app/Config/Cache.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Config;
 
+use CodeIgniter\Cache\CacheInterface;
 use CodeIgniter\Cache\Handlers\DummyHandler;
 use CodeIgniter\Cache\Handlers\FileHandler;
 use CodeIgniter\Cache\Handlers\MemcachedHandler;
@@ -35,37 +36,6 @@ class Cache extends BaseConfig
      */
     public string $backupHandler = 'dummy';
 
-    /**
-     * --------------------------------------------------------------------------
-     * Cache Directory Path
-     * --------------------------------------------------------------------------
-     *
-     * The path to where cache files should be stored, if using a file-based
-     * system.
-     *
-     * @deprecated Use the driver-specific variant under $file
-     */
-    public string $storePath = WRITEPATH . 'cache/';
-
-    /**
-     * --------------------------------------------------------------------------
-     * Cache Include Query String
-     * --------------------------------------------------------------------------
-     *
-     * Whether to take the URL query string into consideration when generating
-     * output cache files. Valid options are:
-     *
-     *    false      = Disabled
-     *    true       = Enabled, take all query parameters into account.
-     *                 Please be aware that this may result in numerous cache
-     *                 files generated for the same page over and over again.
-     *    array('q') = Enabled, but only take into account the specified list
-     *                 of query parameters.
-     *
-     * @var boolean|string[]
-     */
-    public bool | array $cacheQueryString = false;
-
     /**
      * --------------------------------------------------------------------------
      * Key Prefix
@@ -89,10 +59,24 @@ class Cache extends BaseConfig
      */
     public int $ttl = 60;
 
+    /**
+     * --------------------------------------------------------------------------
+     * Reserved Characters
+     * --------------------------------------------------------------------------
+     *
+     * A string of reserved characters that will not be allowed in keys or tags.
+     * Strings that violate this restriction will cause handlers to throw.
+     * Default: {}()/\@:
+     *
+     * Note: The default set is required for PSR-6 compliance.
+     */
+    public string $reservedCharacters = '{}()/\@:';
+
     /**
      * --------------------------------------------------------------------------
      * File settings
      * --------------------------------------------------------------------------
+     *
      * Your file storage preferences can be specified below, if you are using
      * the File driver.
      *
@@ -100,25 +84,26 @@ class Cache extends BaseConfig
      */
     public array $file = [
         'storePath' => WRITEPATH . 'cache/',
-        'mode' => 0640,
+        'mode'      => 0640,
     ];
 
     /**
      * -------------------------------------------------------------------------
      * Memcached settings
      * -------------------------------------------------------------------------
+     *
      * Your Memcached servers can be specified below, if you are using
      * the Memcached drivers.
      *
      * @see https://codeigniter.com/user_guide/libraries/caching.html#memcached
      *
-     * @var array<string, string|int|boolean>
+     * @var array<string, string|int|bool>
      */
     public array $memcached = [
-        'host' => '127.0.0.1',
-        'port' => 11211,
+        'host'   => '127.0.0.1',
+        'port'   => 11211,
         'weight' => 1,
-        'raw' => false,
+        'raw'    => false,
     ];
 
     /**
@@ -131,10 +116,10 @@ class Cache extends BaseConfig
      * @var array<string, string|int|null>
      */
     public array $redis = [
-        'host' => '127.0.0.1',
+        'host'     => '127.0.0.1',
         'password' => null,
-        'port' => 6379,
-        'timeout' => 0,
+        'port'     => 6379,
+        'timeout'  => 0,
         'database' => 0,
     ];
 
@@ -146,14 +131,33 @@ class Cache extends BaseConfig
      * This is an array of cache engine alias' and class names. Only engines
      * that are listed here are allowed to be used.
      *
-     * @var array<string, string>
+     * @var array<string, class-string<CacheInterface>>
      */
     public array $validHandlers = [
-        'dummy' => DummyHandler::class,
-        'file' => FileHandler::class,
+        'dummy'     => DummyHandler::class,
+        'file'      => FileHandler::class,
         'memcached' => MemcachedHandler::class,
-        'predis' => PredisHandler::class,
-        'redis' => RedisHandler::class,
-        'wincache' => WincacheHandler::class,
+        'predis'    => PredisHandler::class,
+        'redis'     => RedisHandler::class,
+        'wincache'  => WincacheHandler::class,
     ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Web Page Caching: Cache Include Query String
+     * --------------------------------------------------------------------------
+     *
+     * Whether to take the URL query string into consideration when generating
+     * output cache files. Valid options are:
+     *
+     *    false = Disabled
+     *    true  = Enabled, take all query parameters into account.
+     *            Please be aware that this may result in numerous cache
+     *            files generated for the same page over and over again.
+     *    ['q'] = Enabled, but only take into account the specified list
+     *            of query parameters.
+     *
+     * @var bool|list<string>
+     */
+    public $cacheQueryString = false;
 }

