Files

fs 8cd21f3c8a fix: permission sync was deactivating core permissions, not just module-owned ones

deactivateOrphaned() treated ALL is_system=1 permissions as module-owned.
Core seed permissions (users.view, tenants.view, etc.) are also is_system=1,
so they were incorrectly deactivated — breaking admin panel access.

Fix: scan all module manifests on disk (enabled or not) to build the set of
module-owned permission keys. Only deactivate permissions whose key appears
in that set. Core seed permissions are never touched.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-19 19:32:36 +01:00

App

fix: permission sync was deactivating core permissions, not just module-owned ones

2026-03-19 19:32:36 +01:00

Architecture

Split list titlebar contracts

2026-03-19 19:29:45 +01:00

Console

refactor: console improvements — auto-discovery, centralized bootstrap, per-command help

2026-03-19 19:16:36 +01:00

Domain/Taxonomy

major update

2026-03-04 15:56:58 +01:00

Http

fix(session): preserve intended URL across session timeout with remember-me

2026-03-13 18:28:13 +01:00

I18n

big restructure

2026-02-11 19:28:12 +01:00

Repository

refactor(repository): deduplicate unwrap and id array helpers

2026-03-13 13:12:51 +01:00

Service

feat: module architecture improvements — session keys, dependency graph, event dispatcher, deactivation hooks

2026-03-19 18:20:13 +01:00

Support

feat: extract bookmarks as standalone module with MintyPHP\Module\Bookmarks namespace

2026-03-18 22:20:20 +01:00

Unit/Module

feat: module architecture improvements — session keys, dependency graph, event dispatcher, deactivation hooks

2026-03-19 18:20:13 +01:00

bootstrap.php

major update

2026-03-04 15:56:58 +01:00

README.md

Split list titlebar contracts

2026-03-19 19:29:45 +01:00

README.md

Tests

Ziel

Die Tests sind nach Schutzwirkung organisiert, nicht nur nach technischer Ebene. Wichtige Architektur- und Security-Invarianten sollen schnell gezielt laufen koennen, ohne dass jede Aenderung immer die komplette Suite im Kopf behalten muss.

PHPUnit-Suiten

CoreCore: gesamte Test-Suite.
Architecture: alle Architektur-Contracts unter tests/Architecture/.
ArchitectureCore: Core-Boundaries, Module-/Repository-Contracts, Taxonomie- und Sync-Contracts.
ArchitectureSecurity: CSRF, PRG, File-Storage, Crypto, Logging sowie AuthZ-nahe Contracts.
ArchitectureUI: UI-Contracts fuer Listen, Detailseiten, Runtime-Komponenten und A11y.
ArchitectureModules: modulbezogene Struktur- und Isolations-Contracts.
ArchitectureMeta: Agent-/Skill-/Meta-Contracts fuer das Repository-Setup.

Regeln fuer neue Architecture-Tests

Nur stabile Invarianten testen, keine einmaligen Migrationsdetails.
Guards oder Risiken explizit abdecken, zum Beispiel GR-CORE-*, GR-SEC-*, GR-TEST-*.
Keine Duplikate neben bereits breiten Contracts anlegen.
String-Assertions nur verwenden, wenn kein robusterer Contract moeglich ist.
Monolithische Sammeltests vermeiden; lieber kleine thematische Contracts.

Delete vs. Refactor vs. Keep

keep: testet einen echten plattformweiten Contract oder Security-Guard.
refactor: Schutz ist wichtig, aber der Test ist zu datei-, markup- oder implementation-detailnah.
delete: dupliziert bestehende Schutzwirkung oder prueft nur historische Altlasten.

Naechste Refactor-Kandidaten

tests/Architecture/ContainerFactoryContractTest.php
tests/Architecture/SecurityCryptoContractTest.php
tests/Architecture/AuthzApiBootstrapContractTest.php
tests/Architecture/ListUiSharedPartialsContractTest.php