+
+ Die Dateien liegen.
+ Diese Datei hat sich selbst gelöscht. Weiter geht es mit der Einrichtung: Datenbank, Konto, Website.
+
+ Zur Einrichtung →
+ Führt der Verweis ins Leere, zeigt die Domain nicht auf public/. Das muss beim Hoster eingestellt werden – ohne das wären auch .env und var/ über das Netz erreichbar.
+
+ KantSites installieren
+ Diese Datei lädt Fassung herunter, prüft die Prüfsumme und entpackt sie hierher:
+
+
+
+ Das dauert je nach Anbindung eine halbe bis mehrere Minuten. Adresse und Prüfsumme stehen fest in dieser Datei; ein Archiv mit abweichender Prüfsumme wird nicht entpackt.
+
+
+
+
diff --git a/src/Content/DemoContent.php b/src/Content/DemoContent.php
index a4edccd..f79ce96 100644
--- a/src/Content/DemoContent.php
+++ b/src/Content/DemoContent.php
@@ -129,6 +129,41 @@ final class DemoContent
*
* @return array
*/
+ /**
+ * The start page of a fresh installation - not demo content.
+ *
+ * Short on purpose. Somebody who has just installed should find a page they can edit, not a
+ * brochure about the CMS they have to delete first. Exactly one H1, as every page requires.
+ */
+ public static function starterPage(string $siteName): array
+ {
+ return [
+ 'schemaVersion' => 16,
+ 'title' => $siteName,
+ 'description' => 'NOCH AUSZUFÜLLEN: ein Satz darüber, was es hier gibt. Er erscheint in Suchergebnissen.',
+ 'blocks' => [
+ self::section('start-hero', [
+ self::heading('start-heading', $siteName, 1),
+ self::text('start-intro', 'Diese Seite ist der Anfang. Melde dich an, öffne sie im Editor und ersetze diesen Text durch deinen eigenen.'),
+ ], 'mint'),
+ self::section('start-body', [
+ self::heading('start-next-heading', 'Die nächsten Schritte', 2),
+ self::text('start-next', "Impressum und Datenschutzerklärung sind bereits angelegt und müssen noch ausgefüllt werden – die Pflichtangaben sind darin markiert.\n\nUnter „Design“ legst du Farben, Schriften und die Breite fest, unter „Menüs“ die Navigation, unter „Einstellungen“ den Namen und die Angaben zum Unternehmen."),
+ ], 'paper', 'narrow'),
+ ],
+ ];
+ }
+
+ /** Header and footer of a fresh installation, with the site name instead of a wordmark. */
+ public static function starterAreas(string $siteName): array
+ {
+ $areas = self::areas();
+ $areas['header']['document']['blocks'][0]['children'][0]['children'][0]['children'][0]['props']['text'] = $siteName;
+ $areas['footer']['document']['blocks'][0]['children'][0]['children'][0]['children'][0]['props']['text'] = '© '.date('Y').' '.$siteName;
+
+ return $areas;
+ }
+
public static function areas(): array
{
$row = static fn (string $id, array $children): array => [
diff --git a/src/Controller/InstallController.php b/src/Controller/InstallController.php
new file mode 100644
index 0000000..3247278
--- /dev/null
+++ b/src/Controller/InstallController.php
@@ -0,0 +1,208 @@
+guard();
+ $checks = $this->installation->checks();
+
+ return $this->render('install/check.html.twig', [
+ 'step' => 1,
+ 'checks' => $checks,
+ 'ready' => $this->installation->ready($checks),
+ ]);
+ }
+
+ #[Route('/install/datenbank', name: 'install_database', methods: ['GET', 'POST'], priority: 10)]
+ public function database(Request $request): Response
+ {
+ $this->guard();
+ $error = null;
+ $driver = $request->request->getString('driver', 'sqlite');
+ if ($request->isMethod('POST') && $this->signed($request, 'datenbank')) {
+ $input = [
+ 'host' => $request->request->getString('host', '127.0.0.1'),
+ 'port' => $request->request->getString('port', '3306'),
+ 'name' => $request->request->getString('name', 'cms'),
+ 'user' => $request->request->getString('user'),
+ 'password' => $request->request->getString('password'),
+ ];
+ $result = $this->installation->testDatabase('mysql' === $driver ? 'mysql' : 'sqlite', $input);
+ $error = $result['error'];
+ if (null === $error) {
+ try {
+ $this->installation->writeEnvironment(['APP_ENV' => 'prod', 'APP_DEBUG' => '0', 'DATABASE_URL' => $result['url']]);
+
+ // The new connection only exists in the next request, because the environment
+ // file is read while booting. That is also why this is a redirect and not a
+ // rendered page: the migration screen has to talk to the new database.
+ return $this->redirectToRoute('install_migration');
+ } catch (\RuntimeException $e) {
+ $error = $e->getMessage();
+ }
+ }
+ }
+
+ return $this->render('install/database.html.twig', [
+ 'step' => 2,
+ 'driver' => $driver,
+ 'error' => $error,
+ 'values' => $request->request->all(),
+ 'mysql' => \extension_loaded('pdo_mysql'),
+ 'sqlite' => \extension_loaded('pdo_sqlite'),
+ ...$this->token('datenbank'),
+ ]);
+ }
+
+ #[Route('/install/migration', name: 'install_migration', methods: ['GET', 'POST'], priority: 10)]
+ public function migration(Request $request): Response
+ {
+ $this->guard();
+ if (!$this->installation->environmentWritten()) {
+ return $this->redirectToRoute('install_database');
+ }
+ $error = null;
+ $applied = null;
+ if ($request->isMethod('POST') && $this->signed($request, 'migration')) {
+ @set_time_limit(0);
+ try {
+ $applied = $this->installation->migrate();
+
+ return $this->redirectToRoute('install_website');
+ } catch (\Throwable $e) {
+ $error = $e->getMessage();
+ }
+ }
+
+ return $this->render('install/migration.html.twig', [
+ 'step' => 3,
+ 'pending' => $error ? [] : $this->pending(),
+ 'applied' => $applied,
+ 'error' => $error,
+ ...$this->token('migration'),
+ ]);
+ }
+
+ #[Route('/install/website', name: 'install_website', methods: ['GET', 'POST'], priority: 10)]
+ public function website(Request $request): Response
+ {
+ $this->guard();
+ if (!$this->installation->schemaReady()) {
+ return $this->redirectToRoute('install_migration');
+ }
+ $error = null;
+ if ($request->isMethod('POST') && $this->signed($request, 'website')) {
+ try {
+ $this->installation->createSite(
+ $request->request->getString('name'),
+ $request->request->getString('origin'),
+ $request->request->getString('locale', 'de'),
+ );
+
+ return $this->redirectToRoute('install_account');
+ } catch (InvalidPage|\RuntimeException $e) {
+ $error = $e->getMessage();
+ }
+ }
+
+ return $this->render('install/website.html.twig', [
+ 'step' => 4,
+ 'error' => $error,
+ 'values' => $request->request->all(),
+ // The address the browser is on is almost always the right one, so it is prefilled.
+ 'origin' => $request->getSchemeAndHttpHost(),
+ ...$this->token('website'),
+ ]);
+ }
+
+ #[Route('/install/konto', name: 'install_account', methods: ['GET', 'POST'], priority: 10)]
+ public function account(Request $request): Response
+ {
+ $this->guard();
+ if (!$this->installation->siteReady()) {
+ return $this->redirectToRoute('install_website');
+ }
+ $error = null;
+ if ($request->isMethod('POST') && $this->signed($request, 'konto')) {
+ try {
+ $this->installation->createAdmin(
+ $request->request->getString('username'),
+ $request->request->getString('password'),
+ $request->request->getString('repeat'),
+ );
+
+ // The last screen is rendered here, not after a redirect: one request later this
+ // route is gone, because the account it just created ends the installation.
