Complete Phase 5 integration, CI, and deployment hardening

.github/workflows/quality.yml

@@ -0,0 +1,62 @@
+name: Quality
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-and-scan:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+          tools: composer:v2
+
+      - name: Validate Composer configuration
+        run: composer validate --strict
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Run dependency audit
+        run: composer audit
+
+      - name: PHP syntax check
+        run: find src tests -name '*.php' -print0 | xargs -0 -n1 php -l
+
+      - name: Run unit tests
+        run: composer test:unit
+
+      - name: Run integration tests
+        run: composer test:integration
+
+      - name: Run static analysis
+        run: composer analyze
+
+      - name: Run coding standards
+        run: composer lint
+
+      - name: Run performance benchmark
+        run: php tests/performance/benchmark.php --format=github
+
+      - name: Build Docker image
+        run: docker build -t tinyfilemanager:test .
+
+      - name: Run smoke checks in container
+        run: |
+          docker run -d --rm --name tinyfilemanager-ci -p 8080:8080 tinyfilemanager:test
+          ./tests/smoke-tests.sh http://127.0.0.1:8080
+
+      - name: Stop test container
+        if: always()
+        run: docker stop tinyfilemanager-ci || true

.gitignore

@@ -0,0 +1,17 @@
+# Generated release archives
+releases/tinyfilemanager-*.zip
+
+# Runtime uploads and ad-hoc local test files
+uploads/
+.fm_usercfg/*.json
+.fm_usercfg/*.sqlite
+!.fm_usercfg/.htaccess
+
+# Local Joyee bridge secrets (server-only)
+joyee-bridge.config.php
+
+# Generated ChatGPT source manifest with live machine token
+chatgpt-source-joyee.md
+
+# Local VS Code user settings (machine-specific)
+.vscode/settings.json

CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog
+
+## [Unreleased]
+
+### Added
+- Added integrated read-only user administration page via `?admin_users=1`.
+- Added admin-only modal framework for future New/Edit user actions.
+- Added one-time migration helper `scripts/migrate-legacy-state.php` with `dry-run` and `--apply` modes.
+
+### Changed
+- User overview now lists access type, auth status, assigned directories and configuration notes.
+- Access to the user administration page and navigation link is now restricted to the `admin` user only (not `manager_users`).
+- Runtime state storage is now configurable via `$state_storage_path` in `config.php`.
+- Internal runtime records (online users, chat DB, owner metadata, audit and fallback log, per-user settings) now use a persistent state directory.
+- Authentication and online-user tracking were hardened to remove stale user markers when a session account changes.
+- Documentation updated for release/deploy flow to include runtime-state migration and verification.
+
+### Removed
+- Removed operational dependency on app-local `.fm_usercfg` as the primary runtime state location.
+
+### Breaking changes
+- Visual baseline is now aligned with the modern theme layer.
+- Some legacy CSS override rules were narrowed or removed to reduce cascade conflicts.
+- Custom theme overrides may need revalidation after deploy.
+
+### Migration notes
+- Back up `config.php`, `api.config.php`, custom assets, and local patches before deploy.
+- Deploy the new release package and verify file ownership/permissions in the target environment.
+- Clear browser cache and any reverse proxy or CDN cache.
+- Run smoke tests for login/logout, theme switch, listing density, selection/bulk move, upload, rename, copy/move, delete, and file preview/editor.
+- Verify path-boundary behavior for move/copy operations and confirm readonly/upload-only modes.
+- Review PHP and web server logs after deploy and check browser console for front-end regressions.
+
+### Notes
+- User listing remains read-only; modal content is loaded only on admin action.
+- No `config.php` write is performed in user administration phase.

