bootstrap.php

<?php

declare(strict_types=1);

/**
 * Ava CMS Bootstrap
 *
 * Loads composer autoload, configuration, and initializes core services.
 * This file is shared by both the web front controller and CLI.
 */

// Prevent direct web access if accidentally exposed
if (php_sapi_name() !== 'cli' && !defined('AVA_START')) {
    http_response_code(403);
    exit('Direct access denied.');
}

// Ava version (CalVer: YY.M.PATCH - e.g., 26.2.0 = first patch of Feb 2026)
define('AVA_VERSION', '26.9.2');

// Ensure we have a root constant
if (!defined('AVA_ROOT')) {
    define('AVA_ROOT', __DIR__);
}

// Composer autoload
$autoloadPath = AVA_ROOT . '/vendor/autoload.php';
if (!file_exists($autoloadPath)) {
    $isCli = php_sapi_name() === 'cli';
    
    if ($isCli) {
        echo "\n👋 Welcome to Ava CMS!\n\n";
        echo "Run 'composer install' from your Ava root directory.\n\n";
        echo "No SSH? Run it locally and upload the vendor/ folder.\n\n";
        echo "More info: https://ava.addy.zone/docs/hosting\n\n";
        exit(1);
    }
    
    http_response_code(503);
    echo <<<'HTML'
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Ava CMS Setup</title>
    <style>
        body { font-family: system-ui, sans-serif; max-width: 480px; margin: 4rem auto; padding: 1.5rem; line-height: 1.6; color: #334155; }
        h1 { font-size: 1.5rem; margin-bottom: 1rem; }
        code { background: #f1f5f9; padding: 0.15rem 0.4rem; border-radius: 0.25rem; font-size: 0.9em; }
        a { color: #2563eb; }
        .hint { margin-top: 1.5rem; padding-top: 1rem; border-top: 1px solid #e2e8f0; font-size: 0.875rem; color: #64748b; }
    </style>
</head>
<body>
    <h1>👋 Welcome to Ava CMS!</h1>
    <p>Run <code>composer install</code> from your Ava root directory.</p>
    <p>No SSH? Run it locally and upload the <code>vendor/</code> folder.</p>
    <p class="hint">Need help? See the <a href="https://ava.addy.zone/docs/hosting">Hosting Guide</a></p>
</body>
</html>
HTML;
    exit;
}
require $autoloadPath;

// Load main configuration
$configPath = AVA_ROOT . '/app/config/ava.php';
if (!file_exists($configPath)) {
    die("Configuration file not found: app/config/ava.php\n");
}

$config = require $configPath;

// Configure error handling. Logging is independent from browser debug output so
// production errors remain observable without exposing their details to users.
$errorSettings = \Ava\Support\ErrorSettings::resolve($config['debug'] ?? []);
$debugEnabled = $errorSettings['debug_enabled'];
$displayErrors = $errorSettings['display_errors'];
$logErrors = $errorSettings['log_errors'];
$errorLevel = $errorSettings['level'];
$configuredStorage = $config['paths']['storage'] ?? 'storage';
$configuredStorage = is_string($configuredStorage) && $configuredStorage !== ''
    ? $configuredStorage
    : 'storage';
$errorLog = AVA_ROOT . '/' . trim($configuredStorage, '/\\') . '/logs/error.log';

// Set error reporting level
$errorReporting = match ($errorLevel) {
    'all' => E_ALL,
    'errors' => E_ERROR | E_PARSE | E_CORE_ERROR | E_COMPILE_ERROR | E_USER_ERROR | E_RECOVERABLE_ERROR,
    'none' => 0,
    default => E_ALL & ~E_NOTICE & ~E_DEPRECATED,
};
error_reporting($errorReporting);

// Display errors (only in debug mode with display_errors enabled)
ini_set('display_errors', $displayErrors ? '1' : '0');
ini_set('display_startup_errors', $displayErrors ? '1' : '0');

// Honour the configured logging policy even when the host php.ini enables
// logging globally.
ini_set('log_errors', $logErrors ? '1' : '0');
$reportedError = false;

// Log errors to Ava's file
if ($logErrors) {
    ini_set('error_log', $errorLog);