+ return $this->render('install/done.html.twig', [
+ 'step' => 6,
+ 'username' => strtolower(trim($request->request->getString('username'))),
+ ]);
+ } catch (InvalidPage $e) {
+ $error = $e->getMessage();
+ }
+ }
+
+ return $this->render('install/account.html.twig', [
+ 'step' => 5,
+ 'error' => $error,
+ 'username' => $request->request->getString('username'),
+ ...$this->token('konto'),
+ ]);
+ }
+
+ /** Reading the pending list must never be the reason the screen cannot be shown. */
+ private function pending(): array
+ {
+ try {
+ return $this->installation->pendingMigrations();
+ } catch (\Throwable) {
+ return [];
+ }
+ }
+
+ private function guard(): void
+ {
+ if ($this->installation->isInstalled()) {
+ throw new NotFoundHttpException('Diese Installation ist abgeschlossen.');
+ }
+ }
+
+ private function token(string $step): array
+ {
+ $issued = time();
+
+ return ['issued' => $issued, 'signature' => $this->installation->sign($step, $issued)];
+ }
+
+ private function signed(Request $request, string $step): bool
+ {
+ return $this->installation->verify($step, $request->request->getInt('issued'), $request->request->getString('signature'));
+ }
+}
diff --git a/src/EventSubscriber/InstallSubscriber.php b/src/EventSubscriber/InstallSubscriber.php
new file mode 100644
index 0000000..c8d09da
--- /dev/null
+++ b/src/EventSubscriber/InstallSubscriber.php
@@ -0,0 +1,53 @@
+ ['onRequest', 36]];
+ }
+
+ public function onRequest(RequestEvent $event): void
+ {
+ if (!$event->isMainRequest() || is_file($this->projectDir.'/'.self::MARKER)) {
+ return;
+ }
+ if ($this->installation->isInstalled()) {
+ @file_put_contents($this->projectDir.'/'.self::MARKER, gmdate('c')."\n");
+
+ return;
+ }
+ $path = $event->getRequest()->getPathInfo();
+ if (str_starts_with($path, '/install') || preg_match('#^/(assets/|favicon)#', $path)) {
+ return;
+ }
+ $event->setResponse(new RedirectResponse('/install'));
+ }
+}
diff --git a/src/Ops/Installation.php b/src/Ops/Installation.php
new file mode 100644
index 0000000..0eaf07e
--- /dev/null
+++ b/src/Ops/Installation.php
@@ -0,0 +1,419 @@
+db->fetchOne('SELECT id FROM cms_user LIMIT 1');
+ } catch (\Throwable) {
+ // No database, no table, no installation - all three mean the same here.
+ return false;
+ }
+ }
+
+ /**
+ * The system check, as a list of findings rather than a yes or no.
+ *
+ * Every failing check names the file or path that has to change. A check that is merely
+ * advisable is marked as such, so a missing `proc_open` does not look like a reason to stop.
+ */
+ public function checks(): array
+ {
+ $checks = [];
+ $required = PHP_VERSION_ID >= 80200;
+ $checks[] = $this->check('PHP-Fassung', $required, sprintf('Gefunden: %s. Gebraucht wird mindestens 8.2 – beim Hoster umstellen, meistens im Kundenmenü unter „PHP-Version“.', PHP_VERSION), true, PHP_VERSION);
+
+ foreach (['pdo' => 'Datenbankzugriff', 'ctype' => 'Zeichenprüfungen', 'iconv' => 'Zeichensätze', 'mbstring' => 'Mehrbytetexte', 'json' => 'Dokumente', 'dom' => 'HTML-Verarbeitung', 'session' => 'Anmeldung'] as $extension => $purpose) {
+ $checks[] = $this->check('Erweiterung '.$extension, extension_loaded($extension), sprintf('%s braucht diese Erweiterung. Beim Hoster aktivieren oder in der php.ini eintragen.', $purpose));
+ }
+ $drivers = array_values(array_intersect(['pdo_sqlite', 'pdo_mysql'], get_loaded_extensions()));
+ $checks[] = $this->check('Datenbanktreiber', [] !== $drivers, 'Weder pdo_sqlite noch pdo_mysql ist vorhanden. Ohne einen von beiden gibt es keine Datenbank.', true, implode(', ', $drivers));
+
+ $webp = extension_loaded('gd') && (gd_info()['WebP Support'] ?? false);
+ $checks[] = $this->check('GD mit WebP', $webp, 'Bilder werden beim Hochladen in WebP umgewandelt. Ohne GD mit WebP-Unterstützung schlägt jeder Upload fehl. Der Rest der Website funktioniert.', false);
+ $checks[] = $this->check('ZIP-Erweiterung', class_exists(\ZipArchive::class), 'Wird für Sicherungen als Archiv gebraucht. Ohne sie bleibt die Sicherung ein Verzeichnis.', false);
+ $checks[] = $this->check('proc_open', \function_exists('proc_open') && !\in_array('proc_open', array_map('trim', explode(',', (string) ini_get('disable_functions'))), true), 'Ohne proc_open kann das Update im Browser nicht laufen. Ein Update über das Releasearchiv geht trotzdem.', false);
+
+ foreach ([$this->root => 'Projektstamm (für .env.local)', $this->root.'/var' => 'var/ (Datenbank, Cache, Sicherungen)', $this->mediaDirectory => 'Medienordner'] as $path => $label) {
+ $checks[] = $this->check('Schreibrecht: '.$label, $this->writable($path), sprintf('%s ist nicht beschreibbar. Im FTP-Programm die Rechte auf 0775 setzen (oder 0755, wenn PHP als Eigentümer läuft).', $path), true, $path);
+ }
+
+ // The one check that is about the web server rather than PHP: if the document root is the
+ // project directory, then var/ and .env are reachable over the network.
+ $documentRoot = realpath((string) ($_SERVER['DOCUMENT_ROOT'] ?? ''));
+ $public = realpath($this->root.'/public');
+ $checks[] = $this->check(
+ 'Dokumentenstamm zeigt auf public/',
+ false !== $documentRoot && false !== $public && str_replace('\\', '/', $documentRoot) === str_replace('\\', '/', $public),
+ sprintf('Der Dokumentenstamm ist %s, erwartet wird %s. Sonst sind .env und var/ über das Netz erreichbar. Beim Hoster die Domain auf public/ zeigen lassen.', $documentRoot ?: 'unbekannt', $public ?: $this->root.'/public'),
+ false,
+ $documentRoot ?: null,
+ );
+ $checks[] = $this->check('Geheimnis (APP_SECRET)', '' !== $this->secret && !str_contains($this->secret, 'nicht-gespeichert'), 'Das Geheimnis konnte nicht in .env.local geschrieben werden. Ohne Schreibrecht im Projektstamm bleibt jede Anmeldung nach einem Neustart ungültig.');
+
+ return $checks;
+ }
+
+ /** True when every check that blocks an installation passed. */
+ public function ready(array $checks): bool
+ {
+ return [] === array_filter($checks, static fn (array $check): bool => $check['required'] && !$check['ok']);
+ }
+
+ public function environmentWritten(): bool
+ {
+ return is_file($this->root.'/.env.local') && str_contains((string) file_get_contents($this->root.'/.env.local'), 'DATABASE_URL=');
+ }
+
+ public function schemaReady(): bool
+ {
+ try {
+ $this->db->executeQuery('SELECT 1 FROM cms_user LIMIT 1');
+
+ return true;
+ } catch (\Throwable) {
+ return false;
+ }
+ }
+
+ public function siteReady(): bool
+ {
+ try {
+ return (bool) $this->db->fetchOne('SELECT id FROM website WHERE id = ?', ['default']);
+ } catch (\Throwable) {
+ return false;
+ }
+ }
+
+ /**
+ * Builds a DSN from what the form asked and proves it works before it is written anywhere.