app/Config/Colors.php

+<?php
+
+declare(strict_types=1);
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Colors extends BaseConfig
+{
+    /**
+     * @var array<string, array<string, mixed>>
+     */
+    public array $themes = [
+        /* Castopod's brand color */
+        'pine' => [
+            'accent-base'     => [174, 100, 29],
+            'accent-hover'    => [172, 100, 17],
+            'accent-muted'    => [131, 100, 12],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [172, 100, 17],
+            'heading-background' => [111, 64, 94],
+
+            'background-elevated'   => [0, 0, 100],
+            'background-base'       => [173, 44, 96],
+            'background-navigation' => [172, 100, 17],
+            'background-header'     => [172, 100, 17],
+            'background-highlight'  => [111, 64, 94],
+            'background-backdrop'   => [0, 0, 50],
+
+            'border-subtle'     => [111, 42, 86],
+            'border-contrast'   => [0, 0, 0],
+            'border-navigation' => [131, 100, 12],
+
+            'text-base'  => [158, 8, 3],
+            'text-muted' => [172, 8, 38],
+        ],
+        /* Red / Rose color */
+        'crimson' => [
+            'accent-base'     => [350, 87, 61],
+            'accent-hover'    => [348, 75, 40],
+            'accent-muted'    => [348, 73, 32],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [348, 73, 32],
+            'heading-background' => [344, 79, 96],
+
+            'background-elevated'  => [0, 0, 100],
+            'background-base'      => [350, 44, 96],
+            'background-header'    => [348, 75, 40],
+            'background-highlight' => [344, 79, 96],
+            'background-backdrop'  => [0, 0, 50],
+
+            'border-subtle'   => [348, 42, 86],
+            'border-contrast' => [0, 0, 0],
+
+            'text-base'  => [340, 8, 3],
+            'text-muted' => [345, 8, 38],
+        ],
+        /* Blue color */
+        'lake' => [
+            'accent-base'     => [194, 100, 44],
+            'accent-hover'    => [194, 100, 22],
+            'accent-muted'    => [195, 100, 11],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [194, 100, 22],
+            'heading-background' => [195, 100, 92],
+
+            'background-elevated'  => [0, 0, 100],
+            'background-base'      => [196, 44, 96],
+            'background-header'    => [194, 100, 22],
+            'background-highlight' => [195, 100, 92],
+            'background-backdrop'  => [0, 0, 50],
+
+            'border-subtle'   => [195, 42, 86],
+            'border-contrast' => [0, 0, 0],
+
+            'text-base'  => [194, 8, 3],
+            'text-muted' => [195, 8, 38],
+        ],
+        /* Orange color */
+        'amber' => [
+            'accent-base'     => [17, 100, 57],
+            'accent-hover'    => [17, 100, 35],
+            'accent-muted'    => [17, 100, 24],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [17, 100, 35],
+            'heading-background' => [17, 100, 89],
+
+            'background-elevated'  => [0, 0, 100],
+            'background-base'      => [15, 44, 96],
+            'background-header'    => [17, 100, 35],
+            'background-highlight' => [17, 100, 89],
+            'background-backdrop'  => [0, 0, 50],
+
+            'border-subtle'   => [17, 42, 86],
+            'border-contrast' => [0, 0, 0],
+
+            'text-base'  => [15, 8, 3],
+            'text-muted' => [17, 8, 38],
+        ],
+        /* Violet color */
+        'jacaranda' => [
+            'accent-base'     => [254, 72, 52],
+            'accent-hover'    => [254, 73, 30],
+            'accent-muted'    => [254, 71, 19],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [254, 73, 30],
+            'heading-background' => [254, 73, 84],
+
+            'background-elevated'  => [0, 0, 100],
+            'background-base'      => [253, 44, 96],
+            'background-header'    => [254, 73, 30],
+            'background-highlight' => [254, 88, 91],
+            'background-backdrop'  => [0, 0, 50],
+
+            'border-subtle'   => [254, 42, 86],
+            'border-contrast' => [0, 0, 0],
+
+            'text-base'  => [253, 8, 3],
+            'text-muted' => [254, 8, 38],
+        ],
+        /* Black color */
+        'onyx' => [
+            'accent-base'     => [240, 17, 2],
+            'accent-hover'    => [240, 17, 17],
+            'accent-muted'    => [240, 17, 17],
+            'accent-contrast' => [0, 0, 100],
+
+            'heading-foreground' => [240, 17, 17],
+            'heading-background' => [240, 17, 94],
+
+            'background-elevated'  => [0, 0, 100],
+            'background-base'      => [240, 17, 96],
+            'background-header'    => [240, 12, 17],
+            'background-highlight' => [240, 17, 94],
+            'background-backdrop'  => [0, 0, 50],
+
+            'border-subtle'   => [240, 17, 86],
+            'border-contrast' => [0, 0, 0],
+
+            'text-base'  => [240, 8, 3],
+            'text-muted' => [240, 8, 38],
+        ],
+    ];
+}

app/Config/Constants.php

@@ -11,7 +11,7 @@ declare(strict_types=1);
  |
  | NOTE: this constant is updated upon release with Continuous Integration.
  */
-defined('CP_VERSION') || define('CP_VERSION', '1.0.0-alpha.80');
+defined('CP_VERSION') || define('CP_VERSION', '2.0.0-next.3');
 
 /*
  | --------------------------------------------------------------------
@@ -24,10 +24,23 @@ defined('CP_VERSION') || define('CP_VERSION', '1.0.0-alpha.80');
  | classes should use.
  |
  | NOTE: changing this will require manually modifying the
- | existing namespaces of App\* namespaced-classes.
+ | existing namespaces of App* namespaced-classes.
  */
 defined('APP_NAMESPACE') || define('APP_NAMESPACE', 'App');
 
+/*
+ | --------------------------------------------------------------------
+ | Plugins Path
+ | --------------------------------------------------------------------
+ |
+ | This defines the folder in which plugins will live.
+ */
+defined('PLUGINS_PATH') ||
+    define('PLUGINS_PATH', ROOTPATH . 'plugins' . DIRECTORY_SEPARATOR);
+
+defined('PLUGINS_KEY_PATTERN') ||
+    define('PLUGINS_KEY_PATTERN', '[a-z0-9]([_.-]?[a-z0-9]+)*\/[a-z0-9]([_.-]?[a-z0-9]+)*');
+
 /*
  | --------------------------------------------------------------------------
  | Composer Path
@@ -52,9 +65,9 @@ defined('MINUTE') || define('MINUTE', 60);
 defined('HOUR') || define('HOUR', 3600);
 defined('DAY') || define('DAY', 86400);
 defined('WEEK') || define('WEEK', 604800);
-defined('MONTH') || define('MONTH', 2592000);
-defined('YEAR') || define('YEAR', 31536000);
-defined('DECADE') || define('DECADE', 315360000);
+defined('MONTH') || define('MONTH', 2_592_000);
+defined('YEAR') || define('YEAR', 31_536_000);
+defined('DECADE') || define('DECADE', 315_360_000);
 
 /*
  | --------------------------------------------------------------------------

app/Config/ContentSecurityPolicy.php

@@ -35,28 +35,28 @@ class ContentSecurityPolicy extends BaseConfig
     /**
      * Will default to self if not overridden
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $defaultSrc = null;
 
     /**
      * Lists allowed scripts' URLs.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $scriptSrc = 'self';
 
     /**
      * Lists allowed stylesheets' URLs.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $styleSrc = 'self';
 
     /**
      * Defines the origins from which images can be loaded.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $imageSrc = 'self';
 
@@ -65,35 +65,35 @@ class ContentSecurityPolicy extends BaseConfig
      *
      * Will default to self if not overridden
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $baseURI = null;
 
     /**
      * Lists the URLs for workers and embedded frame contents
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $childSrc = 'self';
 
     /**
      * Limits the origins that you can connect to (via XHR, WebSockets, and EventSource).
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $connectSrc = 'self';
 
     /**
      * Specifies the origins that can serve web fonts.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $fontSrc;
 
     /**
      * Lists valid endpoints for submission from `<form>` tags.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $formAction = 'self';
 
@@ -102,47 +102,62 @@ class ContentSecurityPolicy extends BaseConfig
      * `<embed>`, and `<applet>` tags. This directive can't be used in `<meta>` tags and applies only to non-HTML
      * resources.
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $frameAncestors = null;
 
