|
@@ -10,7 +10,7 @@ Read this when changing MySQL connections, mappers, transactions, or persistence
|
|
|
| `src/Core/System/User.php` | `users` mapper, role serialization, password hash generation |
|
|
| `src/Core/System/User.php` | `users` mapper, role serialization, password hash generation |
|
|
|
| `src/Core/System/Notifications.php` | `notifications` mapper and table-wide clear operation |
|
|
| `src/Core/System/Notifications.php` | `notifications` mapper and table-wide clear operation |
|
|
|
| `src/Core/Api/UserController.php` | Account CRUD, row locks, transactions, duplicate detection |
|
|
| `src/Core/Api/UserController.php` | Account CRUD, row locks, transactions, duplicate detection |
|
|
|
-| `phpengine.sql` | Schema, unique index, and sample data |
|
|
|
|
|
|
|
+| `phengine.sql` | Schema, unique index, and sample data |
|
|
|
|
|
|
|
|
## Flow
|
|
## Flow
|
|
|
1. F3 globals provide DSN and database credentials to `System`.
|
|
1. F3 globals provide DSN and database credentials to `System`.
|
|
@@ -24,7 +24,7 @@ Read this when changing MySQL connections, mappers, transactions, or persistence
|
|
|
|---|---|---|
|
|
|---|---|---|
|
|
|
| Connection secrets | Values originate in runtime configuration, not request input | `cfg/config.bin` loaded by `index.php` |
|
|
| Connection secrets | Values originate in runtime configuration, not request input | `cfg/config.bin` loaded by `index.php` |
|
|
|
| Request values in queries | Mapper predicates use placeholders for username/ID lookups | `User`, `AuthController`, `UserController` |
|
|
| Request values in queries | Mapper predicates use placeholders for username/ID lookups | `User`, `AuthController`, `UserController` |
|
|
|
-| Duplicate identities | Application precheck plus `uq_users_username` database constraint | `UserController`, `phpengine.sql` |
|
|
|
|
|
|
|
+| Duplicate identities | Application precheck plus `uq_users_username` database constraint | `UserController`, `phengine.sql` |
|
|
|
| Final administrator race | Transaction and `SELECT id FROM users FOR UPDATE` serialize checks and mutations | `UserController` |
|
|
| Final administrator race | Transaction and `SELECT id FROM users FOR UPDATE` serialize checks and mutations | `UserController` |
|
|
|
| Role deserialization | `unserialize(..., ['allowed_classes' => false])` prevents object instantiation | `User::__construct()` |
|
|
| Role deserialization | `unserialize(..., ['allowed_classes' => false])` prevents object instantiation | `User::__construct()` |
|
|
|
| Table-wide notification deletion | Only authenticated, CSRF-protected notification API path reaches `emptyAll()` | `NotificationController::delete()` |
|
|
| Table-wide notification deletion | Only authenticated, CSRF-protected notification API path reaches `emptyAll()` | `NotificationController::delete()` |
|