DEPLOYMENT.md

@@ -0,0 +1,63 @@
+# Deployment Guide
+
+This project now includes a complete Phase 5 delivery set: integration tests, performance benchmark, CI quality workflow, container smoke checks, and deployment runbooks.
+
+## Deployment Targets
+
+- Docker container on Linux host
+- Linux VPS with PHP 8.0+
+- Shared hosting with PHP 8.0+
+
+## Local Validation
+
+Run the full quality gate before deployment:
+
+```bash
+composer install
+composer test:unit
+composer test:integration
+composer analyze
+composer lint
+php tests/performance/benchmark.php
+docker build -t tinyfilemanager:test .
+docker run -d --rm --name tinyfilemanager-test -p 8080:8080 tinyfilemanager:test
+./tests/smoke-tests.sh http://127.0.0.1:8080
+./tests/health-check.sh http://127.0.0.1:8080
+docker stop tinyfilemanager-test
+```
+
+## Docker Deployment
+
+```bash
+docker build -t tinyfilemanager:latest .
+docker compose up -d --build
+./tests/health-check.sh http://127.0.0.1:8080
+```
+
+Notes:
+- The container runs as a non-root user.
+- The application listens on port 8080 inside the container.
+- Persist data with a bind mount or named volume.
+
+## Rollback
+
+```bash
+docker compose down
+git checkout <last-known-good-tag>
+docker compose up -d --build
+./tests/health-check.sh http://127.0.0.1:8080
+```
+
+## Release Checklist
+
+- Unit and integration suites pass
+- Benchmark stays within targets
+- Docker image builds successfully
+- Smoke and health checks pass
+- Configured credentials are not defaults
+- Data backup completed before rollout
+- Runtime state path is persistent (`$state_storage_path` in `config.php`)
+- Legacy runtime data migration script executed when needed:
+	- `php scripts/migrate-legacy-state.php`
+	- `php scripts/migrate-legacy-state.php --apply`
+- Runtime state files verified in target directory (`uploads/.tfm-state`)

DOCS_AUDIT.md

@@ -0,0 +1,76 @@
+# Documentation Audit and Structure Proposal
+
+## 1. Audit of All Markdown Files
+
+| File                        | Purpose / Content Summary                                                                 | Status         | Recommendation         |
+|-----------------------------|----------------------------------------------------------------------------------------|----------------|-----------------------|
+| README.md                   | Main project overview, usage, requirements, demo links.                                 | Active         | KEEP (root)           |
+| PROJECT_STATUS.md           | High-level project status, phase summary, quick start, links to phase docs.             | Active         | KEEP (root)           |
+| CHANGELOG.md                | Changelog, recent removals, and changes.                                                | Active         | KEEP (root)           |
+| DEPLOYMENT.md               | Deployment guide, validation, Docker, and CI instructions.                              | Active         | KEEP (root)           |
+| SECURITY.md                 | Security policy and vulnerability disclosure process.                                   | Active         | KEEP (root)           |
+| SMOKE_TEST_2.9.19.md        | Manual smoke test checklist for version 2.9.19.                                         | Active         | KEEP (root)           |
+| TEST_RESULTS.md             | Phase 4 security test results, coverage, and summary.                                   | Historical     | ARCHIVE               |
+| Structure.md                | Repository structure overview (tree format).                                            | Historical     | ARCHIVE               |
+| REFACTORING.md              | Security refactoring project summary, phase completion, and code/test stats.             | Historical     | ARCHIVE               |
+| PHASE2_README.md            | Phase 2: Modularization, new structure, and bootstrap details.                          | Historical     | ARCHIVE               |
+| PHASE3_README.md            | Phase 3: Router & Middleware, architecture, and router features.                        | Historical     | ARCHIVE               |
+| PHASE4_PLAN.md              | Phase 4: Security testing plan, objectives, and test categories.                        | Historical     | ARCHIVE               |
+| PHASE4_PROGRESS.md          | Phase 4: Security testing progress, completed infrastructure, and test coverage.         | Historical     | ARCHIVE               |
+| PHASE4_COMPLETE.md          | Phase 4: Completion summary, delivered components, and test suite overview.             | Historical     | ARCHIVE               |
+| PHASE5_PLAN.md              | Phase 5: Integration testing, deployment, and CI/CD plan.                               | Historical     | ARCHIVE               |
+
+## 2. Classification
+- **Active Docs (should remain in root):**
+  - README.md
+  - PROJECT_STATUS.md
+  - CHANGELOG.md
+  - DEPLOYMENT.md
+  - SECURITY.md
+  - SMOKE_TEST_2.9.19.md
+- **Historical/Phase/Refactor Docs (should be archived):**
+  - TEST_RESULTS.md
+  - Structure.md
+  - REFACTORING.md
+  - PHASE2_README.md
+  - PHASE3_README.md
+  - PHASE4_PLAN.md
+  - PHASE4_PROGRESS.md
+  - PHASE4_COMPLETE.md
+  - PHASE5_PLAN.md
+
+## 3. Proposed Documentation Structure
+
+```
+/ (root)
+├── README.md
+├── PROJECT_STATUS.md
+├── CHANGELOG.md
+├── DEPLOYMENT.md
+├── SECURITY.md
+├── SMOKE_TEST_2.9.19.md
+└── docs/
+  └── archive/
+    └── refactor-history/
+      ├── TEST_RESULTS.md
+      ├── Structure.md
+      ├── REFACTORING.md
+      ├── PHASE2_README.md
+      ├── PHASE3_README.md
+      ├── PHASE4_PLAN.md
+      ├── PHASE4_PROGRESS.md
+      ├── PHASE4_COMPLETE.md
+      └── PHASE5_PLAN.md
+```
+
+- **Active docs**: Only current, user-facing, and operational documentation in the root.
+- **Archive**: All phase, refactoring, and historical docs in `docs/archive/refactor-history/`.
+
+## 4. Notes
+- No files have been moved, deleted, or modified yet. This is an audit and proposal only.
+- All phase and refactoring docs are valuable for historical reference but should not clutter the root.
+- The archive structure allows for easy access to project history while keeping the main directory clean.
+
+---
+
+*Prepared by GitHub Copilot — Documentation Audit, [date auto-inserted on save]*

