Restyle Pinakes and complete mobile collections and catalogue fixes

.distignore

@@ -4,7 +4,7 @@
 # ========================================
 
 # Version control
-.git/
+.git
 .gitignore
 .gitattributes
 

.github/workflows/ci-browser-security.yml

@@ -76,7 +76,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2 tooling
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip, gd, apcu

.github/workflows/ci-database-compatibility.yml

@@ -73,7 +73,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml

.github/workflows/ci-deep-regression.yml

@@ -98,7 +98,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu
@@ -300,7 +300,7 @@ jobs:
           [ -z "${php_module}" ] || sudo a2enmod "${php_module}"
           sudo a2dissite 000-default || true
       - name: Setup PHP and Node
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, curl, zip, gd, intl, xml

.github/workflows/ci-e2e.yml

@@ -78,7 +78,7 @@ jobs:
 
       # ── PHP 8.2 CLI for Composer and tooling ────────────────────────────────
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu

.github/workflows/ci-quality.yml

@@ -66,7 +66,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql
@@ -351,6 +351,7 @@ jobs:
         env:
           CI_STRICT_TESTS: '1'
         run: |
+          php tests/mobile-collections.integration.php
           php tests/desiderata.integration.php
           php tests/desiderata-visibility.integration.php
           php tests/desiderata-extended.integration.php
@@ -385,7 +386,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml

.github/workflows/ci-real-upgrade.yml

@@ -102,7 +102,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu

.github/workflows/ci-security-supply-chain.yml

@@ -119,7 +119,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip
@@ -146,6 +146,9 @@ jobs:
       - name: Verify generated assets match the commit
         run: git diff --exit-code -- public/assets
 
+      - name: Verify packaging from a Git worktree
+        run: bash tests/release-worktree.test.sh
+
       - name: Build the release twice and require byte-for-byte reproducibility
         run: |
           bash bin/build-release.sh --skip-build

.github/workflows/ci-upgrade-smoke.yml

@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, curl, zip, mbstring

.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
         run: bash scripts/ci-verify-release-source.sh
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip, gd

.github/workflows/test-migrations.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           coverage: none
@@ -84,7 +84,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli
@@ -218,7 +218,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql

.rsync-filter

@@ -87,7 +87,7 @@
 # ========================================
 
 # Version control
-- .git/
+- .git
 - .gitignore
 - .gitattributes
 - .gitmodules

app/Controllers/Admin/CmsAdminController.php

@@ -45,22 +45,16 @@ public function editPage(Request $request, Response $response, array $args): Res
         $correctSlug = CmsHelper::getRedirectSlug($slug, $currentLocale);
         if ($correctSlug !== null) {
             // Redirect 301 to correct localized admin slug
+            // Keep the query (?saved=1, ?error=…): it carries the save outcome.
+            $query = $request->getUri()->getQuery();
             return $response
-                ->withHeader('Location', '/admin/cms/' . $correctSlug)
+                ->withHeader('Location', url('/admin/cms/' . $correctSlug) . ($query !== '' ? '?' . $query : ''))
                 ->withStatus(301);
         }
 
-        // Recupera la pagina dal database (slug + locale)
-        $stmt = $this->db->prepare("
-            SELECT id, slug, locale, title, content, image, meta_description, is_active
-            FROM cms_pages
-            WHERE slug = ? AND locale = ?
-        ");
-        $stmt->bind_param('ss', $slug, $currentLocale);
-        $stmt->execute();
-        $result = $stmt->get_result();
-        $page = $result->fetch_assoc();
-        $stmt->close();
+        // The page under this slug, or under another slug of the same page
+        // (an it_IT install seeded with 'about-us'): never a duplicate.
+        $page = $this->findPageRow($slug, $currentLocale);
 
         if (!$page) {
             // Check if this is a known CMS page that should exist
@@ -101,6 +95,9 @@ public function editPage(Request $request, Response $response, array $args): Res
             }
         }
 
+        // An image uploaded by an older version may sit outside the web root.
+        \App\Support\CmsImageStorage::ensurePublic($page['image'] ?? null);
+
         // Passa i dati alla view
         $pageData = $page;
         $title = sprintf(__('Modifica %s'), $page['title']);
@@ -131,26 +128,57 @@ public function updatePage(Request $request, Response $response, array $args): R
         $metaDescription = $data['meta_description'] ?? '';
         $isActive = isset($data['is_active']) ? 1 : 0;
 
-        // Aggiorna la pagina (slug + locale)
+        // The row the editor showed: the same lookup as editPage(), so a page
+        // stored under another slug of the same page is the one updated.
+        $page = $this->findPageRow($slug, $currentLocale);
+        if ($page === null) {
+            return $response
+                ->withHeader('Location', url('/admin/cms/' . $slug . '?error=db'))
+                ->withStatus(302);
+        }
+        $pageRowId = (int) $page['id'];
+
         $stmt = $this->db->prepare("
             UPDATE cms_pages
             SET title = ?, content = ?, image = ?, meta_description = ?, is_active = ?, updated_at = NOW()
-            WHERE slug = ? AND locale = ?
+            WHERE id = ?
         ");
-        $stmt->bind_param('ssssiss', $title, $content, $image, $metaDescription, $isActive, $slug, $currentLocale);
+        $stmt->bind_param('ssssii', $title, $content, $image, $metaDescription, $isActive, $pageRowId);
 
