Expand TUI gate panels

Author: theokeist

README.md

@@ -15,6 +15,15 @@ Open: `http://127.0.0.1:8000`
 ## Documentation
 
 - Main docs: `docs/README.md`
+- CLI guide: `docs/CLI.md`
+- Routing & pipelines: `docs/ROUTING.md`
+- Error handling: `docs/ERROR_HANDLING.md`
+- Flash messages: `docs/FLASH.md`
+- Authentication: `docs/AUTH.md`
+- Database layer: `docs/DATABASE.md`
+- Workers: `docs/WORKERS.md`
+- HTTP helpers: `docs/HTTP.md`
+- Changelog: `docs/CHANGELOG.md`
 - Architecture overview: `docs/ARCHITECTURE.md`
 - Per-file reference: `docs/reference/`
 - Codex / AI contributor notes: `docs/CODEX.md`

composer.json

@@ -19,6 +19,7 @@
     "ext-pdo": "*",
     "ext-json": "*",
     "ext-mbstring": "*",
+    "psr/log": "^3.0",
     "vlucas/phpdotenv": "^5.6"
   },
   "require-dev": {

config/app.php

@@ -3,6 +3,9 @@
 return [
     'env' => env('APP_ENV', 'local'),
     'debug' => env('APP_DEBUG', true),
+    'log_level' => env('APP_LOG_LEVEL', 'error'),
+    'request_id_header' => env('APP_REQUEST_ID_HEADER', 'X-Request-Id'),
+    'debug_toolbar' => env('APP_DEBUG_TOOLBAR', false),
     // Phoenix analogue: secret_key_base. Required for signed cookies/sessions.
     'secret_key_base' => env('APP_KEY', 'change-me-in-.env'),
     // Phoenix analogue: Endpoint module that defines pipelines/scopes/routes.

config/auth.php

@@ -0,0 +1,5 @@
+<?php
+
+return [
+    'remember_cookie' => env('AUTH_REMEMBER_COOKIE', 'pipeflow_remember'),
+];

docs/ARCHITECTURE.md

@@ -7,13 +7,44 @@ PipeFlow is structured to keep the "pipeline" idea central:
 - **App composition**: `Foundation\Application` owns config, container bindings, router instance, view engine, and DB.
 - **Scaffolding**: `pipeflow` CLI generates controllers/models/migrations using the `stubs/` templates.
 
+### Currying note (functional style)
+
+Many pipeline-friendly functions can be written in a curried style so they compose
+cleanly in `pipe()` or `|>` chains. Prefer small functions that return closures
+when you need configuration first, then data:
+
+```php
+$trim = fn(int $length) => fn(string $value) => mb_substr($value, 0, $length);
+$result = pipe('hello world', $trim(5), fn($s) => strtoupper($s));
+```
+
 ## Where to start
 
 - Web entry: `public/index.php`
 - App bootstrap: `bootstrap/app.php`
 - Routes: `routes/web.php`
 - CLI: `pipeflow`
 
+## Router pipelines (Phoenix-style) status
+
+PipeFlow already supports a Phoenix-inspired request flow using `Conn` + plugs/pipelines,
+but the routing and pipeline DSL is **not yet Phoenix-complete**. The current scope is
+intentionally minimal, so keep these gaps in mind:
+
+- **Nested scopes with inherited pipelines** (predictable merge rules are not implemented).
+- **Route naming + reverse routing helpers** (e.g., `route('post.show', ['id' => 1])`).
+- **404/405 handling with content negotiation** (HTML vs JSON responses).
+
+For routing overview and current behavior, see `docs/ROUTING.md`.
+
+## Error handling & diagnostics
+
+The kernel captures uncaught exceptions and delegates to `ExceptionHandler`, which
+returns HTML error pages for browser requests and JSON problem details for API calls.
+Logging and request-id correlation are built in, and a debug toolbar hook is available.
+
+See `docs/ERROR_HANDLING.md` for details.
+
 ## Middleware vs Plugs (Pipes) and runtime modes
 
 PipeFlow supports two ways to run logic before/after your route handler:

docs/AUTH.md

@@ -0,0 +1,69 @@
+# Authentication & Authorization
+
+PipeFlow includes a minimal authentication layer built on plugs and a user provider.
+The goal is to make it easy to assign a `current_user` and authorize actions without
+locking you into a storage strategy.
+
+## Auth plug (current_user)
+
+The `AuthPlug` reads the user id from the session and assigns it to the connection:
+
+- `assigns['current_user']`
+- `private['current_user']`
+
+Enable it by keeping `AuthPlug` in the global plug list (default).
+
+## User provider
+
+Implement `PipeFlow\Auth\UserProviderInterface` to fetch and validate users. The
+provider is bound into the container, so you can swap in your own implementation:
+
+```php
+app(PipeFlow\Foundation\Container::class)->instance(
+    PipeFlow\Auth\UserProviderInterface::class,
+    new App\Auth\DbUserProvider()
+);
+```
+
+Required methods:
+- `findById($id)`
+- `findByCredentials(array $credentials)`
+- `validateCredentials($user, array $credentials)`
+- `getUserId($user)`
+
+## Auth manager
+
+`PipeFlow\Auth\AuthManager` offers convenience APIs:
+
+- `attempt($conn, $credentials, $remember = false)`
+- `login($conn, $user, $remember = false)`
+- `logout($conn)`
+- `userFromSession($conn)`
+
+## Password hashing
+
+Use `PipeFlow\Security\PasswordHasher` for hashing/verifying:
+
+```php
+$hash = app(PipeFlow\Security\PasswordHasher::class)->hash($password);
+$isValid = app(PipeFlow\Security\PasswordHasher::class)->verify($password, $hash);
+```
+
+## Authorization (gates)
+
+`PipeFlow\Auth\AuthorizationGate` is a lightweight policy registry:
+
+```php
+$gate = app(PipeFlow\Auth\AuthorizationGate::class);
+$gate->define('posts.update', fn($user, $post) => $user->id === $post->user_id);
+```
+
+In views/templates, use `can()` to check abilities.
+
+## Remember-me (optional)
+
+`AuthManager` can set a remember cookie when `remember=true`. For a production system
+back this with a secure token store and rotation policy.
+
+Configuration:
+- `AUTH_REMEMBER_COOKIE` (default: `pipeflow_remember`)

docs/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable documentation changes are recorded here. This project follows a simplified
+"keep a changelog" format without strict versioning.
+
+## Unreleased
+
+### Added
+- Central exception handling with HTML/JSON responses and environment-aware diagnostics.
+- PSR-3 logging integration with request ID correlation.
+- Optional debug toolbar hook and error-handling guide.
+- Flash message helpers and optional flash partial documentation.
+- Functional currying guidance in architecture notes.
+- Phoenix-style Result helpers for ok/error flows.
+- Documented Result metadata conventions for UI/diagnostics.
+- Authentication plug, auth manager, gates, and password hashing utilities.
+- Database safety improvements, transactions, and model casting/validation.
+- Long-lived worker checklist and per-request cleanup hooks.
+- Boot-once helper for warming config/routes/views.
+- Additional CLI scaffolds (crud, plug, channel, test, factory, fixture).
+- HTTP header/cookie helpers and security/static plugs.
+- Typed route parameters with built-in patterns (including `slug`) for routing.
+- Routing guide section describing typed parameters and constraints.
+- Routing & pipelines guide (`docs/ROUTING.md`) with current behavior and known gaps.
+- Router pipeline status section in architecture notes.
+- Clickable reference index and per-file summaries in generated docs.
+- CLI guide with beginner walkthrough and command reference.