+ *
+ * Returns the error in plain German, or null when the connection stands. A wrong password has
+ * to show up here and not two screens later, when the file is already written.
+ */
+ public function testDatabase(string $driver, array $input): array
+ {
+ $url = 'sqlite' === $driver
+ ? 'sqlite:///%kernel.project_dir%/var/'.$this->sqliteName($input['name'] ?? 'cms')
+ : sprintf(
+ 'mysql://%s:%s@%s:%d/%s?charset=utf8mb4',
+ rawurlencode(trim((string) ($input['user'] ?? ''))),
+ rawurlencode((string) ($input['password'] ?? '')),
+ trim((string) ($input['host'] ?? '127.0.0.1')),
+ (int) ($input['port'] ?? 3306) ?: 3306,
+ rawurlencode(trim((string) ($input['name'] ?? ''))),
+ );
+
+ try {
+ $connection = ConnectionFactory::create($this->resolve($url));
+ $connection->executeQuery('SELECT 1');
+ $connection->close();
+ } catch (\Throwable $e) {
+ return ['url' => $url, 'error' => 'mysql' === $driver
+ ? sprintf('Die Datenbank antwortet nicht: %s. Zugangsdaten stehen im Kundenmenü des Hosters; oft ist der Host nicht localhost, sondern ein eigener Name.', $e->getMessage())
+ : sprintf('Die SQLite-Datei ließ sich nicht anlegen: %s. Meistens fehlt das Schreibrecht auf var/.', $e->getMessage())];
+ }
+
+ return ['url' => $url, 'error' => null];
+ }
+
+ /**
+ * Writes `.env.local`, never `.env`.
+ *
+ * `.env` belongs to the release and is replaced by the next update; `.env.local` belongs to
+ * this installation and survives. Values that are already there stay unless they are given
+ * again, so the website step can add the address without losing the database.
+ */
+ public function writeEnvironment(array $values): void
+ {
+ $file = $this->root.'/.env.local';
+ $lines = [];
+ foreach (is_file($file) ? (preg_split('/\R/', (string) file_get_contents($file)) ?: []) : [] as $line) {
+ if ('' !== trim($line) && 1 === preg_match('/^([A-Z_]+)=/', $line, $match) && !\array_key_exists($match[1], $values)) {
+ $lines[$match[1]] = $line;
+ }
+ }
+ foreach ($values as $key => $value) {
+ $lines[$key] = $key.'="'.str_replace(['\\', '"', "\n"], ['\\\\', '\"', ''], (string) $value).'"';
+ }
+ $content = "# Diese Datei gehört zu dieser Installation und wird von keinem Update überschrieben.\n".implode("\n", $lines)."\n";
+ $temporary = $file.'.'.bin2hex(random_bytes(4));
+ if (false === file_put_contents($temporary, $content) || !rename($temporary, $file)) {
+ @unlink($temporary);
+ throw new \RuntimeException('.env.local ließ sich nicht schreiben. Bitte das Schreibrecht im Projektstamm prüfen.');
+ }
+ @chmod($file, 0o600);
+ }
+
+ /**
+ * Runs the migrations in this process.
+ *
+ * Not over the console: on shared hosting there is often no shell, and `proc_open` is a common
+ * casualty of a hardened php.ini. The installer therefore does what the console command does,
+ * with the same configuration file, and returns the versions it applied.
+ */
+ public function migrate(): array
+ {
+ $factory = DependencyFactory::fromConnection(
+ new PhpFile($this->root.'/migrations.php'),
+ new ExistingConnection($this->db),
+ );
+ $factory->getMetadataStorage()->ensureInitialized();
+ $version = $factory->getVersionAliasResolver()->resolveVersionAlias('latest');
+ $plan = $factory->getMigrationPlanCalculator()->getPlanUntilVersion($version);
+ $configuration = (new MigratorConfiguration())->setAllOrNothing(false)->setTimeAllQueries(false);
+ $factory->getMigrator()->migrate($plan, $configuration);
+
+ return $this->planNames($plan);
+ }
+
+ /** Which migrations would run - the same list the migration screen shows before the button. */
+ public function pendingMigrations(): array
+ {
+ $factory = DependencyFactory::fromConnection(
+ new PhpFile($this->root.'/migrations.php'),
+ new ExistingConnection($this->db),
+ );
+ $factory->getMetadataStorage()->ensureInitialized();
+
+ return $this->planNames($factory->getMigrationPlanCalculator()->getPlanUntilVersion(
+ $factory->getVersionAliasResolver()->resolveVersionAlias('latest'),
+ ));
+ }
+
+ /**
+ * The website: name, address, language - and the content a new site cannot do without.
+ *
+ * A start page, a header and a footer with a menu, and the two legal pages as a skeleton with
+ * every gap marked. The last part is not a courtesy: a German business website without an
+ * imprint and a privacy statement is a problem from its first day, and the installer is the
+ * only moment at which somebody is certainly looking.
+ */
+ public function createSite(string $name, string $origin, string $locale): array
+ {
+ $name = trim($name);
+ if ('' === $name || mb_strlen($name) > 120) {
+ throw new InvalidPage('Bitte gib einen Namen für die Website an (höchstens 120 Zeichen).');
+ }
+ $origin = rtrim(trim($origin), '/');
+ if (!str_starts_with($origin, 'https://') && !str_starts_with($origin, 'http://')) {
+ throw new InvalidPage('Die Adresse beginnt mit https:// – zum Beispiel https://meine-firma.de');
+ }
+ if (false === filter_var($origin, FILTER_VALIDATE_URL)) {
+ throw new InvalidPage('Diese Adresse ist keine gültige URL.');
+ }
+ if (!\in_array($locale, ['de', 'en'], true)) {
+ throw new InvalidPage('Als Sprache stehen Deutsch und Englisch zur Wahl.');
+ }
+
+ $created = [];
+ $this->db->transactional(function () use ($name, $locale, &$created): void {
+ if (!$this->db->fetchOne('SELECT id FROM website WHERE id = ?', ['default'])) {
+ $this->db->insert('website', [
+ 'id' => 'default',
+ 'name' => mb_substr($name, 0, 120),
+ 'default_locale' => $locale,
+ 'theme' => json_encode(['template' => 'kant-starter', 'version' => 1], JSON_THROW_ON_ERROR),
+ ]);
+ } else {
+ $this->db->update('website', ['name' => mb_substr($name, 0, 120), 'default_locale' => $locale], ['id' => 'default']);
+ }
+
+ if (null === $this->pages->findPublished('home', $locale)) {
+ $id = $this->pages->createPage('home', null, 'page', DemoContent::starterPage($name), $locale);
+ $page = $this->pages->findForEditor($id);
+ $this->pages->publish($id, $page['draft_revision_id'], $page['version']);
+ $created[] = 'Startseite';
+ }
+ foreach (DemoContent::LEGAL as $slug => $label) {
+ if (null === $this->pages->findPublished($slug, $locale)) {
+ $id = $this->pages->createPage($slug, null, 'page', DemoContent::legalPage($slug), $locale);
+ $page = $this->pages->findForEditor($id);
+ $this->pages->publish($id, $page['draft_revision_id'], $page['version']);
+ $created[] = $label;
+ }
+ }
+ foreach (DemoContent::starterAreas($name) as $kind => $area) {
+ if (null === $this->partials->findByKind($kind, 'default', $locale)) {
+ $this->partials->create($kind, 'default', $area['name'], $area['document'], $locale);
+ $created[] = $area['name'];
+ }
+ }
+ $this->createMenu($locale, $created);
+ });
+
+ $this->writeEnvironment(['SITE_ORIGIN' => $origin]);
+ $settings = $this->settings->load();
+ $this->settings->save([
+ ...$settings,
+ 'legalName' => $name,
+ 'privacyPath' => 'datenschutz',
+ 'imprintPath' => 'impressum',
+ 'sameAs' => '',
+ 'consentGroups' => $settings['consentGroups'],
+ ]);
+
+ return $created;
+ }
+
+ /**
+ * The first account, and with it the end of the installer.
