PagesController

MMO\editor\controllers · 1 symbole · générée le 27 Oct 2026

class

PagesController

The backoffice's api of the pages (Pages does the work, and checks the rights), under admin/:

class MMO\editor\controllers\PagesController extends MMO\core\classes\aDataController use MMO\editor\controllers\tAdminApi

Espace de noms: MMO\editor\controllers
Étend: aDataController
Utilise les traits: tAdminApi

| route | | |---|---| | `GET admin/pages.json`, `POST` one | the pages; a new one: `{slug, title, layout, seo, sections}` | | `GET`, `PUT`, `DELETE admin/pages/{id}.json` | a page; `PUT` changes its draft (only the fields given) | | `POST admin/pages/{id}/publish.json`, `/unpublish.json` | its draft goes live; it goes offline | | `GET admin/pages/{id}/revisions.json`, `POST .../rollback.json` `{number}` | its history; a revision back in its draft | | `POST admin/pages/{id}/preview?language=` | the html of a version that is not saved (the body: `{title, layout, seo, sections, languages, translations}`), in a language | | `GET admin/sections.json` | the types of section, with their schemas, and the layouts | | `GET admin/pages/token.json` | the session's CSRF token | | `GET admin/pages?page={id}` | the backoffice's html page: `<mmo-page-editor>` (`templates/backoffice.phtml`) | Someone has to be logged in (401 otherwise), with the `editor.pages` scopes (403). A request changing something sends the session's CSRF token in `X-CSRF-Token` ([`Token`](https://mmoframework.fr/fr/documentation/mmo.editor/php/controllers/PagesController.md#pagescontroller-token); a page has it in `MMO.editor.config.token`), unless an `Authorization` header authenticates it. A page that is not valid is a 422 whose `errors` say why, field by field.

curl -X PUT -H 'Content-Type: application/json' -H "X-CSRF-Token: $TOKEN" -d '{"title": "Home"}' .../admin/pages/1.json

Index

	CSRF_KEY
	body($route)
	checkToken($route)	Make sure a request changing something comes from a page of the site: it has the session's token, or is authenticated by an `Authorization` header (which a browser does not send on its own)
	explainErrors($route)	An error says why in the answer's body too (`meta.error`): http/2 has no status text to carry it
	exportPage($page, $user, $sections)	A page as the routes give it: its draft, what is published of it (without its sections), its url, and what $user may do with it.
	invalid($route, $e)
	onRoute($route)
	page($route)
	routeBackoffice($route)	The backoffice: an html page holding `<mmo-page-editor>`, which works from the api.
	routeCreate($route)
	routeDelete($route)
	routeGet($route)
	routeList($route)
	routePreview($route)	The html of a version of the page that is not saved (the body: `{title, layout, seo, sections, languages, translations}`), as the backoffice's preview shows it: its sections say which they are (`da…
	routePublish($route)
	routeRevisions($route)
	routeRollback($route)
	routeSections($route)
	routeToken($route)	The session's CSRF token (`Token`): a page holds the one of the session it was made in, which the server no longer has once the session changed.
	routeUnpublish($route)
	routeUpdate($route)
	setStatus($route, $status)
	Token() static
	user($route)

Constantes1

CSRF_KEY

const CSRF_KEY = 'MMO\\editor\\controllers\\PagesController'

Méthodes23

body($route)

tAdminApi.php:52

protected function body(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed> the body of the request, a json object

checkToken($route)

tAdminApi.php:42

Make sure a request changing something comes from a page of the site: it has the session's token, or is authenticated by an Authorization header (which a browser does not send on its own)

protected function checkToken(MMO\core\server\Route $route): void

$route	Route
retourne	void
lève		(403) if it has not

explainErrors($route)

tAdminApi.php:18

An error says why in the answer's body too (meta.error): http/2 has no status text to carry it

protected function explainErrors(MMO\core\server\Route $route): void

$route	Route
retourne	void

exportPage($page, $user, $sections)

