ModuleInstaller 1.6.0: Module Sets, bulk CP UI, mtools consumer, DevOps baseline - #2
Merged
Merged
Conversation
…ps baseline ## Summary Release **1.6.0-Stable** of ModuleInstaller: bulk module management and **Module Sets** for focused testing, as a proper **mtools** consumer, with Control Panel chrome only (no legacy install-wizard shell). ### Highlights - **Module Sets** (YAML under `XOOPS_VAR_PATH`): create/edit/import/export, snapshot actives, Focus/activate/deactivate/install/uninstall with dry-run and protected-module rules - **Bulk tabs** via `AdminBulkPage::serve()`: install, update, activate, deactivate, uninstall — filter, sticky “N selected”, Apply set, CSRF, per-module result reports - **Installer home** dashboard (counts, updates, last Focus snapshot) + optional **sample module sets** (e.g. PM / Profile / Protector) - **mtools ≥ 1.2.0**: bootstrap, lifecycle hooks, `Utility` → `Mtools\Common\SysUtility`; removed local `class/Common/*` forks - **UI**: CP look & feel from ModuleAdmin/admin theme; scoped `assets/css/admin.css` only; logos, even/odd rows, set edit polish - **Cleanup**: removed `extras/`, InstallWizard / `install_tpl` / prototype / English `install.php` language baggage - **DevOps baseline** (`module-devops`): Composer QA, PHPStan/PHPUnit/CS-Fixer/Rector, `.github` CI/release, stubs ### Requirements - XOOPS ≥ 2.5.12, PHP ≥ 8.2, mtools ≥ 1.2.0 (installed; active not required) ### Docs - `README.md`, `CHANGELOG.md`, `docs/changelog.txt`, `docs/TUTORIAL.md`, `docs/readme.txt` ## Test plan - [ ] Install/update module with mtools present - [ ] Bulk Install/Update/Activate/Deactivate/Uninstall (select, filter, Continue, result log) - [ ] Module Sets: edit membership, Apply Focus, restore snapshot - [ ] Load sample set (PM, Profile & Protector) from Installer home - [ ] Confirm CP nav/footer match admin theme (no wizard CSS bleed) - [ ] `composer install` && `composer test` (or site PHPUnit) on unit suite
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @mambax7, your pull request is larger than the review limit of 150000 diff characters
|
Important Review skippedToo many files! This PR contains 106 files, which is 6 over the limit of 100. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (126)
You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Correctness: - verify real post-action state via a fresh DB read for install/uninstall/ activate/deactivate rather than reporting OK whenever the core call did not throw; an unverifiable state is now a failure, and deactivation must leave the module installed and inactive (a vanished module is a failure) - abort Focus when the recovery snapshot cannot be saved, so no module is deactivated without a restore point - add a distinct ORPHANED state (installed, files gone); such modules are never activated and are surfaced as skips/notices - stream the module-set YAML export before xoops_cp_header() so the download headers are sent and no admin markup leaks into the file - dynamically protect the start-page module from deactivation while still allowing Focus to activate it when inactive Security: - fail closed in the bulk CSRF check when the security service is absent - sanitize core install-log messages before rendering (strip all tags and escape) to stop markup injected through a module name or version - gate the sample-data export behind the confirm + token flow like load and clear instead of a tokenless GET filesystem write - add direct-access guards to the install and uninstall callbacks QA gate: - make composer qa pass on PHP 8.2-8.4: apply CS-Fixer and Rector, add xoops/xmf as a dev dependency, skip integration-only tests in unit runs, stub the mtools SysUtility base for analysis, and regenerate the PHPStan baseline - fix the null-deref and type issues PHPStan surfaced along the way
The QA gate enables phpstan-strict-rules and phpstan-deprecation-rules through phpstan/extension-installer, but the committed baseline had been generated in an environment where those extensions were not active, so it did not cover the ~145 strict/deprecation findings (mostly pre-existing legacy patterns: empty(), short ternary, non-boolean conditions, loose comparisons). CI therefore failed on them. Regenerate the baseline with the strict and deprecation rule sets active so it matches what CI analyses, and tighten the one strict finding in new code: use an explicit false check on the query result in freshState().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release 1.6.0-Stable of ModuleInstaller: bulk module management and Module Sets for focused testing, as a proper mtools consumer, with Control Panel chrome only (no legacy install-wizard shell).
Highlights
XOOPS_VAR_PATH): create/edit/import/export, snapshot actives, Focus/activate/deactivate/install/uninstall with dry-run and protected-module rulesAdminBulkPage::serve(): install, update, activate, deactivate, uninstall — filter, sticky “N selected”, Apply set, CSRF, per-module result reportsUtility→Mtools\Common\SysUtility; removed localclass/Common/*forksassets/css/admin.cssonly; logos, even/odd rows, set edit polishextras/, InstallWizard /install_tpl/ prototype / Englishinstall.phplanguage baggagemodule-devops): Composer QA, PHPStan/PHPUnit/CS-Fixer/Rector,.githubCI/release, stubsRequirements
Docs
README.md,CHANGELOG.md,docs/changelog.txt,docs/TUTORIAL.md,docs/readme.txtTest plan
composer install&&composer test(or site PHPUnit) on unit suite