xamxam/TODO.md

TODO

• Replace inline alert CSS in admin.css with floating bottom-center toast styles (fixed, z-index, animation)

• Update flash-messages.php partial to output .toast markup in hidden container for footer JS

• Add toast container HTML + JS to admin footer.php (centralised, 4s auto-dismiss with fade-out)

• Remove redundant flash-messages.php includes from all admin pages (8 files)

• Convert hardcoded alerts in login.php, thanks.php, index.php import to .toast class

• Update admin.css dialog rule from [role=alert/status] to .toast

• Commit with jj

• Move DB export from admin/index.php to admin/parametres.php (maintenance section)

• Reorganize src/ - move 7 controllers to src/Controllers/

  • Create Controllers directory
  • Move controller files (Home, Tfe, Search, ThesisCreate, ThesisEdit, Export, System)
  • Update all require_once paths across codebase

• Move stray test.db from root to storage/

• Store admin password hash in DB (site_settings) instead of config file

  • Create migration 013
  • Update AdminAuth to read hash from DB
  • Update bootstrap.php — remove credential file loading
  • Update parametres.php — status check from DB
  • Update actions/account.php — write hash to DB
  • Update login.php — dev-mode check
  • Update header.php — dev check
  • Delete config/admin_credentials.example.php

Now: Single Entry Point Routing

Phase 1: Dispatcher refinement

• MediaController: extract media.php logic into MediaController class
  • Create src/Controllers/MediaController.php
  • Move path validation + storage jail + MIME check + streaming
  • Wire into Dispatcher for /media route
  • Delete app/public/media.php
• Update Dispatcher to handle all routes directly (no require APP_ROOT/public/*.php)

Phase 2: Single entry point

• Create app/public/index.php as front controller
  • Bootstrap + Dispatcher invocation
• Remove direct-access public/*.php (index.php, search.php, tfe.php, apropos.php, licence.php)
• Rename old entry points so they can't be hit directly (e.g., prefix with underscore or delete)

Phase 3: Server config

• Update router.php — route all PHP requests to Dispatcher
• Update nginx config — point all public routes to index.php via try_files
  • Replace per-file location ~ \.php$ with front-controller pattern

Phase 4: Cleanup

• Delete app/public/live-reload.php (already handled by LiveReloadController)
• Test all routes (/, search.php, tfe, repertoire, apropos, licence, media, live-reload)