PagesController.php:234

A page as the routes give it: its draft, what is published of it (without its sections), its url, and what $user may do with it.

function exportPage( MMO\editor\cms\Page $page, MMO\oauth\interfaces\iClient $user, bool $sections = true ): array

$page	Page
$user	iClient
$sections = true	bool
retourne	array	mixed>

invalid($route, $e)

tAdminApi.php:59

protected function invalid(MMO\core\server\Route $route, MMO\editor\exceptions\eInvalidPage $e): array

$route	Route
$e	eInvalidPage
retourne	array	array<string, string>} a 422 saying what is wrong

onRoute($route)

PagesController.php:46

function onRoute(MMO\core\server\Route $route): bool

$route	Route
retourne	bool

page($route)

PagesController.php:257

protected function page(MMO\core\server\Route $route): MMO\editor\cms\Page

$route	Route
retourne	Page	the page `{id}` @throws e404 if there is none

routeBackoffice($route)

PagesController.php:59

The backoffice: an html page holding <mmo-page-editor>, which works from the api. Its template is backoffice.phtml, the application's own when one of its Pages::$templates has one.

#[MMO\core\attributes\APIRoute('GET|admin/pages?page={?page}', 'The backoffice of the pages', mediaTypes: ['html'])] function routeBackoffice(MMO\core\server\Route $route): MMO\core\server\Response

$route	Route
retourne	Response

routeCreate($route)

PagesController.php:85

#[MMO\core\attributes\APIRoute('POST|admin/pages.json', 'Make a page: slug, title, layout, seo, sections', mediaTypes: ['json'])] function routeCreate(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed> the page made (201), or its `errors` (422)

routeDelete($route)

PagesController.php:116

#[MMO\core\attributes\APIRoute('DELETE|admin/pages/{id}.json', 'Delete a page, and its revisions', mediaTypes: ['json'])] function routeDelete(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed, deleted: true}

routeGet($route)

PagesController.php:96

#[MMO\core\attributes\APIRoute('GET|admin/pages/{id}.json', 'A page: its draft, and what is published', mediaTypes: ['json'])] function routeGet(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed>

routeList($route)

PagesController.php:76

#[MMO\core\attributes\APIRoute('GET|admin/pages.json', 'The pages of the site', mediaTypes: ['json'])] function routeList(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed>> every page, without its sections (`exportPage`)

routePreview($route)

PagesController.php:182

The html of a version of the page that is not saved (the body: {title, layout, seo, sections, languages, translations}), as the backoffice's preview shows it: its sections say which they are (data-section), in {language} (one of its languages; none, the default one). Nothing is saved; the version is cleaned as a draft would be, and a 422 says what is wrong with it.

#[MMO\core\attributes\APIRoute('POST|admin/pages/{id}/preview?mode={?mode}&language={?language}', 'The html of a version of a page that is not saved', mediaTypes: ['html'])] function routePreview(MMO\core\server\Route $route): MMO\core\server\Response

$route	Route
retourne	Response

routePublish($route)

PagesController.php:129

#[MMO\core\attributes\APIRoute('POST|admin/pages/{id}/publish.json', 'Publish the draft of a page', mediaTypes: ['json'])] function routePublish(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed> the page, or its `errors` (422) when its draft is not valid

routeRevisions($route)

PagesController.php:150

#[MMO\core\attributes\APIRoute('GET|admin/pages/{id}/revisions.json?full={?full}', 'The revisions of a page', mediaTypes: ['json'])] function routeRevisions(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed>> the revisions kept, the last one first: `{number, date, author}` (`version` with `?full=1`)

routeRollback($route)

PagesController.php:166

#[MMO\core\attributes\APIRoute('POST|admin/pages/{id}/rollback.json', 'Put a revision back in the draft of a page: {number}', mediaTypes: ['json'])] function routeRollback(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed> the page, its draft being the revision `{number}`

routeSections($route)