+ *
+ * The rules are the ones the user administration uses, because an account created here is not
+ * a lesser account - it is the one that can do everything.
+ */
+ public function createAdmin(string $username, string $password, string $repeated): void
+ {
+ $username = strtolower(trim($username));
+ if (1 !== preg_match('/^[a-z0-9][a-z0-9._-]{2,99}$/D', $username)) {
+ throw new InvalidPage('Der Benutzername braucht 3–100 Zeichen: Kleinbuchstaben, Ziffern, Punkt, Unterstrich oder Bindestrich.');
+ }
+ if (\strlen($password) < 14 || \strlen($password) > 72 || str_contains($password, "\0")) {
+ throw new InvalidPage('Das Passwort braucht mindestens 14 Zeichen (höchstens 72 Bytes).');
+ }
+ if (!hash_equals($password, $repeated)) {
+ throw new InvalidPage('Die beiden Passwörter stimmen nicht überein.');
+ }
+ if ($this->isInstalled()) {
+ throw new InvalidPage('Es gibt bereits ein Konto. Die Installation ist damit abgeschlossen.');
+ }
+ $user = new CmsUser(bin2hex(random_bytes(16)), $username, '', ['ROLE_ADMIN']);
+ $this->db->insert('cms_user', [
+ 'id' => $user->id,
+ 'username' => $username,
+ 'password_hash' => $this->hasher->hashPassword($user, $password),
+ 'roles' => json_encode($user->getRoles(), JSON_THROW_ON_ERROR),
+ ]);
+ }
+
+ /**
+ * A signature instead of a session token.
+ *
+ * The session cookie of this application is scoped to `/admin`, so the installer has no
+ * session - and it should not get one for six screens. The signature ties a form to a step and
+ * to a point in time. It is not protection against somebody who can reach the installer: that
+ * protection is that the installer stops existing after the first account, which is why the
+ * last screen says to install right after uploading.
+ */
+ public function sign(string $step, int $issued): string
+ {
+ return hash_hmac('sha256', $step.'|'.$issued, $this->secret);
+ }
+
+ public function verify(string $step, int $issued, string $signature): bool
+ {
+ return abs(time() - $issued) <= self::TOKEN_LIFETIME && hash_equals($this->sign($step, $issued), $signature);
+ }
+
+ private function createMenu(string $locale, array &$created): void
+ {
+ if ([] !== $this->menus->all($locale)) {
+ return;
+ }
+ $items = [];
+ foreach ($this->db->fetchAllAssociative('SELECT id, path FROM page WHERE website_id = ? AND locale = ?', ['default', $locale]) as $page) {
+ if (\in_array($page['path'], ['home', 'datenschutz', 'impressum'], true)) {
+ $items['home' === $page['path'] ? 'header' : 'footer'][] = [
+ 'label' => ['home' => 'Start', 'datenschutz' => 'Datenschutz', 'impressum' => 'Impressum'][$page['path']],
+ 'type' => 'page',
+ 'pageId' => $page['id'],
+ 'anchor' => '',
+ 'children' => [],
+ ];
+ }
+ }
+ foreach (['header', 'footer'] as $slot) {
+ if (isset($items[$slot])) {
+ $this->menus->save($slot, MenuRepository::SLOTS[$slot], $items[$slot], 0, $locale);
+ $created[] = 'header' === $slot ? 'Hauptmenü' : 'Fußmenü';
+ }
+ }
+ }
+
+ private function planNames(MigrationPlanList $plan): array
+ {
+ $names = [];
+ foreach ($plan->getItems() as $item) {
+ $names[] = (string) $item->getVersion();
+ }
+
+ return $names;
+ }
+
+ private function check(string $label, bool $ok, string $hint, bool $required = true, ?string $found = null): array
+ {
+ return ['label' => $label, 'ok' => $ok, 'required' => $required, 'hint' => $hint, 'found' => $found];
+ }
+
+ /** A directory that does not exist yet counts as writable when its parent is. */
+ private function writable(string $path): bool
+ {
+ return is_dir($path) ? is_writable($path) : (is_dir(\dirname($path)) && is_writable(\dirname($path)));
+ }
+
+ private function sqliteName(string $name): string
+ {
+ $name = preg_replace('/[^a-z0-9_-]/', '', strtolower(trim($name))) ?: 'cms';
+
+ return mb_substr($name, 0, 40).'.db';
+ }
+
+ private function resolve(string $url): string
+ {
+ return str_replace('%kernel.project_dir%', str_replace('\\', '/', $this->root), $url);
+ }
+}
diff --git a/templates/install/account.html.twig b/templates/install/account.html.twig
new file mode 100644
index 0000000..5fa3502
--- /dev/null
+++ b/templates/install/account.html.twig
@@ -0,0 +1,25 @@
+{% extends 'install/base.html.twig' %}
+{% block heading %}Dein Zugang{% endblock %}
+{% block lead %}
+Das erste Konto ist ein Administratorkonto: es darf alles, auch weitere Konten anlegen. Mit ihm endet die Installation – danach antwortet /install nicht mehr.
+{% endblock %}
+{% block content %}
+
+{% endblock %}
diff --git a/templates/install/base.html.twig b/templates/install/base.html.twig
new file mode 100644
index 0000000..ed0a62f
--- /dev/null
+++ b/templates/install/base.html.twig
@@ -0,0 +1,25 @@
+{% extends 'admin/base.html.twig' %}
+{% set steps = ['Systemprüfung', 'Datenbank', 'Migration', 'Website', 'Konto', 'Fertig'] %}
+{% block title %}{{ steps[step - 1] }} · Installation{% endblock %}
+{% block body_class %}install-body{% endblock %}
+{% block body %}
+
+ KANTSITES INSTALLIEREN
+
+ {% for index, name in steps %}
+ -
+ {{ index + 1 < step ? '✓' : index + 1 }}
+ {{ name }}{% if index + 1 == step %} – aktueller Schritt{% endif %}
+
+ {% endfor %}
+
+
+
{% block heading %}{% endblock %}
+
+ {% block lead %}{% endblock %}
+ {% if error is defined and error %}
{{ error }}
{% endif %}
+ {% block content %}{% endblock %}
+
+
Geprüft wird, was diese Installation tatsächlich braucht. Jede fehlgeschlagene Prüfung sagt, was zu tun ist – und wo. Punkte ohne Sternchen sind Empfehlungen: ohne sie fehlt eine Funktion, nicht die Website.