     /**
      * The frame-src directive restricts the URLs which may be loaded into nested browsing contexts.
      *
-     * @var string[]|string|null
+     * @var list<string>|string|null
      */
     public string | array | null $frameSrc = null;
 
     /**
      * Restricts the origins allowed to deliver video and audio.
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $mediaSrc = null;
 
     /**
      * Allows control over Flash and other plugins.
      *
-     * @var string|string[]
+     * @var list<string>|string
      */
     public string | array $objectSrc = 'self';
 
     /**
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $manifestSrc = null;
 
     /**
      * Limits the kinds of plugins a page may invoke.
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $pluginTypes = null;
 
     /**
      * List of actions allowed.
      *
-     * @var string|string[]|null
+     * @var list<string>|string|null
      */
     public string | array | null $sandbox = null;
+
+    /**
+     * Nonce tag for style
+     */
+    public string $styleNonceTag = '{csp-style-nonce}';
+
+    /**
+     * Nonce tag for script
+     */
+    public string $scriptNonceTag = '{csp-script-nonce}';
+
+    /**
+     * Replace nonce tag automatically
+     */
+    public bool $autoNonce = true;
 }

app/Config/Cookie.php

@@ -84,6 +84,8 @@ class Cookie extends BaseConfig
      * Defaults to `Lax` for compatibility with modern browsers. Setting `''`
      * (empty string) means default SameSite attribute set by browsers (`Lax`)
      * will be set on cookies. If set to `None`, `$secure` must also be set.
+     *
+     * @phpstan-var 'None'|'Lax'|'Strict'|''
      */
     public string $samesite = 'Lax';
 

app/Config/Cors.php

+<?php
+
+declare(strict_types=1);
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Cross-Origin Resource Sharing (CORS) Configuration
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+ */
+class Cors extends BaseConfig
+{
+    /**
+     * The default CORS configuration.
+     *
+     * @var array{
+     *      allowedOrigins: list<string>,
+     *      allowedOriginsPatterns: list<string>,
+     *      supportsCredentials: bool,
+     *      allowedHeaders: list<string>,
+     *      exposedHeaders: list<string>,
+     *      allowedMethods: list<string>,
+     *      maxAge: int,
+     *  }
+     */
+    public array $default = [
+        /**
+         * Origins for the `Access-Control-Allow-Origin` header.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+         *
+         * E.g.:
+         *   - ['http://localhost:8080']
+         *   - ['https://www.example.com']
+         */
+        'allowedOrigins' => [],
+
+        /**
+         * Origin regex patterns for the `Access-Control-Allow-Origin` header.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+         *
+         * NOTE: A pattern specified here is part of a regular expression. It will
+         *       be actually `#\A<pattern>\z#`.
+         *
+         * E.g.:
+         *   - ['https://\w+\.example\.com']
+         */
+        'allowedOriginsPatterns' => [],
+
+        /**
+         * Weather to send the `Access-Control-Allow-Credentials` header.
+         *
+         * The Access-Control-Allow-Credentials response header tells browsers whether
+         * the server allows cross-origin HTTP requests to include credentials.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+         */
+        'supportsCredentials' => false,
+
+        /**
+         * Set headers to allow.
+         *
+         * The Access-Control-Allow-Headers response header is used in response to
+         * a preflight request which includes the Access-Control-Request-Headers to
+         * indicate which HTTP headers can be used during the actual request.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+         */
+        'allowedHeaders' => [],
+
+        /**
+         * Set headers to expose.
+         *
+         * The Access-Control-Expose-Headers response header allows a server to
+         * indicate which response headers should be made available to scripts running
+         * in the browser, in response to a cross-origin request.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
+         */
+        'exposedHeaders' => [],
+
+        /**
+         * Set methods to allow.
+         *
+         * The Access-Control-Allow-Methods response header specifies one or more
+         * methods allowed when accessing a resource in response to a preflight
+         * request.
+         *
+         * E.g.:
+         *   - ['GET', 'POST', 'PUT', 'DELETE']
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+         */
+        'allowedMethods' => [],
+
+        /**
+         * Set how many seconds the results of a preflight request can be cached.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+         */
+        'maxAge' => 7200,
+    ];
+}

app/Config/Database.php

@@ -24,53 +24,66 @@ class Database extends Config
     /**
      * The default database connection.
      *
-     * @var array<string, string|bool|int|array>
+     * @var array<string, mixed>
      */
     public array $default = [
-        'DSN' => '',
-        'hostname' => 'localhost',
-        'username' => '',
-        'password' => '',
-        'database' => '',
-        'DBDriver' => 'MySQLi',
-        'DBPrefix' => 'cp_',
-        'pConnect' => false,
-        'DBDebug' => ENVIRONMENT !== 'production',
-        'charset' => 'utf8mb4',
-        'DBCollat' => 'utf8mb4_unicode_ci',
-        'swapPre' => '',
-        'encrypt' => false,
-        'compress' => false,
-        'strictOn' => false,
-        'failover' => [],
-        'port' => 3306,
+        'DSN'          => '',
+        'hostname'     => 'localhost',
+        'username'     => '',
+        'password'     => '',
+        'database'     => '',
+        'DBDriver'     => 'MySQLi',
+        'DBPrefix'     => 'cp_',
+        'pConnect'     => false,
+        'DBDebug'      => true,
+        'charset'      => 'utf8mb4',
+        'DBCollat'     => 'utf8mb4_unicode_ci',
+        'swapPre'      => '',
+        'encrypt'      => false,
+        'compress'     => false,
+        'strictOn'     => false,
+        'failover'     => [],
+        'port'         => 3306,
+        'numberNative' => false,
+        'foundRows'    => false,
+        'dateFormat'   => [
+            'date'     => 'Y-m-d',
+            'datetime' => 'Y-m-d H:i:s',
+            'time'     => 'H:i:s',
+        ],
     ];
 
     /**
      * This database connection is used when running PHPUnit database tests.
      *
-     * @noRector StringClassNameToClassConstantRector
-     *
-     * @var array<string, string|bool|int|array>
+     * @var array<string, mixed>
      */
     public array $tests = [
-        'DSN' => '',
+        'DSN'      => '',
         'hostname' => '127.0.0.1',
         'username' => '',
         'password' => '',
         'database' => ':memory:',
         'DBDriver' => 'SQLite3',
         'DBPrefix' => 'db_',
-        'pConnect' => false,
-        'DBDebug' => ENVIRONMENT !== 'production',
-        'charset' => 'utf8',
-        'DBCollat' => 'utf8_general_ci',
-        'swapPre' => '',
-        'encrypt' => false,
-        'compress' => false,
-        'strictOn' => false,
-        'failover' => [],
-        'port' => 3306,
+        // Needed to ensure we're working correctly with prefixes live. DO NOT REMOVE FOR CI DEVS
+        'pConnect'    => false,
+        'DBDebug'     => true,
+        'charset'     => 'utf8',
+        'DBCollat'    => '',
+        'swapPre'     => '',
+        'encrypt'     => false,
+        'compress'    => false,
+        'strictOn'    => false,
+        'failover'    => [],
+        'port'        => 3306,
+        'foreignKeys' => true,
+        'busyTimeout' => 1000,
+        'dateFormat'  => [
+            'date'     => 'Y-m-d',
+            'datetime' => 'Y-m-d H:i:s',
+            'time'     => 'H:i:s',
+        ],
     ];
 
