# Contributing to Key Lair

Key Lair is proprietary software (see [LICENSE.md](LICENSE.md)) maintained
by:

**Oswald Weber — Secret Item Games GmbH**

This is not an open-source project accepting public contributions. This
document exists for internal/authorized contributors working on the
codebase.

## Coding conventions

- PHP only, namespaced under `KeyLair\`.
- Code and comments are written in English.
- All database access goes through PDO with prepared statements — never
  interpolate values into SQL.
- Every state-changing form includes a CSRF token (see `src/Csrf.php`).
- No external dependencies for anything critical (no Composer packages, no
  Node/PostgreSQL). If a library feels tempting for something small (e.g.
  TOTP), prefer a small self-contained implementation instead.

## Testing before submitting a change

- Test against a real Apache setup with `mod_rewrite` enabled, not just the
  PHP built-in dev server. The dev server ignores `.htaccess` entirely,
  which has previously hidden real bugs (broken rewrites, invalid
  `.htaccess` directives) until the code reached production.
- Verify both the public claim flow (`/claim/{token}` and
  `/claim/{token}/{slug}`) and the admin panel after any change touching
  routing, sanitization, or the key-allocation logic in
  `src/ClaimService.php`.
- Changes to `src/ClaimService.php` should be checked for concurrency safety
  — two simultaneous claims must never receive the same key.

## Security-sensitive areas

Take extra care when touching:

- `src/ClaimService.php` — atomic key allocation.
- `src/Helpers::renderRichText()` — sanitize on save, not just on display.
- `src/Auth.php`, `src/TwoFactor/` — login and 2FA flow.
- `src/ImageUpload.php` — validate actual image content, not just file
  extension or MIME header.

## Commits

Write commit messages that explain why a change was made, not just what
changed. Do not push to shared branches without confirming with the
maintainer first.
