Lewati ke isi

8. Cross-cutting concepts

Configuration

Configuration is layered:

  1. system defaults;
  2. new-area defaults;
  3. installation config.inc.php;
  4. optional site-specific configuration; and
  5. database values for existing areas and rooms.

Internal configuration validates combinations and maps selected legacy variables to current equivalents.

Identity and authorization

Session and authentication are separate strategies. Page-level authorization establishes a minimum access level, while booking and resource workflows apply ownership, administrator, privacy, and policy rules.

Security checks must remain server-side even where the UI hides an action.

Persistence and transactions

MySQL and PostgreSQL adapters normalize database differences. Booking workflows must treat conflict checks and writes as one integrity-sensitive operation. Table names include an installation-defined prefix.

The central entities are:

erDiagram
  AREA ||--o{ ROOM : contains
  ROOM ||--o{ ENTRY : hosts
  ROOM ||--o{ REPEAT : hosts
  REPEAT o|--o{ ENTRY : generates
  ENTRY ||--o{ PARTICIPANT : has
  USER ||--o{ ENTRY : creates

variables, zoneinfo, and sessions support schema state, timezone data, and optional session persistence.

Time and recurrence

MRBS stores and compares instants while displaying dates and times according to room, area, and locale context. Daylight-saving transitions and recurring rules make timezone selection an integrity concern, not only presentation.

Internationalisation

Language catalogues supply user-facing vocabulary. MRBS\Language and MRBS\Intl encapsulate locale selection, formatting, collation, and fallbacks when optional PHP extensions are unavailable.

Error handling and logging

Central error infrastructure maps PHP and application failures to browser-safe responses and server logs. Integration debug modes are opt-in because they can expose sensitive context.

Mail

Application workflows enqueue messages and the queue flushes during request shutdown. Backend selection, recipients, privacy of message detail, and transport security are configuration concerns.

Security

Input must be validated for its target context:

  • SQL through parameters and database abstractions;
  • HTML and JavaScript through context-specific escaping;
  • redirect targets through allowlisting and normalization;
  • uploaded and remote imports through type and destination restrictions; and
  • commands through strict argument construction.

Backward compatibility

Configuration and schema upgrade code preserve long-lived installations. Compatibility behavior should have an explicit removal condition to prevent permanent accumulation.