История коммитов

Controllers are container singletons, so a Request injected into the constructor outlives the request it belongs to. Every downloads controller now takes it as the first action argument; private handlers receive it as a parameter, and DownloadPathController forwards it to the controllers it delegates to.

Fixes ImportFileController::handleImport(), which read $category from the caller's scope: a successful import failed with a TypeError in getCategoryUrl(). The helper now takes the category as a parameter, and the matching PHPStan baseline entry is gone.

Controllers are container singletons, so a Request injected into the constructor outlives the request it belongs to. Every admin controller now takes it as the first action argument; private helpers such as isCsrfValid() receive it as a parameter.

Controllers are container singletons, so a Request injected into the constructor outlives the request it belongs to. Every forum controller now takes it as the first action argument; private helpers receive it as a parameter.

ForumUtils::topicLink() no longer resolves the request from the container: it needs the host only, which the caller now passes as a string.

The shared Session facade now implements ResetInterface, so the kernel drops the bags
of the request it has served before serving the next one. An open session belongs to
the request being served (the FPM boot opens it before the kernel runs) and is left
alone.

Session::save() moves into the finally block of Kernel::handle(): a cycle that throws
no longer leaves its session open for the next one, which is what lets an open session
be read as the current request's.

Also: the console application implements ResetInterface, so the instanceof rule tagged
it as resettable and every HTTP request built the whole CLI application just to reset
it. Its definition now sits before that rule, guarded by a container test.

Introduce Johncms\Security\ClientInfoDTO and Environment::getClientInfo(): controllers
take the visitor address and user agent and hand them down, so use cases and forms no
longer depend on the HTTP-layer Environment service.

- forum: CreateTopic/PostMessage/ReplyMessage use cases take ClientInfoDTO
- registration: RegisterUserUseCase takes ClientInfoDTO
- admin: PrepareIpBanUseCase takes ClientInfoDTO; the admin's own addresses now go
through IpRangeParser, so an unparsable address takes part in no comparison
- contacts: ContactForm::getValidationRules() takes ClientInfoDTO
- fix stale ForumMessage $ip / $ip_via_proxy annotations (int -> string)

The short-term log of who has been hitting the site is a storage, not a fact of the
request: it now lives behind RequestRateLogInterface with a flat-file implementation
(the record format is unchanged). The kernel records the visit, online/GetIpActivityUseCase
reads it, and Environment keeps only the address and the user agent.

Addresses cross the interface as strings — the unsigned-int form stays an implementation
detail, which is what IPv6 support will replace. The online module also stops depending
on Environment altogether: the current address is handed to the use case by its controller.

The locale belongs to the request, the translator is shared. LocaleResolver holds the
choice (?setlng, then the session, the profile, the system default) and the kernel
applies it once the current user is known.

Setting the locale is no longer enough on its own: addTranslationDomain() loads
<locale>.lng.php at registration time, and domains are registered from the constructors
of the shared controllers — once per process. So setLocale() now reloads the dictionary
of every registered domain and restores the default one; the same locale stays a no-op.

Both current-user services are shared and taken in the constructor of hundreds of
controllers and services, so they cannot be rebuilt per request — their state is
replaced instead. The Eloquent user is rehydrated (raw attributes, exists, relations
dropped), the legacy one through the new setProperties(), which restores the declared
properties to their default and removes the dynamic ones left by the previous visitor.

CurrentUserAuthenticator drives it and is idempotent per request object: under FPM the
boot and the kernel serve the same Request, so the second call issues no extra queries.
The boot calls it before resolving the translator, which reads the locale of the profile.

The constant belongs to the process: Ads::checkAccess() and Counters::counters() read
it with defined(), so under a long-running runtime the first home page served would have
made every later page look like the home page. HomepageController now marks the request
itself and both readers take the flag from the RequestStack.