-        if ($stmt->execute()) {
-            $stmt->close();
-            return $response
-                ->withHeader('Location', '/admin/cms/' . $slug . '?saved=1')
-                ->withStatus(302);
-        } else {
-            $error = $this->db->error;
-            $stmt->close();
-            return $response
-                ->withHeader('Location', '/admin/cms/' . $slug . '?error=db')
-                ->withStatus(302);
-        }
+        $ok = $stmt->execute();
+        $stmt->close();
+        // Back to the editor under the locale's own slug (no extra 301 hop).
+        return $response
+            ->withHeader('Location', url('/admin/cms/' . CmsHelper::getLocalizedSlug($slug, $currentLocale) . ($ok ? '?saved=1' : '?error=db')))
+            ->withStatus(302);
+    }
+
+    /**
+     * The cms_pages row for a slug in a locale: the exact slug first, then any
+     * other slug of the same page (CmsHelper's map), as the public page does.
+     *
+     * @return array<string, mixed>|null
+     */
+    private function findPageRow(string $slug, string $locale): ?array
+    {
+        $pageId = CmsHelper::getPageIdFromSlug($slug);
+        $variants = $pageId !== null ? CmsHelper::getSlugsForPage($pageId) : [];
+        $slugs = array_values(array_unique(array_merge([$slug], $variants)));
+        $placeholders = implode(',', array_fill(0, count($slugs), '?'));
+        $stmt = $this->db->prepare("
+            SELECT id, slug, locale, title, content, image, meta_description, is_active
+            FROM cms_pages
+            WHERE slug IN ($placeholders) AND locale = ?
+            ORDER BY slug = ? DESC, id ASC
+            LIMIT 1
+        ");
+        $params = array_merge($slugs, [$locale, $slug]);
+        $stmt->bind_param(str_repeat('s', count($params)), ...$params);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $row = $result instanceof \mysqli_result ? $result->fetch_assoc() : null;
+        $stmt->close();
+        return is_array($row) ? $row : null;
     }
 
     public function uploadImage(Request $request, Response $response): Response
@@ -201,20 +229,22 @@ public function uploadImage(Request $request, Response $response): Response
             return $response->withHeader('Content-Type', 'application/json')->withStatus(400);
         }
 
-        // SECURITY: Store uploads outside web directory to prevent direct access
-        $baseDir = realpath(__DIR__ . '/../../../storage/uploads');
-        if ($baseDir === false) {
-            error_log("Upload base directory not found");
+        // The image is shown on a public page, so it is stored where its URL
+        // (/uploads/cms/<file>) is served from: public/uploads/cms. It used to
+        // be written to storage/uploads/cms, outside the web root, while the
+        // same /uploads/cms URL was saved: every CMS image answered 404.
+        $uploadPath = \App\Support\CmsImageStorage::publicDir();
+        if (!is_dir($uploadPath) && !@mkdir($uploadPath, 0755, true) && !is_dir($uploadPath)) {
+            \App\Support\SecureLogger::error('[CMS] upload directory cannot be created: ' . $uploadPath);
             $payload = json_encode(['error' => __('Errore di configurazione del server.')] );
             $response->getBody()->write($payload);
             return $response->withHeader('Content-Type', 'application/json')->withStatus(500);
         }
-
-        $uploadPath = $baseDir . '/cms';
-
-        // Crea directory se non esiste
-        if (!is_dir($uploadPath)) {
-            mkdir($uploadPath, 0755, true);
+        $baseDir = realpath($uploadPath);
+        if ($baseDir === false) {
+            $payload = json_encode(['error' => __('Errore di configurazione del server.')] );
+            $response->getBody()->write($payload);
+            return $response->withHeader('Content-Type', 'application/json')->withStatus(500);
         }
 
         // SECURITY: Generate cryptographically secure random filename

app/Controllers/AuthController.php

@@ -200,7 +200,10 @@ public function login(Request $request, Response $response, mysqli $db): Respons
                 } elseif (in_array($row['tipo_utente'], ['admin', 'staff'], true)) {
                     $redirectUrl = '/admin/dashboard';
                 } else {
-                    $redirectUrl = '/user/dashboard';
+                    // The dashboard in the reader's language, set just above from their
+                    // profile (/utente/bacheca for an Italian reader), not the English
+                    // path, which also answers but is not canonical there.
+                    $redirectUrl = RouteTranslator::route('user_dashboard');
                 }
 
                 return $response->withHeader('Location', $redirectUrl)->withStatus(302);

app/Controllers/AutoriController.php

@@ -129,7 +129,7 @@ public function store(Request $request, Response $response, mysqli $db): Respons
         $collegamenti = $this->buildCollegamentiJson($data);
 
         try {
-            $repo->create([
+            $newAuthorId = $repo->create([
                 'nome' => trim($data['nome'] ?? ''),
                 'pseudonimo' => trim($data['pseudonimo'] ?? ''),
                 'data_nascita' => $data['data_nascita'] ?? null,
@@ -154,6 +154,14 @@ public function store(Request $request, Response $response, mysqli $db): Respons
         if ($photo['deleteOnSuccess'] !== null) {
             $this->deleteLocalPhoto($photo['deleteOnSuccess']);
         }
+        // Plugins that add fields to the create form (author.create.fields)
+        // store them now that the row exists. A plugin failure never undoes
+        // the author the librarian just created.
+        try {
+            \App\Support\Hooks::do('author.created', [$newAuthorId, $data]);
+        } catch (\Throwable $e) {
+            \App\Support\SecureLogger::error('author.created listener failed: ' . $e->getMessage());
+        }
         return $response->withHeader('Location', url('/admin/authors'))->withStatus(302);
     }