# TODO - core-template Project template for Core PHP Framework applications. This is the starter template developers clone to create new projects. ## P1 - Critical / Security ### Security Hardening - [ ] **Add security headers middleware** - Configure `X-Frame-Options`, `X-Content-Type-Options`, `X-XSS-Protection`, `Referrer-Policy`, and CSP headers. The template should ship with secure defaults that developers can customise. - [ ] **Add CSRF protection documentation** - Document that Laravel's CSRF protection is enabled by default and how to handle AJAX requests with the X-CSRF-TOKEN header (already set up in `bootstrap.js` via axios). - [ ] **Configure session security in .env.example** - Add `SESSION_SECURE_COOKIE=true` (commented for production) and document that `SESSION_ENCRYPT=true` should be enabled for sensitive applications. - [ ] **Add rate limiting to default routes** - The welcome page has no rate limiting. Consider adding basic throttle middleware to prevent abuse during development/staging. - [ ] **Document APP_KEY rotation** - Add a security note about key rotation and the implications for encrypted data (sessions, cookies). ### Environment Security - [ ] **Add .env.production.example** - Provide a production-ready example with secure defaults (`APP_DEBUG=false`, `SESSION_SECURE_COOKIE=true`, etc.). - [ ] **Add sensitive key validation** - Consider adding a boot-time check that warns if critical keys (APP_KEY, BCRYPT_ROUNDS) are using insecure defaults in production. ## P2 - High Priority ### Testing Infrastructure - [x] **Add example tests** - Added example tests demonstrating Pest patterns. (Fixed: 2026-01-29) - `tests/Feature/WelcomePageTest.php` - Tests welcome page (GET / returns 200) - `tests/Feature/HealthEndpointTest.php` - Tests health endpoint (GET /up returns 200) - `tests/Unit/ExampleTest.php` - Demonstrates Pest expectations syntax - [x] **Add Pest configuration file** - Created `tests/Pest.php` with TestCase binding, RefreshDatabase for Feature tests, and documentation for custom expectations/helpers. (Fixed: 2026-01-29) - [ ] **Configure parallel testing** - Add `pest.xml` or configure phpunit.xml for parallel test execution. - [ ] **Add database refresh trait documentation** - Document when to use `RefreshDatabase` vs `DatabaseMigrations` in tests. ### Developer Experience - [x] **Add composer scripts** - Added common scripts to composer.json: `lint`, `test`, `test:coverage`. Also added `pestphp/pest-plugin-type-coverage` for coverage support. (Fixed: 2026-01-29) - [ ] **Add make:mod command documentation** - The README mentions `php artisan make:mod` but doesn't document all available flags (--web, --api, --admin, --all). - [ ] **Create example module** - Add a simple example module (e.g., `app/Mod/Example/`) that developers can reference or delete. This would demonstrate the module pattern better than documentation alone. - [ ] **Add VS Code workspace settings** - Create `.vscode/settings.json` with recommended settings for PHP, Blade, and Tailwind. - [ ] **Add EditorConfig** - Create `.editorconfig` for consistent formatting across different editors. ### Configuration - [ ] **Document CDN configuration** - The `config/core.php` references CDN settings but there's no documentation on how to configure BunnyCDN or other CDN providers. - [ ] **Add Flux Pro setup script** - Consider adding a composer script or artisan command to simplify Flux Pro installation for licensed users. - [ ] **Add database configuration examples** - The .env.example shows SQLite as default with commented MySQL. Add PostgreSQL example too. ## P3 - Medium Priority ### Code Quality - [ ] **Add strict_types to all PHP files** - The `AppServiceProvider.php`, `TestCase.php`, `DatabaseSeeder.php`, and route files are missing `declare(strict_types=1);`. This contradicts the coding standards documented in CLAUDE.md. - [ ] **Add return type to artisan file** - The `artisan` file should have proper typing for consistency. - [ ] **Standardise route file structure** - The `routes/api.php` and `routes/console.php` have comments but no actual routes. Consider adding example routes or removing the unused files entirely. - [ ] **Add PHPStan/Larastan configuration** - Consider adding static analysis to catch type errors and potential bugs. ### Frontend - [ ] **Add Livewire to Vite config** - The vite.config.js doesn't include Livewire-specific configuration for hot reloading. - [ ] **Configure Tailwind for module paths** - The tailwind.config.js only scans `resources/` but modules in `app/Mod/*/Views/` won't be picked up. Add: ```js content: [ "./resources/**/*.blade.php", "./resources/**/*.js", "./app/Mod/**/Views/**/*.blade.php", ] ``` - [ ] **Add Flux UI styles import** - The `app.css` only imports Tailwind utilities. When using Flux, additional styles may be needed. - [ ] **Remove welcome.blade.php inline styles** - The welcome page uses inline `