     //--------------------------------------------------------------------

app/Config/DocTypes.php

@@ -4,6 +4,9 @@ declare(strict_types=1);
 
 namespace Config;
 
+/**
+ * @immutable
+ */
 class DocTypes
 {
     /**
@@ -12,42 +15,34 @@ class DocTypes
      * @var array<string, string>
      */
     public array $list = [
-        'xhtml11' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">',
-        'xhtml1-strict' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">',
-        'xhtml1-trans' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">',
-        'xhtml1-frame' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">',
-        'xhtml-basic11' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.1//EN" "http://www.w3.org/TR/xhtml-basic/xhtml-basic11.dtd">',
-        'html5' => '<!DOCTYPE html>',
-        'html4-strict' =>
-            '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">',
-        'html4-trans' =>
-            '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">',
-        'html4-frame' =>
-            '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">',
-        'mathml1' =>
-            '<!DOCTYPE math SYSTEM "http://www.w3.org/Math/DTD/mathml1/mathml.dtd">',
-        'mathml2' =>
-            '<!DOCTYPE math PUBLIC "-//W3C//DTD MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/mathml2.dtd">',
-        'svg10' =>
-            '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">',
-        'svg11' =>
-            '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">',
-        'svg11-basic' =>
-            '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Basic//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd">',
-        'svg11-tiny' =>
-            '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">',
-        'xhtml-math-svg-xh' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
-        'xhtml-math-svg-sh' =>
-            '<!DOCTYPE svg:svg PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
-        'xhtml-rdfa-1' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">',
-        'xhtml-rdfa-2' =>
-            '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.1//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-2.dtd">',
+        'xhtml11'           => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">',
+        'xhtml1-strict'     => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">',
+        'xhtml1-trans'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">',
+        'xhtml1-frame'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">',
+        'xhtml-basic11'     => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.1//EN" "http://www.w3.org/TR/xhtml-basic/xhtml-basic11.dtd">',
+        'html5'             => '<!DOCTYPE html>',
+        'html4-strict'      => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">',
+        'html4-trans'       => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">',
+        'html4-frame'       => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">',
+        'mathml1'           => '<!DOCTYPE math SYSTEM "http://www.w3.org/Math/DTD/mathml1/mathml.dtd">',
+        'mathml2'           => '<!DOCTYPE math PUBLIC "-//W3C//DTD MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/mathml2.dtd">',
+        'svg10'             => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">',
+        'svg11'             => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">',
+        'svg11-basic'       => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Basic//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd">',
+        'svg11-tiny'        => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">',
+        'xhtml-math-svg-xh' => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
+        'xhtml-math-svg-sh' => '<!DOCTYPE svg:svg PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
+        'xhtml-rdfa-1'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">',
+        'xhtml-rdfa-2'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.1//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-2.dtd">',
     ];
+
+    /**
+     * Whether to remove the solidus (`/`) character for void HTML elements (e.g. `<input>`)
+     * for HTML5 compatibility.
+     *
+     * Set to:
+     *    `true` - to be HTML5 compatible
+     *    `false` - to be XHTML compatible
+     */
+    public bool $html5 = true;
 }

app/Config/Email.php

@@ -8,21 +8,21 @@ use CodeIgniter\Config\BaseConfig;
 
 class Email extends BaseConfig
 {
-    public string $fromEmail;
+    public string $fromEmail = '';
 
-    public string $fromName;
+    public string $fromName = 'Castopod';
 
-    public string $recipients;
+    public string $recipients = '';
 
     /**
      * The "user agent"
      */
-    public string $userAgent = 'CodeIgniter';
+    public string $userAgent = 'Castopod/' . CP_VERSION;
 
     /**
      * The mail sending protocol: mail, sendmail, smtp
      */
-    public string $protocol = 'mail';
+    public string $protocol = 'smtp';
 
     /**
      * The server path to Sendmail.
@@ -30,19 +30,19 @@ class Email extends BaseConfig
     public string $mailPath = '/usr/sbin/sendmail';
 
     /**
-     * SMTP Server Address
+     * SMTP Server Hostname
      */
-    public string $SMTPHost;
+    public string $SMTPHost = '';
 
     /**
      * SMTP Username
      */
-    public string $SMTPUser;
+    public string $SMTPUser = '';
 
     /**
      * SMTP Password
      */
-    public string $SMTPPass;
+    public string $SMTPPass = '';
 
     /**
      * SMTP Port
@@ -60,7 +60,11 @@ class Email extends BaseConfig
     public bool $SMTPKeepAlive = false;
 
     /**
-     * SMTP Encryption. Either tls or ssl
+     * SMTP Encryption.
+     *
+     * @var string '', 'tls' or 'ssl'. 'tls' will issue a STARTTLS command
+     *             to the server. 'ssl' means implicit SSL. Connection on port
+     *             465 should set this to ''.
      */
     public string $SMTPCrypto = 'tls';
 
@@ -77,7 +81,7 @@ class Email extends BaseConfig
     /**
      * Type of mail, either 'text' or 'html'
      */
-    public string $mailType = 'text';
+    public string $mailType = 'html';
 
