xamxam/app/public/admin

Admin Panel Structure

This directory and app/templates/admin/ contain the admin panel for managing the XAMXAM TFE database.

Entry points (app/public/admin/)

File	Purpose
index.php	List all theses (main page; hosts the inline CSV import + tabs for list/trash)
add.php	Add new thesis form
edit.php	Existing thesis form
recapitulatif.php	Post-submission recap
cleanup.php	Orphaned-draft / storage cleanup
system.php	System dashboard (logs, SMTP/PeerTube status)
contenus.php	Editable content (pages, contacts)
contenus-edit.php	Edit a content page
acces.php	Share-link management
file-access.php	Restricted-file access requests
account.php	Admin account / password
login.php	Login (session)
import.php	Redirects to /admin/ (CSV import is inline in index.php)
status.php, markdown-cheatsheet-fragment.php, *fragment.php	HTMX fragments / helpers

Backend actions (app/public/admin/actions/)

Process forms and redirect (no HTML output):

• formulaire.php — thesis create submission (ThesisCreateController::submit())
• edit.php — thesis edit submission (ThesisEditController::save())
• export-csv.php, export-db.php, export-files.php — see docs/export.md
• filepond/ — FilePond async upload endpoints
• many others: publish, delete, corbeille (trash), draft, visibility, tag, language, form-help*, page, apropos, smtp-test, peertube-*, maintenance, settings, account, access-request, acces-etudiante, cleanup-*

Templates

View templates live under app/templates/admin/ (not in public/):

• app/templates/admin/*.php — page layouts
• app/templates/admin/partials/ — shared fragments (toasts, dialogs, toc, …)

The public/partage and form partials live in app/templates/partials/ and app/templates/partage/.

Auth

• PHP session auth (src/AdminAuth.php) via AdminAuth::requireLogin() is the only authentication layer. The old nginx auth_basic layer has been removed — see docs/security.md and nginx/docs/PHP_AUTH_LAYER.md.
• All forms include a CSRF token from $_SESSION['csrf_token'].
• Inputs use PDO prepared statements; uploads validated and stored outside the webroot (app/storage/).

Bootstrap / routing

Entry pages bootstrap the app and set up the environment:

require_once __DIR__ . '/../../bootstrap.php';      // defines APP_ROOT, autoload, config
require_once APP_ROOT . '/src/AdminAuth.php';
AdminAuth::requireLogin();

APP_ROOT is the app/ directory. Database access is via app/src/Database.php; form logic lives in app/src/Controllers/ and app/src/Form/.

URL structure

• /admin/ — list theses (index.php)
• /admin/add.php — add thesis
• /admin/edit.php?id=N — edit thesis
• /admin/cleanup.php, /admin/system.php, /admin/acces.php, etc.
• /admin/actions/… — backend processors

Development guide

Add a page: create app/templates/admin/yourpage.php, add a thin app/public/admin/yourpage.php entry that bootstraps + requires the template, and add navigation in app/templates/admin/partials/admin-toc.php.

Add an action: create app/public/admin/actions/youraction.php that bootstraps, requires login, verifies the CSRF token, performs the work, and redirects back to the referring admin page.

See docs/development.md for the general workflow (dev server, builds, tests, linting).