index.php

<?php

// Error Handling Setup
ini_set('display_errors', 0); // Hide errors from users
ini_set('log_errors', 1);     // Log errors to file
ini_set('error_log', __DIR__ . '/logs/php_error.log');
// error_reporting(E_ALL);

// Initialize database connection
require_once __DIR__ . '/config/db.php';

require_once __DIR__ . '/vendor/autoload.php';

use Aaditya\Cms\Router;
use Aaditya\Cms\TemplateEngine;

// Security Headers
header("X-Frame-Options: SAMEORIGIN");
header("X-Content-Type-Options: nosniff");
header("X-XSS-Protection: 1; mode=block");
header("Referrer-Policy: strict-origin-when-cross-origin");
// header("Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.quilljs.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.quilljs.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:;");


// CRITICAL: Set unique session name to prevent session leakage on shared hosting
session_name('customTest_session');

// Start session for user authentication with Secure params
$sessionParams = session_get_cookie_params();
session_set_cookie_params([
    'lifetime' => $sessionParams["lifetime"],
    'path' => '/~np02cs4a240031/',  // Restrict to this subdirectory only
    'domain' => $sessionParams["domain"],
    'secure' => isset($_SERVER['HTTPS']), // True if HTTPS
    'httponly' => true,
    'samesite' => 'Strict'
]);

session_start();

// Initialize template engine
$templateEngine = new TemplateEngine();

// Initialize router
$router = new Router($templateEngine);

$router->get('/', 'HomeController@index');
$router->get('/about', 'HomeController@about');

$router->get('/auth/register', 'UserController@register');
$router->get('/auth/login', 'UserController@login');
$router->get('/auth/logout', 'UserController@logout');

$router->post('/auth/register', 'UserController@register');
$router->post('/auth/login', 'UserController@login');

$router->get('/@{username}', 'UserController@profile');
$router->get('/users/{id}', 'UserController@profile'); // Keep for ID access
$router->get('/users/{id}/edit', 'UserController@edit');
$router->post('/users/{id}/edit', 'UserController@edit');

// User Personal Routes
$router->get('/me/stories', 'BlogController@myStories');
$router->get('/me/saved', 'BlogController@savedStories');

// Route for tag feed
$router->get('/tag/{tag}', 'BlogController@byTag');

$router->get('/blogs', 'BlogController@index');
$router->get('/blogs/create', 'BlogController@create');
$router->post('/blogs/create', 'BlogController@create');

$router->get('/blogs/{id}', 'BlogController@view');
$router->get('/blogs/{id}/edit', 'BlogController@edit');
$router->post('/blogs/{id}/edit', 'BlogController@edit');
$router->post('/blogs/{id}/delete', 'BlogController@delete');
$router->post('/blogs/{id}/comment', 'BlogController@addComment');
$router->post('/blogs/{id}/save', 'BlogController@toggleSave');
$router->post('/blogs/{id}/like', 'BlogController@toggleLike');

$router->post('/users/{id}/follow', 'UserController@toggleFollow');

$router->get('/api/blogs', 'BlogController@apiIndex');
$router->get('/api/blogs/search', 'BlogController@apiSearch');

// Dispatch the request
$router->dispatch();