Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions,
  JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter)
- DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD),
  Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG)
- Security: SSRF guard, MIME validation, rate limits, API-key auth,
  bcrypt admin login, security headers
- Admin panel: dashboard, tools/categories/guides CRUD, SEO audit,
  analytics, job inspector with retry, system health, feature flags
- Docker deployment (nginx + web/api FPM pools + scalable workers),
  PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker

app/Filters/AdminAuth.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Admin gate: single-operator password from .env (bcrypt), session
+ * flag, CSRF-protected login. Deliberately simple — swap for SSO or a
+ * users table later without touching routes (same filter alias).
+ */
+final class AdminAuth implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        // The login/logout pair is exempted in Filters::$filters config.
+        $uri = uri_string();
+        if ($uri === 'admin/login' || $uri === 'admin/auth/attempt') {
+            return null;
+        }
+
+        if (! session()->get('tv_admin_ok')) {
+            return redirect()->to('/admin/login');
+        }
+
+        return null;
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}

app/Filters/ApiAuth.php

@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Developer API authentication: `Authorization: Bearer <token>` mapped
+ * to an api_keys row. Per-key hourly quota enforced here.
+ */
+final class ApiAuth implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! $request instanceof \CodeIgniter\HTTP\IncomingRequest) {
+            return null;
+        }
+
+        $header = $request->getHeaderLine('Authorization');
+        if ($header === '' || ! preg_match('/^Bearer\s+(\S+)$/i', $header, $m)) {
+            return $this->deny(401, 'Missing bearer token.');
+        }
+
+        $key = model(\App\Models\ApiKeyModel::class)->findByPlainKey($m[1]);
+        if ($key === null) {
+            return $this->deny(401, 'Invalid token.');
+        }
+
+        // hourly per-key quota
+        $bucket = 'rl_api_' . $key['key_prefix'] . date('YmdH');
+        $used   = (int) (cache()->get($bucket) ?? 0);
+        if ($used >= (int) $key['rate_limit_per_hour']) {
+            return response()->setStatusCode(429)
+                ->setJSON(['error' => 'quota_exceeded', 'message' => 'Hourly API quota exhausted.']);
+        }
+        cache()->save($bucket, $used + 1, 3700);
+
+        service('request')->api_key = $key; // available to controllers
+
+        return null;
+    }
+
+    private function deny(int $status, string $message): ResponseInterface
+    {
+        return response()->setStatusCode($status)
+            ->setJSON(['error' => 'unauthorized', 'message' => $message]);
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}

app/Filters/RateLimit.php

@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Cache-backed sliding-window rate limiting for processing endpoints
+ * (API, upload, download). Buckets: per-IP and per-session. Legit users
+ * never hit these limits; abusive automation gets a clean 429.
+ */
+final class RateLimit implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! $request instanceof \CodeIgniter\HTTP\IncomingRequest) {
+            return null;
+        }
+
+        $site = config('Site');
+
+        $ipBucket   = 'rl_ip_' . md5($request->getIPAddress() . '|' . date('YmdH'));
+        $sessionKey = service('analytics')->sessionHash();
+        $sessBucket = 'rl_ses_' . substr($sessionKey, 0, 16) . '|' . date('YmdH');
+
+        $cache = cache();
+
+        $ipCount = (int) ($cache->get($ipBucket) ?? 0);
+        $seCount = (int) ($cache->get($sessBucket) ?? 0);
+
+        // API tokens carry their own generous quota and bypass the IP window
+        $isApi = str_starts_with(uri_string(), 'api/v1') && $request->getHeaderLine('Authorization') !== '';
+
+        if (! $isApi && $ipCount >= $site->maxJobsPerHourIp * 3) {
+            return $this->tooMany();
+        }
+        if ($seCount >= $site->maxJobsPerHourSession * 3) {
+            return $this->tooMany();
+        }
+
+        $cache->save($ipBucket, $ipCount + 1, 3700);
+        $cache->save($sessBucket, $seCount + 1, 3700);
+
+        return null;
+    }
+
+    private function tooMany(): ResponseInterface
+    {
+        return response()
+            ->setStatusCode(429)
+            ->setBody(view('errors/rate_limited'));
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}

app/Filters/SeoCanonical.php

@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Canonical URL enforcement for SEO: any request that differs from the
+ * canonical lowercase, no-trailing-slash form is 301-redirected before
+ * routing. Prevents duplicate-content across case variants and slashes.
+ */
+final class SeoCanonical implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! $request instanceof \CodeIgniter\HTTP\IncomingRequest) {
+            return null;
+        }
+
+        // Only GET/HEAD matter for indexing.
+        if (! in_array(strtolower($request->getMethod()), ['get', 'head'], true)) {
+            return null;
+        }
+
+        $path = trim(uri_string());
+        if ($path === '') {
+            $path = trim($request->getUri()->getPath(), '/');
+        }
+
+        // Skip files that legitimately end with a slash-like pattern or assets
+        if ($path === '' || str_contains($path, '.')) {
+            return null;
+        }
+
+        $needsRedirect = false;
+
+        // trailing slash
+        if (str_ends_with($path, '/')) {
+            $path          = rtrim($path, '/');
+            $needsRedirect = true;
+        }
+
+        // uppercase / mixed case
+        if ($path !== mb_strtolower($path)) {
+            $path          = mb_strtolower($path);
+            $needsRedirect = true;
+        }
+
+        // multiple consecutive slashes
+        if (str_contains($path, '//')) {
+            $path          = preg_replace('#/+#', '/', $path);
+            $needsRedirect = true;
+        }
+
+        if ($needsRedirect) {
+            return redirect()->to($path !== '' ? '/' . ltrim((string) $path, '/') : '/')
+                ->setStatusCode(301);
+        }
+
+        return null;
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}