     /**
      * Character set (utf-8, iso-8859-1, etc.)
@@ -118,4 +122,11 @@ class Email extends BaseConfig
      * Enable notify message from server
      */
     public bool $DSN = false;
+
+    public function __construct()
+    {
+        parent::__construct();
+
+        $this->userAgent = 'Castopod/' . CP_VERSION . '; +' . base_url('', 'https');
+    }
 }

app/Config/Embed.php

+<?php
+
+declare(strict_types=1);
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Embed extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Embeddable player config
+     * --------------------------------------------------------------------------
+     */
+    public int $width = 485;
+
+    public int $height = 112;
+}

app/Config/Encryption.php

@@ -58,4 +58,37 @@ class Encryption extends BaseConfig
      * HMAC digest to use, e.g. 'SHA512' or 'SHA256'. Default value is 'SHA512'.
      */
     public string $digest = 'SHA512';
+
+    /**
+     * Whether the cipher-text should be raw. If set to false, then it will be base64 encoded.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to false for CI3 Encryption compatibility.
+     */
+    public bool $rawData = true;
+
+    /**
+     * Encryption key info.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'encryption' for CI3 Encryption compatibility.
+     */
+    public string $encryptKeyInfo = '';
+
+    /**
+     * Authentication key info.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'authentication' for CI3 Encryption compatibility.
+     */
+    public string $authKeyInfo = '';
+
+    /**
+     * Cipher to use.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'AES-128-CBC' to decrypt encrypted data that encrypted
+     * by CI3 Encryption default configuration.
+     */
+    public string $cipher = 'AES-256-CTR';
 }

app/Config/Events.php

@@ -6,9 +6,11 @@ namespace Config;
 
 use App\Entities\Actor;
 use App\Entities\Post;
+use App\Models\EpisodeModel;
+use CodeIgniter\Debug\Toolbar\Collectors\Database;
 use CodeIgniter\Events\Events;
 use CodeIgniter\Exceptions\FrameworkException;
-use Modules\Auth\Entities\User;
+use CodeIgniter\HotReloader\HotReloader;
 
 /*
  * --------------------------------------------------------------------
@@ -27,8 +29,7 @@ use Modules\Auth\Entities\User;
  *      Events::on('create', [$myInstance, 'myMethod']);
  */
 
-Events::on('pre_system', function () {
-    // @phpstan-ignore-next-line
+Events::on('pre_system', static function (): void {
     if (ENVIRONMENT !== 'testing') {
         if (ini_get('zlib.output_compression')) {
             throw FrameworkException::forEnabledZlibOutputCompression();
@@ -38,9 +39,7 @@ Events::on('pre_system', function () {
             ob_end_flush();
         }
 
-        ob_start(function ($buffer) {
-            return $buffer;
-        });
+        ob_start(static fn ($buffer) => $buffer);
     }
 
     /*
@@ -48,32 +47,21 @@ Events::on('pre_system', function () {
      * Debug Toolbar Listeners.
      * --------------------------------------------------------------------
      * If you delete, they will no longer be collected.
-     *
-     * @phpstan-ignore-next-line
      */
     if (CI_DEBUG && ! is_cli()) {
-        Events::on('DBQuery', 'CodeIgniter\Debug\Toolbar\Collectors\Database::collect');
-        Services::toolbar()->respond();
-    }
-});
-
-Events::on('login', function (User $user): void {
-    helper('auth');
-
-    // set interact_as_actor_id value
-    $userPodcasts = $user->podcasts;
-    if ($userPodcasts = $user->podcasts) {
-        set_interact_as_actor($userPodcasts[0]->actor_id);
+        Events::on('DBQuery', Database::class . '::collect');
+        service('toolbar')
+            ->respond();
+
+        // Hot Reload route - for framework use on the hot reloader.
+        if (ENVIRONMENT === 'development') {
+            service('routes')->get('__hot-reload', static function (): void {
+                (new HotReloader())->run();
+            });
+        }
     }
 });
 
-Events::on('logout', function (User $user): void {
-    helper('auth');
-
-    // remove user's interact_as_actor session
-    remove_interact_as_actor();
-});
-
 /*
  * --------------------------------------------------------------------
  * Fediverse events
@@ -83,7 +71,7 @@ Events::on('logout', function (User $user): void {
  * @param Actor $actor
  * @param Actor $targetActor
  */
-Events::on('on_follow', function ($actor, $targetActor): void {
+Events::on('on_follow', static function ($actor, $targetActor): void {
     if ($actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$actor->podcast->id}*");
@@ -103,7 +91,7 @@ Events::on('on_follow', function ($actor, $targetActor): void {
  * @param Actor $actor
  * @param Actor $targetActor
  */
-Events::on('on_undo_follow', function ($actor, $targetActor): void {
+Events::on('on_undo_follow', static function ($actor, $targetActor): void {
     if ($actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$actor->podcast->id}*");
@@ -122,25 +110,10 @@ Events::on('on_undo_follow', function ($actor, $targetActor): void {
 /**
  * @param Post $post
  */
-Events::on('on_post_add', function ($post): void {
-    $isReply = $post->in_reply_to_id !== null;
-
-    if ($isReply) {
-        $post = $post->reply_to_post;
-    }
-
-    if ($post->episode_id !== null) {
-        if ($isReply) {
-            model('EpisodeModel', false)
-                ->where('id', $post->episode_id)
-                ->increment('comments_count');
-        } else {
-            model('EpisodeModel', false)
-                ->where('id', $post->episode_id)
-                ->increment('posts_count');
-        }
-    }
-
+Events::on('on_post_add', static function ($post): void {
+    model(EpisodeModel::class, false)->builder()
+        ->where('id', $post->episode_id)
+        ->increment('posts_count');
     if ($post->actor->is_podcast) {
         // Removing all of the podcast pages is a bit overkill, but works to avoid caching bugs
         // same for other events below
@@ -154,13 +127,9 @@ Events::on('on_post_add', function ($post): void {
 /**
  * @param Post $post
  */
-Events::on('on_post_remove', function ($post): void {
-    if ($post->in_reply_to_id !== null) {
-        Events::trigger('on_post_remove', $post->reply_to_post);
-    }
-
+Events::on('on_post_remove', static function ($post): void {
     if ($episodeId = $post->episode_id) {
-        model('EpisodeModel', false)
+        model(EpisodeModel::class, false)->builder()
             ->where('id', $episodeId)
             ->decrement('posts_count');
     }
@@ -180,7 +149,7 @@ Events::on('on_post_remove', function ($post): void {
  * @param Actor $actor
  * @param Post $post
  */
-Events::on('on_post_reblog', function ($actor, $post): void {
+Events::on('on_post_reblog', static function ($actor, $post): void {
     if ($post->actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$post->actor->podcast->id}*");
@@ -196,7 +165,6 @@ Events::on('on_post_reblog', function ($actor, $post): void {
 