Dockerfile

@@ -1,26 +1,29 @@
 # how to build?
-# docker login
-## .....input your docker id and password
-#docker build . -t tinyfilemanager/tinyfilemanager:master
-#docker push tinyfilemanager/tinyfilemanager:master
+# docker build -t tinyfilemanager/tinyfilemanager:master .
 
-# how to use?
-# docker run -d -v /absolute/path:/var/www/html/data -p 80:80 --restart=always --name tinyfilemanager tinyfilemanager/tinyfilemanager:master
+FROM php:8.3-cli-alpine AS runtime
 
-FROM php:7.4-cli-alpine
+RUN apk add --no-cache curl libzip-dev oniguruma-dev \
+    && docker-php-ext-install zip
 
-# if run in China
-# RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
+WORKDIR /var/www/html
 
-RUN apk add --no-cache \
-    libzip-dev \
-    oniguruma-dev
+COPY tinyfilemanager.php ./tinyfilemanager.php
+COPY index.php ./index.php
+COPY config.php ./config.php
+COPY src ./src
+COPY translation.json ./translation.json
+COPY KatalogMD.webp ./KatalogMD.webp
 
-RUN docker-php-ext-install \
-    zip 
+RUN addgroup -S tfm && adduser -S -G tfm tfm \
+    && mkdir -p /var/www/html/data /var/www/html/uploads \
+    && chown -R tfm:tfm /var/www/html
 
-WORKDIR /var/www/html
+USER tfm
+
+EXPOSE 8080
 
-COPY tinyfilemanager.php index.php
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD curl -fsS http://127.0.0.1:8080/ >/dev/null || exit 1
 
-CMD ["sh", "-c", "php -S 0.0.0.0:80"]
+CMD ["php", "-S", "0.0.0.0:8080", "-t", "/var/www/html"]

Joyee/ai-write-test.txt

@@ -0,0 +1 @@
+assistant_apply works

Joyee/ops-demo/confirm2.txt

@@ -0,0 +1 @@
+two

Joyee/ops-demo/nested/deeper/a.txt

@@ -0,0 +1 @@
+hello