Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions, JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter) - DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD), Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG) - Security: SSRF guard, MIME validation, rate limits, API-key auth, bcrypt admin login, security headers - Admin panel: dashboard, tools/categories/guides CRUD, SEO audit, analytics, job inspector with retry, system health, feature flags - Docker deployment (nginx + web/api FPM pools + scalable workers), PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker
2026-08-23 07:10:30 +00:00
commit beaf0e1f37
217 changed files with 19619 additions and 0 deletions
@@ -0,0 +1,57 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Developer API authentication: `Authorization: Bearer <token>` mapped
+ * to an api_keys row. Per-key hourly quota enforced here.
+ */
+final class ApiAuth implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! $request instanceof \CodeIgniter\HTTP\IncomingRequest) {
+            return null;
+        }
+
+        $header = $request->getHeaderLine('Authorization');
+        if ($header === '' || ! preg_match('/^Bearer\s+(\S+)$/i', $header, $m)) {
+            return $this->deny(401, 'Missing bearer token.');
+        }
+
+        $key = model(\App\Models\ApiKeyModel::class)->findByPlainKey($m[1]);
+        if ($key === null) {
+            return $this->deny(401, 'Invalid token.');
+        }
+
+        // hourly per-key quota
+        $bucket = 'rl_api_' . $key['key_prefix'] . date('YmdH');
+        $used   = (int) (cache()->get($bucket) ?? 0);
+        if ($used >= (int) $key['rate_limit_per_hour']) {
+            return response()->setStatusCode(429)
+                ->setJSON(['error' => 'quota_exceeded', 'message' => 'Hourly API quota exhausted.']);
+        }
+        cache()->save($bucket, $used + 1, 3700);
+
+        service('request')->api_key = $key; // available to controllers
+
+        return null;
+    }
+
+    private function deny(int $status, string $message): ResponseInterface
+    {
+        return response()->setStatusCode($status)
+            ->setJSON(['error' => 'unauthorized', 'message' => $message]);
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        return null;
+    }
+}