     cache()
         ->deleteMatching("page_post#{$post->id}*");
-
     if ($post->in_reply_to_id !== null) {
         cache()->deleteMatching("page_post#{$post->in_reply_to_id}");
     }
@@ -205,9 +173,8 @@ Events::on('on_post_reblog', function ($actor, $post): void {
 /**
  * @param Post $reblogPost
  */
-Events::on('on_post_undo_reblog', function ($reblogPost): void {
+Events::on('on_post_undo_reblog', static function ($reblogPost): void {
     $post = $reblogPost->reblog_of_post;
-
     if ($post->actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$post->actor->podcast->id}*");
@@ -219,7 +186,6 @@ Events::on('on_post_undo_reblog', function ($reblogPost): void {
         ->deleteMatching("page_post#{$post->id}*");
     cache()
         ->deleteMatching("page_post#{$reblogPost->id}*");
-
     if ($post->in_reply_to_id !== null) {
         cache()->deleteMatching("page_post#{$post->in_reply_to_id}");
     }
@@ -235,10 +201,17 @@ Events::on('on_post_undo_reblog', function ($reblogPost): void {
 /**
  * @param Post $reply
  */
-Events::on('on_post_reply', function ($reply): void {
+Events::on('on_post_reply', static function ($reply): void {
     $post = $reply->reply_to_post;
+    if ($post->in_reply_to_id === null) {
+        model(EpisodeModel::class, false)->builder()
+            ->where('id', $post->episode_id)
+            ->increment('comments_count');
+    }
 
     if ($post->actor->is_podcast) {
+        cache()
+            ->deleteMatching("podcast-{$post->actor->podcast->handle}*");
         cache()
             ->deleteMatching("podcast#{$post->actor->podcast->id}*");
         cache()
@@ -252,10 +225,17 @@ Events::on('on_post_reply', function ($reply): void {
 /**
  * @param Post $reply
  */
-Events::on('on_reply_remove', function ($reply): void {
+Events::on('on_reply_remove', static function ($reply): void {
     $post = $reply->reply_to_post;
+    if ($post->in_reply_to_id === null) {
+        model(EpisodeModel::class, false)->builder()
+            ->where('id', $post->episode_id)
+            ->decrement('comments_count');
+    }
 
     if ($post->actor->is_podcast) {
+        cache()
+            ->deleteMatching("podcast-{$post->actor->podcast->handle}*");
         cache()
             ->deleteMatching("page_podcast#{$post->actor->podcast->id}*");
         cache()
@@ -272,7 +252,7 @@ Events::on('on_reply_remove', function ($reply): void {
  * @param Actor $actor
  * @param Post $post
  */
-Events::on('on_post_favourite', function ($actor, $post): void {
+Events::on('on_post_favourite', static function ($actor, $post): void {
     if ($post->actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$post->actor->podcast->id}*");
@@ -282,7 +262,6 @@ Events::on('on_post_favourite', function ($actor, $post): void {
 
     cache()
         ->deleteMatching("page_post#{$post->id}*");
-
     if ($post->in_reply_to_id !== null) {
         cache()->deleteMatching("page_post#{$post->in_reply_to_id}*");
     }
@@ -298,7 +277,7 @@ Events::on('on_post_favourite', function ($actor, $post): void {
  * @param Actor $actor
  * @param Post $post
  */
-Events::on('on_post_undo_favourite', function ($actor, $post): void {
+Events::on('on_post_undo_favourite', static function ($actor, $post): void {
     if ($post->actor->is_podcast) {
         cache()
             ->deleteMatching("podcast#{$post->actor->podcast->id}*");
@@ -308,7 +287,6 @@ Events::on('on_post_undo_favourite', function ($actor, $post): void {
 
     cache()
         ->deleteMatching("page_post#{$post->id}*");
-
     if ($post->in_reply_to_id !== null) {
         cache()->deleteMatching("page_post#{$post->in_reply_to_id}*");
     }
@@ -320,7 +298,7 @@ Events::on('on_post_undo_favourite', function ($actor, $post): void {
     }
 });
 
-Events::on('on_block_actor', function (int $actorId): void {
+Events::on('on_block_actor', static function (int $actorId): void {
     cache()->deleteMatching('page_podcast*');
     cache()
         ->deleteMatching('podcast*');
@@ -328,7 +306,7 @@ Events::on('on_block_actor', function (int $actorId): void {
         ->deleteMatching('page_post*');
 });
 
-Events::on('on_unblock_actor', function (int $actorId): void {
+Events::on('on_unblock_actor', static function (int $actorId): void {
     cache()->deleteMatching('page_podcast*');
     cache()
         ->deleteMatching('podcast*');
@@ -336,7 +314,7 @@ Events::on('on_unblock_actor', function (int $actorId): void {
         ->deleteMatching('page_post*');
 });
 
-Events::on('on_block_domain', function (string $domainName): void {
+Events::on('on_block_domain', static function (string $domainName): void {
     cache()->deleteMatching('page_podcast*');
     cache()
         ->deleteMatching('podcast*');
@@ -344,7 +322,7 @@ Events::on('on_block_domain', function (string $domainName): void {
         ->deleteMatching('page_post*');
 });
 
-Events::on('on_unblock_domain', function (string $domainName): void {
+Events::on('on_unblock_domain', static function (string $domainName): void {
     cache()->deleteMatching('page_podcast*');
     cache()
         ->deleteMatching('podcast*');

app/Config/Exceptions.php

@@ -5,6 +5,10 @@ declare(strict_types=1);
 namespace Config;
 
 use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Debug\ExceptionHandler;
+use CodeIgniter\Debug\ExceptionHandlerInterface;
+use Psr\Log\LogLevel;
+use Throwable;
 
 /**
  * Setup how the exception handler works.
@@ -29,7 +33,7 @@ class Exceptions extends BaseConfig
      * Any status codes here will NOT be logged if logging is turned on.
      * By default, only 404 (Page Not Found) exceptions are ignored.
      *
-     * @var int[]
+     * @var list<int>
      */
     public array $ignoreCodes = [404];
 
@@ -52,7 +56,53 @@ class Exceptions extends BaseConfig
      * In order to specify 2 levels, use "/" to separate.
      * ex. ['server', 'setup/password', 'secret_token']
      *
-     * @var string[]
+     * @var list<string>
      */
     public array $sensitiveDataInTrace = [];
+
+    /**
+     * --------------------------------------------------------------------------
+     * WHETHER TO THROW AN EXCEPTION ON DEPRECATED ERRORS
+     * --------------------------------------------------------------------------
+     * If set to `true`, DEPRECATED errors are only logged and no exceptions are
+     * thrown. This option also works for user deprecations.
+     */
+    public bool $logDeprecations = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * LOG LEVEL THRESHOLD FOR DEPRECATIONS
+     * --------------------------------------------------------------------------
+     * If `$logDeprecations` is set to `true`, this sets the log level
+     * to which the deprecation will be logged. This should be one of the log
+     * levels recognized by PSR-3.
+     *
+     * The related `Config\Logger::$threshold` should be adjusted, if needed,
+     * to capture logging the deprecations.
+     */
+    public string $deprecationLogLevel = LogLevel::WARNING;
+
+    /*
+     * DEFINE THE HANDLERS USED
+     * --------------------------------------------------------------------------
+     * Given the HTTP status code, returns exception handler that
+     * should be used to deal with this error. By default, it will run CodeIgniter's
+     * default handler and display the error information in the expected format
+     * for CLI, HTTP, or AJAX requests, as determined by is_cli() and the expected
+     * response format.
+     *
+     * Custom handlers can be returned if you want to handle one or more specific
+     * error codes yourself like:
+     *
+     *      if (in_array($statusCode, [400, 404, 500])) {
+     *          return new \App\Libraries\MyExceptionHandler();
+     *      }
+     *      if ($exception instanceOf PageNotFoundException) {
+     *          return new \App\Libraries\MyExceptionHandler();
+     *      }
+     */
+    public function handler(int $statusCode, Throwable $exception): ExceptionHandlerInterface
+    {
+        return new ExceptionHandler($this);
+    }
 }

