Framework Documentation - Application Package

Tutorial: building a complete application

This tutorial builds a small but complete web application on top of the Joomla Framework, using
joomla/application as the foundation and wiring in the other packages one at a time.

The application is a note manager: notes can be listed, read, created and deleted; creating and
deleting requires a login. It is deliberately small, but it exercises everything a real application
needs — dependency injection, configuration, routing, persistence, templating, sessions,
authentication, CSRF protection, events, error handling, logging and a console command.

Chapters

  1. Project setup — dependencies, directory layout, front controller
  2. Container and configuration — joomla/di, joomla/registry
  3. Routing and controllers — joomla/router, controller resolver
  4. Database and repositories — joomla/database
  5. Views and templates — templating and escaping
  6. Session, authentication and CSRF — joomla/session, joomla/authentication
  7. Events and error handling — joomla/event, logging
  8. Console commands and production — joomla/console, deployment

What you need

  • PHP 8.3 or newer
  • Composer
  • SQLite (bundled with PHP) or MySQL

The finished layout

notes/
├── bin/
│   └── console                 # CLI entry point
├── config/
│   └── app.dist.json           # configuration template
├── public/
│   ├── index.php               # web entry point
│   └── .htaccess               # front controller rewrite
├── src/
│   ├── Controller/
│   │   ├── AbstractController.php
│   │   ├── CreateNoteController.php
│   │   ├── DeleteNoteController.php
│   │   ├── ListNotesController.php
│   │   ├── LoginController.php
│   │   ├── LogoutController.php
│   │   └── ShowNoteController.php
│   ├── Command/
│   │   ├── CreateUserCommand.php
│   │   └── MigrateCommand.php
│   ├── EventListener/
│   │   ├── CsrfSubscriber.php
│   │   ├── ErrorSubscriber.php
│   │   └── SecurityHeadersSubscriber.php
│   ├── Repository/
│   │   ├── NoteRepository.php
│   │   └── UserRepository.php
│   ├── Service/
│   │   ├── AuthenticationProvider.php
│   │   ├── ConfigProvider.php
│   │   ├── DatabaseProvider.php
│   │   ├── EventProvider.php
│   │   ├── RouterProvider.php
│   │   ├── SessionProvider.php
│   │   ├── TemplateProvider.php
│   │   └── WebApplicationProvider.php
│   └── Template/
│       ├── PlatesRenderer.php
│       └── TemplateRendererInterface.php
├── templates/
│   ├── layout.php
│   ├── login.php
│   ├── notes.php
│   └── note.php
├── var/
│   ├── log/
│   └── notes.sqlite
├── bootstrap.php
└── composer.json

A note on the framework's rough edges

The framework has a few behaviours that will bite you if you do not know about them. Rather than
writing code that quietly works around them, this tutorial points them out where they come up:

  • Routing a pattern for more than one HTTP method — chapter 3
  • Base URI detection behind a proxy — chapter 1
  • Secure session defaults — chapter 6
  • Session fixation after login — chapter 6
  • Escaping in templates — chapter 5

Start with Project setup.

#