Laravel Laravel Package

Agents

Guidance for AI coding agents working in this repo. This is the tool-agnostic entry point; the deeper canonical notes live in .claude/ — CLAUDE.md, architecture.md, development.md, api-map.md. Read those for detail. For the human-facing monorepo map (engine ↔ adapters, the three integration...

claude-code

cursor

Audit Log

Audit log is archive-before-truncate and tamper-evident; export/verify/purge/fixity are a separate paid layer. StorageMetadataHandler::audit()'s rotation writes the dropped tail to fluxfiles/audit/archive/audit-<ts>-<hex>.jsonl first, under the same lock — a free/core correctness fix. Every entry...

cursor

Media Delivery

Media preview (inline <video>/<audio>/pdf already exists): the UI auto-refreshes an expiring presigned media URL on playback error (re-presign via /api/fm/presign, keep currentTime). Claims: mediapreview (default true), previewurlttl (media files get a longer presigned TTL), maxpreviewmb...

cursor

Modal Chrome

Modal chrome dark-mode anti-flash: the React/Vue/SDK modal chrome lives in the HOST origin and can't read the cross-origin iframe's resolved theme, so when the theme prop is auto/unset it mirrors the embedded UI's boot: resolve dark from localStorage['fluxfilestheme'] first, then OS, and persist...

cursor

Optimize

Optimization is now FREE/core (POST /api/fm/optimize, \FluxFiles\OptimizeModule + \FluxFiles\PdfOptimizer, both in packages/core/api/): recompress images → WebP at rest (replace/keep, EXIF stripped) + Ghostscript PDF compression + batch + on-upload autooptimize + savings in the usage dashboard...

cursor

Paid Module Ui

Operator UI for paid modules — all behind the same proGate('allowx', '<module>') three-state treatment (hidden / locked teaser / on): Share, Intake, Versioning, AI Vision (modal for bgremove/upscale/smartcrop + detail-panel/context-menu/action-sheet entries; canAiVisionFile() mirrors...

cursor

Role Presets

ACL role presets (docs/design/ACL-ROLE-PRESETS-DESIGN.md): a mint-time-only role claim-bundle preset — four roles, viewer/editor/admin/superadmin (superadmin shares admin's claim bundle but is the one role documented as safe to combine with an empty prefix), structurally parallel to the existing...

cursor

Sftp Hardening

SFTP host-key / cipher hardening (DiskManager::buildSftpProvider(), config keys requirehostkey/strictalgorithms, env SFTPREQUIREHOSTKEY/SFTPSTRICTALGORITHMS): two opt-in (default-off, backward-compatible) tightenings on top of the pre-existing hostfingerprint pinning. requirehostkey fails closed...

cursor

Sso

SSO bridge is pre-auth, so it can't use the normal 3-layer ModuleRegistry::require() — there's no Claims yet to check a per-token claim against. ModuleRegistry::requireServer($id, $license) does layers 1+2 only (installed + licensed); layer 3 becomes an explicit FLUXFILESSSOENABLED env check in...

cursor

Tus Uploads

Resumable uploads (tus 1.0) (POST/HEAD/PATCH/DELETE /api/fm/tus, TusServer.php, free/core): lifts PHP's uploadmaxfilesize ceiling on local/SFTP disks and resumes after a dropped connection. Every upload rule (perm, disk, ext, maxupload, scope, quota, maxfiles, collision, owneronly, legal hold) is...

cursor

Url Import Exif

URL import (POST /api/fm/import-url, UrlImporter.php): synchronous server-side fetch → the upload pipeline. Opt-in per tenant via allowurlimport (default false → inert). SsrfGuard.php is the shared SSRF denylist (per-hop + post-connect IP check; also used by the BYOB endpoint check). v1 is sync...

cursor

Virus Dlp

Virus scan is wired fail-closed, and that's load-bearing. allowvirusscan makes index.php (and the Laravel/WP proxies, which build their own FileManager) set FileManager::setVirusScanner(); the ModuleRegistry::require gate runs inside the callback so reads still work and only writes needing a scan...

cursor

Watermark

Watermark logo + transparent base gotcha: intervention/image v3's place() with opacity<100 composites through an opaque GD scratch image (imagecopymerge), so a logo over a transparent (alpha) PNG/WebP base comes out a dark box (JPEG is fine — no alpha). Fix = bake opacity into the logo's own...

cursor

Webhooks

Webhooks is shipped and intentionally at-most-once. docs/ROADMAP.md's DROP table once listed Webhooks as out-of-scope ("needs a persisted outbox + retries"); COMMERCIAL-STRATEGY.md §6b (2026-06-28) reversed that — event-driven is stateless when the webhook fires on the request that caused the...

cursor