    // Native PHP errors are written after the custom handler returns. Rotate
    // at shutdown only when an error occurred, avoiding work on clean requests.
    register_shutdown_function(static function () use ($errorLog, $config, &$reportedError): void {
        $lastError = error_get_last();
        $fatalTypes = [E_ERROR, E_PARSE, E_CORE_ERROR, E_COMPILE_ERROR];
        $fatalError = $lastError !== null && in_array($lastError['type'], $fatalTypes, true);

        if (!$reportedError && !$fatalError) {
            return;
        }

        \Ava\Support\LogRotator::rotateIfNeeded(
            $errorLog,
            (int) ($config['logs']['max_size'] ?? 10 * 1024 * 1024),
            (int) ($config['logs']['max_files'] ?? 3)
        );
    });
}

// Custom error handler for enhanced logging (only if debugging or logging enabled)
if ($debugEnabled || $logErrors) {
    set_error_handler(function (int $errno, string $errstr, string $errfile, int $errline) use ($logErrors, $displayErrors, $errorLog, &$reportedError) {
        // Skip errors suppressed with @
        if (!(error_reporting() & $errno)) {
            return false;
        }

        $reportedError = true;
        
        $type = match ($errno) {
            E_ERROR, E_USER_ERROR => 'ERROR',
            E_WARNING, E_USER_WARNING => 'WARNING',
            E_NOTICE, E_USER_NOTICE => 'NOTICE',
            E_DEPRECATED, E_USER_DEPRECATED => 'DEPRECATED',
            default => 'UNKNOWN',
        };
        
        $message = sprintf(
            "[%s] %s: %s in %s on line %d",
            date('Y-m-d H:i:s'),
            $type,
            $errstr,
            str_replace(AVA_ROOT . '/', '', $errfile),
            $errline
        );
        
        if (!$logErrors) {
            // Nothing written here, so let PHP display it per display_errors.
            return false;
        }

        @file_put_contents($errorLog, $message . "\n", FILE_APPEND | LOCK_EX);

        // PHP's own handler would write the same error to error_log again, so
        // handle it fully here and display it ourselves when that is enabled.
        if ($displayErrors) {
            echo PHP_SAPI === 'cli'
                ? $message . "\n"
                : '<br><b>' . htmlspecialchars($type) . '</b>: ' . htmlspecialchars($errstr)
                    . ' in ' . htmlspecialchars($errfile) . ' on line ' . $errline . "<br>\n";
        }

        return true;
    });
}

// Exception handler - always registered to show custom error pages
set_exception_handler(function (\Throwable $e) use ($debugEnabled, $displayErrors, $logErrors, $config, $errorLog) {
    $message = sprintf(
        "[%s] EXCEPTION: %s in %s on line %d\nStack trace:\n%s",
        date('Y-m-d H:i:s'),
        $e->getMessage(),
        str_replace(AVA_ROOT . '/', '', $e->getFile()),
        $e->getLine(),
        $e->getTraceAsString()
    );
    
    if ($logErrors) {
        @file_put_contents($errorLog, $message . "\n\n", FILE_APPEND | LOCK_EX);
        \Ava\Support\LogRotator::rotateIfNeeded(
            $errorLog,
            (int) ($config['logs']['max_size'] ?? 10 * 1024 * 1024),
            (int) ($config['logs']['max_files'] ?? 3)
        );
    }
    
    if (PHP_SAPI !== 'cli' && !headers_sent()) {
        http_response_code(500);
    }

    if ($debugEnabled && $displayErrors) {
        echo "<pre style='background:#1a1a2e;color:#eee;padding:20px;font-family:monospace;'>";
        echo "<strong style='color:#ff6b6b;'>Exception:</strong> " . htmlspecialchars($e->getMessage()) . "\n\n";
        echo "<strong>File:</strong> " . htmlspecialchars($e->getFile()) . ":" . $e->getLine() . "\n\n";
        echo "<strong>Stack Trace:</strong>\n" . htmlspecialchars($e->getTraceAsString());
        echo "</pre>";
    } else {
        // Show styled error page in production
        // Generate a short error reference ID from timestamp
        $errorId = $logErrors ? date('ymd-His') . '-' . substr(md5($e->getMessage() . $e->getFile()), 0, 6) : null;
        $requestedPath = $_SERVER['REQUEST_URI'] ?? null;
        if ($requestedPath) {
            $requestedPath = parse_url($requestedPath, PHP_URL_PATH) ?: $requestedPath;
        }
        echo \Ava\Rendering\ErrorPages::render500($errorId, $requestedPath, $logErrors);
    }
    exit(1);
});

// Initialize the application and return it
return new Ava\Application($config);