PagesController.php:207

#[MMO\core\attributes\APIRoute('GET|admin/sections.json', 'The types of section, with their schemas, and the layouts', mediaTypes: ['json'])] function routeSections(MMO\core\server\Route $route): array

$route	Route
retourne	array	list<string>, sections: list<\MMO\editor\cms\SectionType>} what the page editor offers

routeToken($route)

PagesController.php:221

The session's CSRF token (Token): a page holds the one of the session it was made in, which the server no longer has once the session changed. A GET is no risk: another site cannot read the answer (no CORS)

#[MMO\core\attributes\APIRoute('GET|admin/pages/token.json', 'The session\'s CSRF token, for the requests changing something', order: -1, mediaTypes: ['json'])] function routeToken(MMO\core\server\Route $route): array

$route	Route
retourne	array	string}

routeUnpublish($route)

PagesController.php:140

#[MMO\core\attributes\APIRoute('POST|admin/pages/{id}/unpublish.json', 'Take a page offline: its draft and revisions stay', mediaTypes: ['json'])] function routeUnpublish(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed>

routeUpdate($route)

PagesController.php:105

#[MMO\core\attributes\APIRoute('PUT|admin/pages/{id}.json', 'Change the draft of a page: only the fields given', mediaTypes: ['json'])] function routeUpdate(MMO\core\server\Route $route): array

$route	Route
retourne	array	mixed> the page, or its `errors` (422)

setStatus($route, $status)

tAdminApi.php:64

protected function setStatus(MMO\core\server\Route $route, int $status): void

$route	Route
$status	int
retourne	void

Token()

staticPagesController.php:42

static function Token(): string

retourne

string

the session's CSRF token, for the requests changing something

user($route)

tAdminApi.php:31

protected function user(MMO\core\server\Route $route): MMO\oauth\interfaces\iClient

$route	Route
retourne	iClient	the logged-in user
lève		(401) if nobody is

Membres hérités (61)

Constantes	Déclaré par	Description
`ALERT`	iLogLevel	Alert: Action must be taken immediately.
`ALL`	iLogLevel	Mask for all
`ALL_PLUS`	iLogLevel	debug everything
`BACKTRACE`	iLogLevel
`COLORS`	aDataController	Named color palettes for chart/report endpoints, e.g.
`CRITICAL`	iLogLevel	Critical: Critical conditions.
`DEBUG`	iLogLevel	Debug: Detailed debug information.
`DEEP`	iLogLevel	debug everything with arguments
`EMERGENCY`	iLogLevel	Emergency: System is unusable.
`ERROR`	iLogLevel	Error: Runtime errors that do not require immediate action but should typically be logged and monitored.
`ERROR_PLUS`	iLogLevel	Mask for all error
`FATAL`	iLogLevel	Mask for all fatal error
`INFO`	iLogLevel	Info: Interesting events.
`INFO_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`MEMORY`	iLogLevel	include backtrace object
`NOTICE`	iLogLevel	Notice: Normal but significant events.
`NOTICE_PLUS`	iLogLevel	Mask for all errors/warning/notices/info
`TRACE`	iLogLevel	include backtrace as origins
`WARNING`	iLogLevel	Warning: Exceptional occurrences that are not errors.
`WARNING_PLUS`	iLogLevel	Mask for all errors and warnings

	Propriétés	Déclaré par	Description
	`repositories`	aDataController
	`verbosity`	aModule