+{% endblock %}
+{% block content %}
+
+ {% for check in checks %}
+ -
+ {{ check.ok ? '✓' : (check.required ? '!' : '·') }}
+
+ {{ check.label }}{% if check.required %} *{% endif %}
+ {{ check.ok ? 'erfüllt' : 'nicht erfüllt' }}:
+ {% if check.ok %}{{ check.found ?: 'in Ordnung' }}{% else %}{{ check.hint }}{% endif %}
+
+
+ {% endfor %}
+
+
+
+{% if not ready %}Solange eine Pflichtprüfung fehlschlägt, geht es nicht weiter. Das ist Absicht: eine Installation, die auf halbem Weg scheitert, hinterlässt mehr Arbeit als eine, die gar nicht erst beginnt.
{% endif %}
+{% endblock %}
diff --git a/templates/install/database.html.twig b/templates/install/database.html.twig
new file mode 100644
index 0000000..90549c4
--- /dev/null
+++ b/templates/install/database.html.twig
@@ -0,0 +1,43 @@
+{% extends 'install/base.html.twig' %}
+{% block heading %}Wohin mit den Inhalten?{% endblock %}
+{% block lead %}
+SQLite ist eine Datei auf diesem Server – nichts einzurichten, gut für eine Website mit überschaubarem Verkehr. MySQL brauchst du, wenn der Hoster es vorgibt oder mehrere Websites dieselbe Datenbank nutzen sollen. Die Verbindung wird sofort geprüft, nicht erst beim Speichern.
+{% endblock %}
+{% block content %}
+
+{% endblock %}
diff --git a/templates/install/done.html.twig b/templates/install/done.html.twig
new file mode 100644
index 0000000..627ad75
--- /dev/null
+++ b/templates/install/done.html.twig
@@ -0,0 +1,20 @@
+{% extends 'install/base.html.twig' %}
+{% block heading %}Fertig.{% endblock %}
+{% block lead %}
+Die Installation ist abgeschlossen und /install antwortet ab sofort mit 404. Melde dich als {{ username }} an.
+{% endblock %}
+{% block content %}
+
+
+Was jetzt noch fehlt
+
+ - ·Impressum und Datenschutzerklärung ausfüllen. Beide Seiten sind angelegt und veröffentlicht; die Pflichtangaben stehen als
NOCH AUSZUFÜLLEN darin. Solange sie so dastehen, sind sie eine Baustelle mit Ansage – aber keine Erklärung.
+ - ·Die Datei
install.php löschen, falls du über sie installiert hast. Sie löscht sich selbst, aber nachsehen kostet nichts.
+ - ·Einen täglichen Cronjob einrichten:
php bin/console cms:backup für die Sicherung und php bin/console cms:stats:prune für die Statistik. Ohne Sicherung gibt es keinen Rückweg.
+ - ·HTTPS prüfen. Eine Anmeldung über
http:// überträgt das Passwort im Klartext.
+ - ·Inhalt und Gestaltung: Startseite bearbeiten, unter „Design“ Farben und Schriften setzen, unter „Einstellungen“ die Angaben zum Unternehmen ergänzen.
+
+{% endblock %}
diff --git a/templates/install/migration.html.twig b/templates/install/migration.html.twig
new file mode 100644
index 0000000..bdb751b
--- /dev/null
+++ b/templates/install/migration.html.twig
@@ -0,0 +1,26 @@
+{% extends 'install/base.html.twig' %}
+{% block heading %}Die Tabellen anlegen{% endblock %}
+{% block lead %}
+Die Verbindung steht. Jetzt werden die Migrationen ausgeführt – dieselben, die später ein Update einspielt, und in derselben Reihenfolge. Das läuft in diesem Prozess, ohne Konsole.
+{% endblock %}
+{% block content %}
+{% if pending is not empty %}
+{{ pending|length }} Migration{{ pending|length == 1 ? '' : 'en' }} stehen an:
+
+ {% for name in pending|slice(0, 40) %}
+ - ·
{{ name|split('\\')|last }}
+ {% endfor %}
+
+{% else %}
+Es steht nichts an – entweder ist die Datenbank schon eingerichtet, oder die Liste ließ sich nicht lesen. Der Knopf unten schadet in beiden Fällen nicht: eine bereits angewandte Migration wird nicht wiederholt.
+{% endif %}
+
+
+Dauert das zu lange und bricht der Browser ab, ist das kein Schaden: angewandte Migrationen sind vermerkt, ein erneuter Aufruf macht dort weiter.
+{% endblock %}
diff --git a/templates/install/website.html.twig b/templates/install/website.html.twig
new file mode 100644
index 0000000..89c42d7
--- /dev/null
+++ b/templates/install/website.html.twig
@@ -0,0 +1,28 @@
+{% extends 'install/base.html.twig' %}
+{% block heading %}Deine Website{% endblock %}
+{% block lead %}
+Damit entstehen eine Startseite, Kopf- und Fußbereich mit Menü sowie Impressum und Datenschutzerklärung als Gerüst. Die beiden rechtlichen Seiten sind keine Option – ihr Text ist eine Erklärung über dein Unternehmen, deshalb legt der Installer die Struktur an und markiert jede Stelle, die noch auszufüllen ist.
+{% endblock %}
+{% block content %}
+
+{% endblock %}
diff --git a/tests/InstallFlowTest.php b/tests/InstallFlowTest.php
new file mode 100644
index 0000000..cb4bd70
--- /dev/null
+++ b/tests/InstallFlowTest.php
@@ -0,0 +1,219 @@
+root = sys_get_temp_dir().'/kant-flow-'.bin2hex(random_bytes(6));
+ foreach (['config', 'templates', 'var', 'public'] as $directory) {
+ mkdir($this->root.'/'.$directory, 0o775, true);
+ }
+ // src/ is copied as well, because the service definitions scan that directory. The
+ // classes themselves still come from the autoloader, so this is only a list of files.
+ foreach (['config', 'templates', 'src'] as $directory) {
+ self::copyDirectory(\dirname(__DIR__).'/'.$directory, $this->root.'/'.$directory);
+ }
+ // The migrations are not copied but pointed at: a second copy of the same classes in one
+ // process is a fatal error, and a copied migration would age away from the original.
+ file_put_contents($this->root.'/migrations.php', sprintf(
+ " ['table_name' => 'migration_versions'], 'migrations_paths' => ['DoctrineMigrations' => %s], 'all_or_nothing' => false];",
+ var_export(\dirname(__DIR__).'/migrations', true),
+ ));
+ $this->database = $this->root.'/var/cms.db';
+ }
+
+ protected function tearDown(): void
+ {
+ gc_collect_cycles();
+ self::removeDirectory($this->root);
+ }
+
+ public function testAnEmptyInstallationBecomesAWebsiteInSixSteps(): void
+ {
+ // 0. Whatever is asked for, the answer is the installer. A missing table is not something
+ // to explain with a stack trace.
+ $response = $this->request('/');
+ self::assertSame(302, $response->getStatusCode());
+ self::assertSame('/install', $response->headers->get('Location'));
+
+ // 1. The system check.
+ $check = $this->request('/install');
+ self::assertSame(200, $check->getStatusCode());
+ self::assertStringContainsString('Passt dieser Server?', $check->getContent());
+
+ // 2. The database. SQLite needs nothing but a writable var/.
+ $database = $this->request('/install/datenbank');
+ $response = $this->submit('/install/datenbank', $database, ['driver' => 'sqlite', 'name' => 'cms']);
+ self::assertSame('/install/migration', $response->headers->get('Location'));
+ $environment = (string) file_get_contents($this->root.'/.env.local');
+ self::assertStringContainsString('DATABASE_URL="sqlite:///%kernel.project_dir%/var/cms.db"', $environment);
+ self::assertStringContainsString('APP_ENV="prod"', $environment);
+
+ // 3. The migrations, in this process, without a console.