app/Config/Feature.php

+<?php
+
+declare(strict_types=1);
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Enable/disable backward compatibility breaking features.
+ */
+class Feature extends BaseConfig
+{
+    /**
+     * Use improved new auto routing instead of the legacy version.
+     */
+    public bool $autoRoutesImproved = true;
+
+    /**
+     * Use filter execution order in 4.4 or before.
+     */
+    public bool $oldFilterOrder = false;
+
+    /**
+     * The behavior of `limit(0)` in Query Builder.
+     *
+     * If true, `limit(0)` returns all records. (the behavior of 4.4.x or before in version 4.x.)
+     * If false, `limit(0)` returns no records. (the behavior of 3.1.9 or later in version 3.x.)
+     */
+    public bool $limitZeroAsAll = true;
+
+    /**
+     * Use strict location negotiation.
+     *
+     * By default, the locale is selected based on a loose comparison of the language code (ISO 639-1)
+     * Enabling strict comparison will also consider the region code (ISO 3166-1 alpha-2).
+     */
+    public bool $strictLocaleNegotiation = false;
+}

app/Config/Fediverse.php

+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright  2022 Ad Aures
+ * @license    https://www.gnu.org/licenses/agpl-3.0.en.html AGPL3
+ * @link       https://castopod.org/
+ */
+
+namespace Config;
+
+use App\Libraries\NoteObject;
+use Exception;
+use Modules\Fediverse\Config\Fediverse as FediverseBaseConfig;
+
+class Fediverse extends FediverseBaseConfig
+{
+    /**
+     * --------------------------------------------------------------------
+     * ActivityPub Objects
+     * --------------------------------------------------------------------
+     */
+    public string $noteObject = NoteObject::class;
+
+    public string $defaultAvatarImagePath = 'castopod-avatar_thumbnail.webp';
+
+    public string $defaultAvatarImageMimetype = 'image/webp';
+
+    public function __construct()
+    {
+        parent::__construct();
+
+        try {
+            $appTheme = service('settings')
+                ->get('App.theme');
+            $defaultBanner = config('Images')
+                ->podcastBannerDefaultPaths[$appTheme] ?? config('Images')->podcastBannerDefaultPaths['default'];
+        } catch (Exception) {
+            $defaultBanner = config('Images')
+                ->podcastBannerDefaultPaths['default'];
+        }
+
+        ['dirname' => $dirname, 'extension' => $extension, 'filename' => $filename] = pathinfo(
+            $defaultBanner['path'],
+        );
+        $defaultBannerPath = $filename;
+        if ($dirname !== '.') {
+            $defaultBannerPathList = [$dirname, $filename];
+            $defaultBannerPath = implode('/', $defaultBannerPathList);
+        }
+
+        helper('media');
+
+        $this->defaultCoverImagePath = $defaultBannerPath . '_federation.' . $extension;
+        $this->defaultCoverImageMimetype = $defaultBanner['mimetype'];
+    }
+}

app/Config/Filters.php

@@ -4,54 +4,98 @@ declare(strict_types=1);
 
 namespace Config;
 
+use App\Filters\AllowCorsFilter;
 use CodeIgniter\Config\BaseConfig;
 use CodeIgniter\Filters\CSRF;
 use CodeIgniter\Filters\DebugToolbar;
+use CodeIgniter\Filters\ForceHTTPS;
 use CodeIgniter\Filters\Honeypot;
+use CodeIgniter\Filters\InvalidChars;
+use CodeIgniter\Filters\PageCache;
+use CodeIgniter\Filters\PerformanceMetrics;
+use CodeIgniter\Filters\SecureHeaders;
 use Modules\Auth\Filters\PermissionFilter;
-use Modules\Fediverse\Filters\FediverseFilter;
-use Myth\Auth\Filters\LoginFilter;
-use Myth\Auth\Filters\RoleFilter;
 
 class Filters extends BaseConfig
 {
     /**
      * Configures aliases for Filter classes to make reading things nicer and simpler.
      *
-     * @var array<string, string>
+     * @var array<string, class-string|list<class-string>>
+     *
+     * [filter_name => classname]
+     * or [filter_name => [classname1, classname2, ...]]
      */
     public array $aliases = [
-        'csrf' => CSRF::class,
-        'toolbar' => DebugToolbar::class,
-        'honeypot' => Honeypot::class,
-        'login' => LoginFilter::class,
-        'role' => RoleFilter::class,
-        'permission' => PermissionFilter::class,
-        'activity-pub' => FediverseFilter::class,
+        'csrf'          => CSRF::class,
+        'toolbar'       => DebugToolbar::class,
+        'honeypot'      => Honeypot::class,
+        'invalidchars'  => InvalidChars::class,
+        'secureheaders' => SecureHeaders::class,
+        'allow-cors'    => AllowCorsFilter::class,
+        'cors'          => Cors::class,
+        'forcehttps'    => ForceHTTPS::class,
+        'pagecache'     => PageCache::class,
+        'performance'   => PerformanceMetrics::class,
+    ];
+
+    /**
+     * List of special required filters.
+     *
+     * The filters listed here are special. They are applied before and after
+     * other kinds of filters, and always applied even if a route does not exist.
+     *
+     * Filters set by default provide framework functionality. If removed,
+     * those functions will no longer work.
+     *
+     * @see https://codeigniter.com/user_guide/incoming/filters.html#provided-filters
+     *
+     * @var array{before: list<string>, after: list<string>}
+     */
+    public array $required = [
+        'before' => [
+            'forcehttps', // Force Global Secure Requests
+            'pagecache',  // Web Page Caching
+        ],
+        'after' => [
+            'pagecache',   // Web Page Caching
+            'performance', // Performance Metrics
+            'toolbar',     // Debug Toolbar
+        ],
     ];
 