Méthodes	Déclaré par	Description
`alert($message, $context)`	aModule	Action must be taken immediately.
`backtraces($message, $context)`	aModule	Force-log a message at INFO level together with a full stack trace/memory snapshot (`iLogLevel::BACKTRACE`), bypassing the verbosity mask entirely (any non-zero verbosity is enough to trigger it).
`Configure($config)`	aModule	Merge $config into this module's configuration in the shared `Configuration`.
`critical($message, $context)`	aModule	Critical conditions. No-op if CRITICAL is currently filtered out by the verbosity mask.
`debug($message, $context)`	aModule	Detailed debug information.
`debugName()`	aModule	Human-readable identifier used as the default `{origin}` in this instance's log messages.
`DefaultConfig()`	aModule	The config a module starts from before anything loaded via `Configuration` is merged in.
`emergency($message, $context)`	aModule	System is unusable. No-op if EMERGENCY is currently filtered out by the verbosity mask.
`error($message, $context)`	aModule	Runtime errors that do not require immediate action but should typically be logged and monitored.
`ExtractRoutes($config)`	aController	Extract all the APIRoute from this class, regardless of the fact they are registered in the application
`getMainRepository()`	aDataController
`getRepositories()`	aDataController
`getRepository($repo)`	aDataController
`getVerbosity()`	aModule
`HasRoutes()`	aController	Tells if any APIRoute are registered in the application
`info($message, $context)`	aModule	Interesting events. No-op if INFO is currently filtered out by the verbosity mask.
`Instantiate($config)`	aModule	(Re)create the shared instance immediately, configured with $config merged into the class's existing config.
`IsShared()`	aModule
`Link($method, $data)`	aController	Build a `Link` (URL + label/icon/description/title, taken from the route's APIRoute metadata) for a registered route.
`log($level, $message, $context)`	aModule	Logs with an arbitrary level.
`notice($message, $context)`	aModule	Normal but significant events.
`offsetExists($key)`	aModule	\ArrayAccess::offsetExists -- tells whether $key is a declared property at all, regardless of whether it is currently readable/writable through array access.
`offsetGet($key)`	aModule	\ArrayAccess::offsetGet -- reads a property directly, unless it has a `#[Serialize(serialize: 'methodName')]` attribute, in which case that zero-argument method is called instead (e.g.
`offsetSet($key, $value)`	aModule	\ArrayAccess::offsetSet -- sets a property directly, unless it has a `#[Serialize(unserialize: 'methodName')]` attribute, in which case that method is called with $value instead (e.g.
`offsetUnset($key)`	aModule	\ArrayAccess::offsetUnset -- equivalent to `$module[$key] = null`.
`Route($method)`	aController	Get a registered APIRoute WARNING: if this class was not registered in the application, it will return null.
`Routes()`	aController	Get a list of registered APIRoutes (from this class) in the application WARNING: if this class was not registered in the application, it will return an empty array.
`serialize($path, $serializer)`	aModule	\MMO\core\interfaces\iSerializable::serialize -- exports every property (via
`setRepositories($repositories)`	aDataController	Register the repositories this controller can query, keyed by name (e.g.
`setVerbosity($verb)`	aModule	Set the current verbosity mask, replacing whatever it was before.
`Shared()`	aModule	Get the shared instance, creating (and configuring) it on first call.
`testVerbosity($level)`	aModule	Test whether a given level (or set of levels) is currently enabled by this instance's verbosity mask.
`traitUnshare($serialize)`	aModule	Remove the shared instance, so the next `Shared()` call creates a fresh one.
`unserialize($data, $path, $instances)`	aModule	\MMO\core\interfaces\iSerializable::unserialize -- merges $data onto `DefaultConfig`, runs it through the (possibly overridden) constructor, then applies each resulting value to its property (via
`Unshare($serialize)`	aModule	Like `tSingleton::Unshare`, but also disconnects this module's instance from every event it was listening to (via `Event::DisconnectListeners`) before dropping it.
`Url($method, $data)`	aController	Build the URL for a registered route, filling in any `{placeholder}` from $data.
`warning($message, $context)`	aModule	Exceptional occurrences that are not errors.
`__construct($config)`	aModule	protected constructor, so it is not possible to do `new Module(...)` called by the serialization process just before being injected with data.
`__wakeup()`	aController	Called automatically right after the controller's shared instance is built (`aModule::unserialize`): registers `onRoute` as a Route listener with a low priority (-10), so it…