+ $migration = $this->request('/install/migration');
+ self::assertStringContainsString('Migration', $migration->getContent());
+ $response = $this->submit('/install/migration', $migration, []);
+ self::assertSame('/install/website', $response->headers->get('Location'));
+ self::assertNotEmpty($this->connection()->fetchAllAssociative('SELECT version FROM migration_versions'));
+
+ // 4. The website, and with it the content a site cannot go live without.
+ $website = $this->request('/install/website');
+ $response = $this->submit('/install/website', $website, ['name' => 'Beispiel GmbH', 'origin' => 'https://beispiel.de', 'locale' => 'de']);
+ self::assertSame('/install/konto', $response->headers->get('Location'));
+ self::assertSame(3, (int) $this->connection()->fetchOne('SELECT COUNT(*) FROM page'), 'Startseite, Impressum, Datenschutz.');
+
+ // 5. The first account - and the last screen, rendered straight away, because one request
+ // later this route no longer exists.
+ $account = $this->request('/install/konto');
+ $done = $this->submit('/install/konto', $account, ['username' => 'chefin', 'password' => 'ein sehr langes passwort', 'repeat' => 'ein sehr langes passwort']);
+ self::assertSame(200, $done->getStatusCode());
+ self::assertStringContainsString('Fertig.', $done->getContent());
+ self::assertStringContainsString('Impressum und Datenschutzerklärung ausfüllen', $done->getContent());
+
+ // 6. The installer is over, and the website answers.
+ self::assertSame(404, $this->request('/install')->getStatusCode());
+ self::assertSame(404, $this->request('/install/konto')->getStatusCode());
+ $home = $this->request('/');
+ self::assertSame(200, $home->getStatusCode());
+ self::assertStringContainsString('Beispiel GmbH', $home->getContent());
+ self::assertStringContainsString('Diese Seite ist der Anfang.', $home->getContent());
+ // The public page is still a public page: no script, and the header carries the name.
+ self::assertStringContainsString("script-src 'none'", (string) $home->headers->get('Content-Security-Policy'));
+ self::assertSame(200, $this->request('/impressum')->getStatusCode());
+ self::assertSame(200, $this->request('/admin/login')->getStatusCode());
+ }
+
+ public function testAStepWithoutItsRequirementSendsYouBack(): void
+ {
+ // Somebody who guesses the address of a later step does not get past the missing database.
+ self::assertSame('/install/datenbank', $this->request('/install/migration')->headers->get('Location'));
+ self::assertSame('/install/migration', $this->request('/install/website')->headers->get('Location'));
+ self::assertSame('/install/website', $this->request('/install/konto')->headers->get('Location'));
+
+ // And a form without a valid signature changes nothing: the page comes back, unchanged.
+ $response = $this->request('/install/datenbank', 'POST', ['driver' => 'sqlite', 'name' => 'cms', 'issued' => time(), 'signature' => 'erfunden']);
+ self::assertSame(200, $response->getStatusCode());
+ self::assertFileDoesNotExist($this->root.'/.env.local');
+ }
+
+ /** Posts a form with the signature the rendered page carries, the way a browser would. */
+ private function submit(string $url, Response $page, array $fields): Response
+ {
+ preg_match('/name="issued" value="(\d+)"/', (string) $page->getContent(), $issued);
+ preg_match('/name="signature" value="([a-f0-9]{64})"/', (string) $page->getContent(), $signature);
+ self::assertNotEmpty($issued, 'Das Formular trägt einen Zeitpunkt.');
+ self::assertNotEmpty($signature, 'Das Formular trägt eine Unterschrift.');
+
+ return $this->request($url, 'POST', [...$fields, 'issued' => $issued[1], 'signature' => $signature[1]]);
+ }
+
+ private function request(string $url, string $method = 'GET', array $body = []): Response
+ {
+ $previous = [];
+ foreach ([
+ 'APP_SECRET' => 'test-only',
+ 'DATABASE_URL' => 'sqlite:///'.str_replace('\\', '/', $this->database),
+ 'SITE_ORIGIN' => 'https://beispiel.de',
+ 'MEDIA_DIRECTORY' => $this->root.'/var/media',
+ ] as $key => $value) {
+ $previous[$key] = [$_SERVER[$key] ?? null, $_ENV[$key] ?? null];
+ $_SERVER[$key] = $_ENV[$key] = $value;
+ }
+ $kernel = new InstallTestKernel($this->root);
+ try {
+ $request = Request::create($url, $method, $body);
+ $response = $kernel->handle($request);
+ $kernel->terminate($request, $response);
+
+ return $response;
+ } finally {
+ $kernel->shutdown();
+ foreach ($previous as $key => [$server, $environment]) {
+ unset($_SERVER[$key], $_ENV[$key]);
+ if (null !== $server) {
+ $_SERVER[$key] = $server;
+ }
+ if (null !== $environment) {
+ $_ENV[$key] = $environment;
+ }
+ }
+ }
+ }
+
+ private function connection(): Connection
+ {
+ return ConnectionFactory::create('sqlite:///'.str_replace('\\', '/', $this->database));
+ }
+
+ private static function copyDirectory(string $from, string $to): void
+ {
+ @mkdir($to, 0o775, true);
+ foreach (scandir($from) ?: [] as $entry) {
+ if ('.' === $entry || '..' === $entry) {
+ continue;
+ }
+ is_dir($from.'/'.$entry)
+ ? self::copyDirectory($from.'/'.$entry, $to.'/'.$entry)
+ : copy($from.'/'.$entry, $to.'/'.$entry);
+ }
+ }
+
+ private static function removeDirectory(string $path): void
+ {
+ if (!is_dir($path)) {
+ return;
+ }
+ foreach (scandir($path) ?: [] as $entry) {
+ if ('.' !== $entry && '..' !== $entry) {
+ is_dir($path.'/'.$entry) ? self::removeDirectory($path.'/'.$entry) : @unlink($path.'/'.$entry);
+ }
+ }
+ @rmdir($path);
+ }
+}
+
+/** A kernel that lives in a throwaway directory, so the installer writes there and not here. */
+final class InstallTestKernel extends Kernel
+{
+ public function __construct(private string $projectDir)
+ {
+ parent::__construct('test', false);
+ }
+
+ public function getProjectDir(): string
+ {
+ return $this->projectDir;
+ }
+
+ public function getCacheDir(): string
+ {
+ return $this->projectDir.'/var/cache';
+ }
+
+ public function getLogDir(): string
+ {
+ return $this->projectDir.'/var/log';
+ }
+}
diff --git a/tests/InstallationTest.php b/tests/InstallationTest.php
new file mode 100644
index 0000000..851715e
--- /dev/null
+++ b/tests/InstallationTest.php
@@ -0,0 +1,249 @@
+root = sys_get_temp_dir().'/kant-install-'.bin2hex(random_bytes(6));
+ mkdir($this->root.'/var', 0o775, true);
+ mkdir($this->root.'/public', 0o775, true);
+ // The same migration configuration a real installation has, pointing at the real
+ // migrations: a copy of the list would drift away from it within a week.
+ file_put_contents($this->root.'/migrations.php', sprintf(
+ " ['table_name' => 'migration_versions'], 'migrations_paths' => ['DoctrineMigrations' => %s], 'all_or_nothing' => false];",
+ var_export(\dirname(__DIR__).'/migrations', true),
+ ));
+ $this->db = ConnectionFactory::create('sqlite:///'.str_replace('\\', '/', $this->root).'/var/cms.db');
+ $this->installation = $this->make();
+ }
+
+ protected function tearDown(): void
+ {
+ $this->db->close();
+ gc_collect_cycles();
+ $this->removeDirectory($this->root);
+ }
+
+ public function testAnEmptyInstallationIsNotInstalledAndSaysWhatIsMissing(): void
+ {
+ // No database, no tables, no account: the installer has to survive all three, because it
+ // is the only screen that exists at that moment.
