Unlike every other post under App/pages/blog/, this one has its own index.php sidecar — App/pages/blog/comments-demo/index.php — which reads and writes a comments table via Lib\Comments and returns a comments key in its context. App/pages/blog/_layout/layout.twig only includes the comment-thread partial (novaconium/pages/_partials/comments/thread.twig) when that key is present, so this is the only post here with a thread below.
Having a sidecar means this page is never served from the static HTML cache the way its sidecar-less siblings are (see {{ icons.book() }}Static caching) — an explicit, per-page tradeoff you accept the moment a page needs comments. See {{ icons.users() }}Comments for the full write-up of Lib\Comments, including why comments are tied to real logged-in accounts rather than anonymous name/email fields, and why they're auto-approved with after-the-fact moderation at /admin/comments rather than a pending queue.
Access::require('group:members') returns null or a ready-made Response (login redirect with a return path, or a 404 for the wrong account). Public is the default — a sidecar that never calls it is untouched, and static (sidecar-less, cached) pages are always public by construction.draft_routes in App/config.php to make it visible only to an authenticated admin; anyone else gets a plain 404, not a login prompt./admin/media, an upload/browse/delete UI for files under public/uploads/, covered by the existing /admin/* auth gate with no separate flag needed. Extension allowlist and max upload size are configurable.Lib\Comments, a reusable comment thread any page can attach to itself via its own sidecar (see App/pages/blog/comments-demo/). Tied to real logged-in accounts, not anonymous name/email fields; auto-approved on submission with after-the-fact hide/delete moderation at /admin/comments.data-theme attribute (persisted to localStorage) that swaps every color via CSS custom properties.Lib\SpamGuard (honeypot + submission-timing check, no external CAPTCHA), Lib\FormValidator, and Lib\Validate, demonstrated on the contact form.Lib\Input (cleaning accessor for $_POST/$_GET) and Lib\Csrf (standalone session-token CSRF protection), wired into the contact form and every admin form.Every comment left via Lib\Comments, across every page — auto-approved on submission (only a verified account can post one), moderated here after the fact instead of a pending queue. Hiding a comment removes it from its page immediately; deleting it is permanent. See {{ icons.book() }}Comments.
{{ notice }}
+ {% endif %} + + {% if error %} +{{ error }}
+ {% endif %} + + {% if comments is empty %} +No comments yet.
+ {% else %} +| Page | +User | +Comment | +Posted | +Status | +Actions | +
|---|---|---|---|---|---|
| {{ comment.page_path }} | +{{ comment.username }} | +{{ comment.excerpt }} | +{{ comment.created_at }} | +{{ comment.is_hidden ? 'Hidden' : 'Visible' }} | ++ + + | +
Lib\Comments is a self-hosted comment thread — no third-party service (Disqus, Commento, etc.) — a plain static class any sidecar can call to attach comments to any page, not just blog posts, the same way {{ icons.email() }}Lib\SpamGuard/Lib\FormValidator are reusable across any form rather than hardcoded to the contact page. It depends on {{ icons.lock() }}admin authentication being enabled — comments are tied to a real logged-in account (App\AdminAuth::currentUser()), never anonymous name/email fields, since currentUser() already excludes disabled and unverified accounts, there's nothing further to check before accepting a comment from whoever it returns.
A comment is visible the instant it's posted — there's no pending-approval queue. Since only a verified account can post one at all, there's no anonymous-spam vector to pre-vet against, the same reasoning {{ icons.lock() }}admin authentication already applies by disabling rather than pre-vetting accounts. An admin can hide or permanently delete any comment after the fact at /admin/comments — hiding removes it from its page immediately (it's excluded at the query level, not just visually), deleting is permanent.
+ +A page needs its own sidecar to use Lib\Comments — this codebase has no client-side JS/fetch anywhere, every dynamic feature is a plain server-rendered POST form, and comments are no different. Giving a page a sidecar is exactly what excludes it from the {{ icons.book() }}static HTML cache (only sidecar-less pages are ever cached), so attaching comments to a previously sidecar-less page is an explicit, per-page tradeoff — the same one /admin/media and /search already accept. See App/pages/blog/comments-demo/index.php for a full worked example (the one post under App/pages/blog/ with a sidecar, specifically for this):
$pagePath = Comments::currentPagePath();
+$user = AdminAuth::currentUser();
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+ if (!Csrf::verify(Input::post('csrf_token'))) { ... }
+ if ($user === null) { ... } // must be logged in
+ // validate $body, run it past SpamGuard, then:
+ Comments::create($pagePath, $user['id'], $body);
+ return Response::redirect($pagePath);
+}
+
+return [
+ 'comments' => Comments::forPage($pagePath),
+ 'currentUser' => $user,
+ // ...csrfField/csrfToken/renderedAt, same as any other form sidecar
+];Then include the reusable partial, novaconium/pages/_partials/comments/thread.twig — a _-prefixed segment, so it's never itself routable (see {{ icons.link() }}Routing's reserved-segments rule), the same convention _layout/ already uses:
{% verbatim %}{% if comments is defined %}
+ {% include '_partials/comments/thread.twig' %}
+{% endif %}{% endverbatim %}Guarding the include with comments is defined — as App/pages/blog/_layout/layout.twig does — means a layout shared by both comment-enabled and sidecar-less pages can include it unconditionally without breaking the pages that never set the key. The partial itself expects comments, currentUser, csrfField/csrfToken, and renderedAt in context — the same shape returned above — and renders the thread plus a honeypot-carrying submit form (mirroring the contact form's spam prevention, see {{ icons.email() }}Forms) when someone's logged in, or a "log in to comment" link otherwise.
Ships as a framework migration, novaconium/migrations/0004_create_comments.sql — a comments table (id, page_path, user_id, body, is_hidden, created_at) on the same default connection as users, applied automatically the first time anything touches it, no manual step. page_path is whatever Comments::currentPagePath() derives from the request (e.g. /blog/comments-demo) — free-text, not a foreign key, so a thread survives even if the page it was attached to is later restructured.
Lib\Access; public by default, static pages always public.public/uploads/ from /admin/media.Lib\Comments, a reusable comment thread any page can attach to itself via its own sidecar.Lib\.
{{ icons.users() }}Comments
+ + {% if comments is empty %} +No comments yet.
+ {% else %} + {% for comment in comments %} +{{ comment.username }} — {{ comment.created_at }}
+{{ comment.body }}
+Log in to leave a comment.
+ {% endif %} +