_POST,$_GET,$_FILES,REQUEST_METHODinpages/**verwenden. - MUST NOT
$_SESSION,$_SERVER,$_COOKIE,$_ENVinpages/**direkt verwenden. - MUST Form-Validation über
FormErrorsführen. - MUST API-Validation-Fehler über
ApiResponse::validationFromFormErrors(...)ausgeben. - MUST NOT
ApiResponse::readJsonBody(...)inpages/api/v1/**verwenden.
List-Data Endpoints
- MUST
pages/**/data().phpals GET-only Endpunkte umsetzen (gridRequireGetRequest()). - MUST Query-Filter über
gridParseFilters(...)+filter-schema.phpnormalisieren. - MUST NOT Query-Filter inline/parallele Alias-Parser in
data().phpneu einführen.
Security / API
- MUST AuthZ serverseitig erzwingen.
- MUST Tenant-Scope serverseitig erzwingen.
- MUST CSRF auf POST-Endpunkten vor Body-Verarbeitung verifizieren.
- MUST NOT PII/Secrets unredacted in Logs oder Audit-Metadata schreiben.
- MUST SQL nur über Repository mit prepared statements ausführen.
- MUST extern UUID-first bleiben.
- MUST API-Fehler konsistent halten (
error, optionalerrors). - MUST OpenAPI im selben Merge aktualisieren, wenn API geändert wird.
Prüf-Hinweis
- Harte Repo-Gates:
tests/Architecture/CoreStarterkitContractTest.php