+ self::assertFalse($this->installation->isInstalled());
+ self::assertFalse($this->installation->schemaReady());
+ self::assertFalse($this->installation->siteReady());
+ self::assertFalse($this->installation->environmentWritten());
+
+ $checks = $this->installation->checks();
+ $labels = array_column($checks, 'label');
+ self::assertContains('PHP-Fassung', $labels);
+ self::assertContains('Datenbanktreiber', $labels);
+ foreach ($checks as $check) {
+ // A failing check without a sentence about what to do is a dead end.
+ self::assertNotSame('', $check['hint'], $check['label'].' braucht einen Hinweis.');
+ }
+ // The document root of a test process is not public/, so this check has to fail - and it
+ // has to fail without blocking, because a wrong document root is the server's business.
+ $documentRoot = self::findCheck($checks, 'Dokumentenstamm zeigt auf public/');
+ self::assertFalse($documentRoot['ok']);
+ self::assertFalse($documentRoot['required']);
+ }
+
+ public function testTheDatabaseStepProvesTheConnectionBeforeItWritesAnything(): void
+ {
+ $good = $this->installation->testDatabase('sqlite', ['name' => 'cms']);
+ self::assertNull($good['error']);
+ self::assertSame('sqlite:///%kernel.project_dir%/var/cms.db', $good['url']);
+
+ // A MySQL host that does not answer must fail here and not two screens later.
+ $bad = $this->installation->testDatabase('mysql', ['host' => '127.0.0.1', 'port' => '1', 'name' => 'x', 'user' => 'y', 'password' => 'z']);
+ self::assertNotNull($bad['error']);
+ self::assertStringNotContainsString('geheimespasswort', $this->installation->testDatabase('mysql', ['host' => '127.0.0.1', 'port' => '1', 'name' => 'x', 'user' => 'y', 'password' => 'geheimespasswort'])['error'], 'Das Passwort gehört in keine Fehlermeldung.');
+ self::assertFalse(is_file($this->root.'/.env.local'), 'Eine gescheiterte Prüfung schreibt nichts.');
+ }
+
+ public function testTheEnvironmentFileKeepsWhatIsAlreadyThere(): void
+ {
+ $this->installation->writeEnvironment(['APP_SECRET' => 'geheim', 'DATABASE_URL' => 'sqlite:///x.db']);
+ self::assertTrue($this->installation->environmentWritten());
+
+ // The website step adds the address later and must not lose the database doing it.
+ $this->installation->writeEnvironment(['SITE_ORIGIN' => 'https://example.de']);
+ $content = (string) file_get_contents($this->root.'/.env.local');
+ self::assertStringContainsString('APP_SECRET="geheim"', $content);
+ self::assertStringContainsString('DATABASE_URL="sqlite:///x.db"', $content);
+ self::assertStringContainsString('SITE_ORIGIN="https://example.de"', $content);
+ self::assertSame(1, substr_count($content, 'DATABASE_URL='), 'Kein Wert steht doppelt in der Datei.');
+ }
+
+ public function testTheWholeInstallationRunsThroughAndThenLocksItself(): void
+ {
+ $pending = $this->installation->pendingMigrations();
+ self::assertNotEmpty($pending, 'Eine leere Datenbank hat ausstehende Migrationen.');
+
+ $applied = $this->installation->migrate();
+ self::assertSame(\count($pending), \count($applied));
+ self::assertTrue($this->installation->schemaReady());
+ // Running again is allowed and does nothing: a browser that timed out is not a problem.
+ self::assertSame([], $this->installation->migrate());
+
+ $created = $this->installation->createSite('Beispiel GmbH', 'https://beispiel.de/', 'de');
+ self::assertTrue($this->installation->siteReady());
+ self::assertContains('Startseite', $created);
+ self::assertContains('Impressum', $created);
+ self::assertContains('Datenschutzerklärung', $created);
+
+ // The start page is published, not a draft: a fresh installation that answers 404 at its
+ // own address would look broken.
+ $home = $this->make()->isInstalled();
+ self::assertFalse($home, 'Ohne Konto gilt die Installation als unfertig.');
+ $pages = new PageRepository($this->db, new DocumentValidator(), new SiteSettings($this->db));
+ self::assertNotNull($pages->findPublished('home'));
+ self::assertNotNull($pages->findPublished('impressum'));
+ self::assertSame('https://beispiel.de', $this->settingsOrigin());
+
+ // The legal pages are linked, otherwise the consent gate and the footer stay empty.
+ $settings = (new SiteSettings($this->db))->load();
+ self::assertSame('datenschutz', $settings['privacyPath']);
+ self::assertSame('impressum', $settings['imprintPath']);
+ self::assertSame('Beispiel GmbH', $settings['legalName']);
+
+ // Running the website step twice creates nothing twice.
+ self::assertSame([], $this->installation->createSite('Beispiel GmbH', 'https://beispiel.de', 'de'));
+
+ $this->installation->createAdmin('chefin', 'ein sehr langes passwort', 'ein sehr langes passwort');
+ self::assertTrue($this->installation->isInstalled(), 'Mit dem ersten Konto ist die Installation vorbei.');
+
+ $row = $this->db->fetchAssociative('SELECT username, password_hash, roles FROM cms_user');
+ self::assertSame('chefin', $row['username']);
+ self::assertStringNotContainsString('passwort', $row['password_hash'], 'Das Passwort steht nirgends im Klartext.');
+ self::assertSame(['ROLE_ADMIN'], json_decode($row['roles'], true));
+ self::assertTrue(
+ (new UserPasswordHasher(new PasswordHasherFactory([CmsUser::class => ['algorithm' => 'auto']])))
+ ->isPasswordValid(new CmsUser('x', 'chefin', $row['password_hash'], ['ROLE_ADMIN']), 'ein sehr langes passwort'),
+ );
+
+ // And the second account is refused, because that is what "the installer is over" means.
