From 46a3c360ecf62d0c836d3b87f67968055ffa6159 Mon Sep 17 00:00:00 2001
From: Pontoporeia <pontoporeia@happyngreen.fr>
Date: Mon, 27 Apr 2026 21:06:10 +0200
Subject: [PATCH] fix: use local storage/ in dev, create upload dirs, gitignore
 uploads

---
 .gitignore                  | 4 ++++
 TODO.md                     | 5 ++++-
 app/bootstrap.php           | 7 ++++++-
 app/storage/covers/.gitkeep | 0
 app/storage/theses/.gitkeep | 0
 5 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 app/storage/covers/.gitkeep
 create mode 100644 app/storage/theses/.gitkeep

diff --git a/.gitignore b/.gitignore
index c6d8557..6ab9c4d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,10 @@ app/storage/test.db
 error.log
 app/storage/cache/*
 !app/storage/cache/.gitkeep
+app/storage/covers/*
+!app/storage/covers/.gitkeep
+app/storage/theses/*
+!app/storage/theses/.gitkeep
 
 # Nix
 .direnv/
diff --git a/TODO.md b/TODO.md
index dae1728..637bc28 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2,7 +2,10 @@
 
 ## Dev / Debug Fixes
 
-- [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets noise
+- [x] Fix `serve` recipe: show all PHP output (errors, logs) except static assets/connection noise
+- [x] Fix `STORAGE_ROOT` — use local `app/storage/` in dev (cli-server), `/var/www/posterg/storage` in prod
+- [x] Create `app/storage/covers/` and `app/storage/theses/` with `.gitkeep`
+- [x] Add gitignore rules for uploaded files in dev storage dirs
 - [x] Fix `error_log` path in `formulaire.php` (was relative, now absolute)
 - [x] Fix CSRF debug: log both tokens on mismatch
 - [x] Fix undefined `$redirect` on success path in `formulaire.php`
diff --git a/app/bootstrap.php b/app/bootstrap.php
index 4211882..2ecf7b4 100644
--- a/app/bootstrap.php
+++ b/app/bootstrap.php
@@ -10,7 +10,12 @@ define('APP_ROOT', __DIR__);
 // Storage directory for uploaded files — intentionally outside the webroot
 // so no uploaded content is ever directly web-accessible (items #3 & #4).
 // Files are served through MediaController which validates paths and MIME types.
-define('STORAGE_ROOT', '/var/www/posterg/storage');
+// In dev (cli-server) use the local storage/ directory; in production use the
+// absolute path outside the webroot.
+define('STORAGE_ROOT', php_sapi_name() === 'cli-server'
+    ? __DIR__ . '/storage'
+    : '/var/www/posterg/storage'
+);
 
 // Error reporting
 if (php_sapi_name() === 'cli-server') {
diff --git a/app/storage/covers/.gitkeep b/app/storage/covers/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/app/storage/theses/.gitkeep b/app/storage/theses/.gitkeep
new file mode 100644
index 0000000..e69de29