     /**
      * List of filter aliases that are always applied before and after every request.
      *
-     * @var array<string, string[]>
+     * @var array<string, array<string, array<string, string|array<string>>>>|array<string, list<string>>
      */
     public array $globals = [
         'before' => [
             // 'honeypot',
-            // 'csrf',
+            'csrf' => [
+                'except' => [
+                    '@[a-zA-Z0-9\_]{1,32}/inbox',
+                    'api/rest/v1/episodes',
+                    'api/rest/v1/episodes/[0-9]+/publish',
+                ],
+            ],
+            // 'invalidchars',
         ],
         'after' => [
-            'toolbar',
             // 'honeypot',
+            // 'secureheaders',
         ],
     ];
 
     /**
      * List of filter aliases that works on a particular HTTP method (GET, POST, etc.).
      *
-     * Example: 'post' => ['csrf', 'throttle']
+     * Example: 'POST' => ['foo', 'bar']
+     *
+     * If you use this, you should disable auto-routing because auto-routing permits any HTTP method to access a
+     * controller. Accessing the controller with a method you don’t expect could bypass the filter.
      *
-     * @var array<string, string[]>
+     * @var array<string, list<string>>
      */
     public array $methods = [];
 
@@ -60,7 +104,7 @@ class Filters extends BaseConfig
      *
      * Example: 'isLoggedIn' => ['before' => ['account/*', 'profiles/*']]
      *
-     * @var array<string, array<string, string[]>>
+     * @var array<string, array<string, list<string>>>
      */
     public array $filters = [];
 
@@ -69,9 +113,14 @@ class Filters extends BaseConfig
         parent::__construct();
 
         $this->filters = [
-            'login' => [
-                'before' => [config('Admin') ->gateway . '*', config('Analytics') ->gateway . '*'],
+            'session' => [
+                'before' => [config('Admin')->gateway . '*', config('Analytics')->gateway . '*'],
+            ],
+            'podcast-unlock' => [
+                'before' => ['*@*/episodes/*'],
             ],
         ];
+
+        $this->aliases['permission'] = PermissionFilter::class;
     }
 }

app/Config/ForeignCharacters.php

@@ -6,6 +6,9 @@ namespace Config;
 
 use CodeIgniter\Config\ForeignCharacters as BaseForeignCharacters;
 
+/**
+ * @immutable
+ */
 class ForeignCharacters extends BaseForeignCharacters
 {
 }

app/Config/Format.php

@@ -5,7 +5,6 @@ declare(strict_types=1);
 namespace Config;
 
 use CodeIgniter\Config\BaseConfig;
-use CodeIgniter\Format\FormatterInterface;
 use CodeIgniter\Format\JSONFormatter;
 use CodeIgniter\Format\XMLFormatter;
 
@@ -24,7 +23,7 @@ class Format extends BaseConfig
      * These formats are only checked when the data passed to the respond()
      * method is an array.
      *
-     * @var string[]
+     * @var list<string>
      */
     public array $supportedResponseFormats = [
         'application/json',
@@ -45,8 +44,8 @@ class Format extends BaseConfig
      */
     public array $formatters = [
         'application/json' => JSONFormatter::class,
-        'application/xml' => XMLFormatter::class,
-        'text/xml' => XMLFormatter::class,
+        'application/xml'  => XMLFormatter::class,
+        'text/xml'         => XMLFormatter::class,
     ];
 
     /**
@@ -61,19 +60,7 @@ class Format extends BaseConfig
      */
     public array $formatterOptions = [
         'application/json' => JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES,
-        'application/xml' => 0,
-        'text/xml' => 0,
+        'application/xml'  => 0,
+        'text/xml'         => 0,
     ];
-
-    //--------------------------------------------------------------------
-
-    /**
-     * A Factory method to return the appropriate formatter for the given mime type.
-     *
-     * @deprecated This is an alias of `\CodeIgniter\Format\Format::getFormatter`. Use that instead.
-     */
-    public function getFormatter(string $mime): FormatterInterface
-    {
-        return Services::format()->getFormatter($mime);
-    }
 }

app/Config/Generators.php

@@ -25,22 +25,22 @@ class Generators extends BaseConfig
      *
      * YOU HAVE BEEN WARNED!
      *
-     * @var array<string, string>
+     * @var array<string, string|array<string,string>>
      */
     public array $views = [
-        'make:command' =>
-            'CodeIgniter\Commands\Generators\Views\command.tpl.php',
-        'make:controller' =>
-            'CodeIgniter\Commands\Generators\Views\controller.tpl.php',
-        'make:entity' => 'CodeIgniter\Commands\Generators\Views\entity.tpl.php',
-        'make:filter' => 'CodeIgniter\Commands\Generators\Views\filter.tpl.php',
-        'make:migration' =>
-            'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
-        'make:model' => 'CodeIgniter\Commands\Generators\Views\model.tpl.php',
-        'make:seeder' => 'CodeIgniter\Commands\Generators\Views\seeder.tpl.php',
-        'make:validation' =>
-            'CodeIgniter\Commands\Generators\Views\validation.tpl.php',
-        'session:migration' =>
-            'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
+        'make:cell' => [
+            'class' => 'CodeIgniter\Commands\Generators\Views\cell.tpl.php',
+            'view'  => 'CodeIgniter\Commands\Generators\Views\cell_view.tpl.php',
+        ],
+        'make:command'      => 'CodeIgniter\Commands\Generators\Views\command.tpl.php',
+        'make:config'       => 'CodeIgniter\Commands\Generators\Views\config.tpl.php',
+        'make:controller'   => 'CodeIgniter\Commands\Generators\Views\controller.tpl.php',
+        'make:entity'       => 'CodeIgniter\Commands\Generators\Views\entity.tpl.php',
+        'make:filter'       => 'CodeIgniter\Commands\Generators\Views\filter.tpl.php',
+        'make:migration'    => 'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
+        'make:model'        => 'CodeIgniter\Commands\Generators\Views\model.tpl.php',
+        'make:seeder'       => 'CodeIgniter\Commands\Generators\Views\seeder.tpl.php',
+        'make:validation'   => 'CodeIgniter\Commands\Generators\Views\validation.tpl.php',
+        'session:migration' => 'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
     ];
 }

app/Config/Honeypot.php

@@ -30,6 +30,15 @@ class Honeypot extends BaseConfig
 
     /**
      * Honeypot container
+     *
+     * If you enabled CSP, you can remove `style="display:none"`.
      */
     public string $container = '<div style="display:none">{template}</div>';
+
+    /**
+     * The id attribute for Honeypot container tag
+     *
+     * Used when CSP is enabled.
+     */
+    public string $containerId = 'hpc';
 }