+ $this->expectException(InvalidPage::class);
+ $this->installation->createAdmin('zweite', 'noch ein langes passwort', 'noch ein langes passwort');
+ }
+
+ #[DataProvider('badAccounts')]
+ public function testAnAccountWithWeakInputIsRefused(string $username, string $password, string $repeat): void
+ {
+ $this->installation->migrate();
+ $this->expectException(InvalidPage::class);
+ $this->installation->createAdmin($username, $password, $repeat);
+ }
+
+ public static function badAccounts(): iterable
+ {
+ yield 'zu kurzer Name' => ['ab', 'ein sehr langes passwort', 'ein sehr langes passwort'];
+ yield 'Leerzeichen im Namen' => ['die chefin', 'ein sehr langes passwort', 'ein sehr langes passwort'];
+ yield 'zu kurzes Passwort' => ['chefin', 'kurz', 'kurz'];
+ yield 'Tippfehler bei der Wiederholung' => ['chefin', 'ein sehr langes passwort', 'ein sehr langes passwortt'];
+ }
+
+ #[DataProvider('badSites')]
+ public function testAWebsiteWithBadInputIsRefused(string $name, string $origin, string $locale): void
+ {
+ $this->installation->migrate();
+ $this->expectException(InvalidPage::class);
+ $this->installation->createSite($name, $origin, $locale);
+ }
+
+ public static function badSites(): iterable
+ {
+ yield 'ohne Namen' => ['', 'https://beispiel.de', 'de'];
+ yield 'Adresse ohne Schema' => ['Beispiel', 'beispiel.de', 'de'];
+ yield 'keine Adresse' => ['Beispiel', 'https://', 'de'];
+ yield 'unbekannte Sprache' => ['Beispiel', 'https://beispiel.de', 'kl'];
+ }
+
+ public function testAFormFromAnotherStepOrAnotherDayDoesNotCount(): void
+ {
+ $issued = time();
+ $signature = $this->installation->sign('website', $issued);
+ self::assertTrue($this->installation->verify('website', $issued, $signature));
+ self::assertFalse($this->installation->verify('konto', $issued, $signature), 'Eine Unterschrift gilt für einen Schritt.');
+ self::assertFalse($this->installation->verify('website', $issued - Installation::TOKEN_LIFETIME - 60, $signature));
+ self::assertFalse($this->installation->verify('website', $issued, 'falsch'));
+ }
+
+ private function make(): Installation
+ {
+ $settings = new SiteSettings($this->db);
+ $validator = new DocumentValidator();
+
+ return new Installation(
+ $this->db,
+ new PageRepository($this->db, $validator, $settings),
+ new PartialRepository($this->db, $validator),
+ new MenuRepository($this->db, $settings),
+ $settings,
+ new UserPasswordHasher(new PasswordHasherFactory([CmsUser::class => ['algorithm' => 'auto']])),
+ $this->root,
+ $this->root.'/var/media',
+ 'ein-test-geheimnis',
+ );
+ }
+
+ private function settingsOrigin(): string
+ {
+ preg_match('/SITE_ORIGIN="([^"]*)"/', (string) file_get_contents($this->root.'/.env.local'), $match);
+
+ return $match[1] ?? '';
+ }
+
+ private static function findCheck(array $checks, string $label): array
+ {
+ foreach ($checks as $check) {
+ if ($check['label'] === $label) {
+ return $check;
+ }
+ }
+ self::fail('Prüfung fehlt: '.$label);
+ }
+
+ private function removeDirectory(string $path): void
+ {
+ if (!is_dir($path)) {
+ return;
+ }
+ foreach (scandir($path) ?: [] as $entry) {
+ if ('.' !== $entry && '..' !== $entry) {
+ is_dir($path.'/'.$entry) ? $this->removeDirectory($path.'/'.$entry) : @unlink($path.'/'.$entry);
+ }
+ }
+ @rmdir($path);
+ }
+}
diff --git a/tests/SingleFileInstallerTest.php b/tests/SingleFileInstallerTest.php
new file mode 100644
index 0000000..ab23686
--- /dev/null
+++ b/tests/SingleFileInstallerTest.php
@@ -0,0 +1,140 @@
+target = sys_get_temp_dir().'/kant-zip-'.bin2hex(random_bytes(6));
+ mkdir($this->target, 0o775, true);
+ }
+
+ protected function tearDown(): void
+ {
+ foreach (glob($this->target.'/*') ?: [] as $entry) {
+ is_dir($entry) ? self::removeDirectory($entry) : @unlink($entry);
+ }
+ @rmdir($this->target);
+ }
+
+ public function testTheVersionFolderIsStrippedAndTheTargetIsRespected(): void
+ {
+ $target = str_replace('\\', '/', $this->target);
+ self::assertSame($target.'/public/index.php', kant_target_path('kantsites-1.2.0/public/index.php', $this->target));
+ // Without the version folder the entry is taken as it is.
+ self::assertSame($target.'/bin/console', kant_target_path('bin/console', $this->target));
+ }
+
+ /**
+ * @param string $entry the archive entry a manipulated archive could contain
+ */
+ #[\PHPUnit\Framework\Attributes\DataProvider('dangerousEntries')]
+ public function testNothingLandsOutsideTheTargetDirectory(string $entry): void
+ {
+ self::assertNull(kant_target_path($entry, $this->target), $entry.' darf nirgends landen.');
+ }
+
+ public static function dangerousEntries(): iterable
+ {
+ yield 'zwei Ebenen nach oben' => ['kantsites-1.2.0/../../.env'];
+ yield 'direkt nach oben' => ['../evil.php'];
+ yield 'mitten im Pfad' => ['kantsites-1.2.0/src/../../../evil.php'];
+ yield 'absolut' => ['/etc/passwd'];
+ yield 'Windows-Laufwerk' => ['C:/Windows/evil.php'];
+ yield 'Rückwärtsschrägstrich' => ['kantsites-1.2.0\\..\\..\\evil.php'];
+ yield 'Nullbyte' => ["kantsites-1.2.0/src/evil\0.php"];
+ yield 'nur das Verzeichnis' => ['kantsites-1.2.0/'];
+ yield 'leer' => [''];
+ }
+
+ public function testAnOrdinaryArchiveIsUnpackedAndAManipulatedOneIsNot(): void
+ {
+ $good = $this->archive(['kantsites-1.2.0/public/index.php' => ' 'x']);
+ self::assertSame(2, kant_unpack($good, $this->target));
+ self::assertSame('target.'/public/index.php'));
+ self::assertFileExists($this->target.'/src/Kernel.php');
+
+ // An archive with an entry that points outside is refused - and the refusal happens while
+ // unpacking, so what matters is that the file outside never appears.
+ $evil = $this->archive(['kantsites-1.2.0/harmlos.txt' => 'ok', 'kantsites-1.2.0/../entwischt.txt' => 'böse']);
+ try {
+ kant_unpack($evil, $this->target);
+ self::fail('Ein Eintrag außerhalb des Ziels muss zum Abbruch führen.');
+ } catch (\RuntimeException $e) {
+ self::assertStringContainsString('außerhalb', $e->getMessage());
+ }
+ self::assertFileDoesNotExist(\dirname($this->target).'/entwischt.txt');
+ }
+
+ public function testThePreflightNamesWhatIsMissing(): void
+ {
+ $checks = kant_checks($this->target);
+ $labels = array_column($checks, 'label');
+ self::assertContains('ZIP-Erweiterung', $labels);
+ self::assertContains('Schreibrecht im Zielverzeichnis', $labels);
+
+ // This copy comes from the repository, not from a release: no address, no checksum, and
+ // it says so instead of downloading something.
+ $unfinished = self::find($checks, 'Adresse und Prüfsumme eingetragen');
+ self::assertFalse($unfinished['ok']);
+
+ // An existing installation is not overwritten, not even partially.
+ mkdir($this->target.'/public', 0o775, true);
+ file_put_contents($this->target.'/public/index.php', 'x');
+ self::assertFalse(self::find(kant_checks($this->target), 'Verzeichnis ist leer genug')['ok']);
+ }
+
+ private function archive(array $entries): string
+ {
+ $path = $this->target.'/../kant-archive-'.bin2hex(random_bytes(4)).'.zip';
+ $zip = new \ZipArchive();
+ $zip->open($path, \ZipArchive::CREATE | \ZipArchive::OVERWRITE);
+ foreach ($entries as $name => $content) {
+ $zip->addFromString($name, $content);
+ }
+ $zip->close();
+ self::assertFileExists($path);
+ register_shutdown_function(static fn () => @unlink($path));
+
+ return $path;
+ }
+
+ private static function find(array $checks, string $label): array
+ {
+ foreach ($checks as $check) {
+ if ($check['label'] === $label) {
+ return $check;
+ }
+ }
+ self::fail('Prüfung fehlt: '.$label);
+ }
+
+ private static function removeDirectory(string $path): void
+ {
+ foreach (scandir($path) ?: [] as $entry) {
+ if ('.' !== $entry && '..' !== $entry) {
+ is_dir($path.'/'.$entry) ? self::removeDirectory($path.'/'.$entry) : @unlink($path.'/'.$entry);
+ }
+ }
+ @rmdir($path);
+ }
+}