Core Architecture Overview

Encrypt CMS is built on a clean, decoupled Model-View-Controller (MVC) architecture designed for reliability, fast bootstrapping, and predictable runtime behavior.

1. The Front Controller Lifecycle

Every incoming HTTP request traverses the single entry point index.php:

[ Incoming HTTP Request ]
          │
          ▼
    index.php (Front Controller)
          │
          ├─► App\Core\Autoloader::register()
          ├─► App\Core\Config::load()
          ├─► App\Core\Session::start()
          ├─► App\Core\Request::capture()
          │
          ▼
   App\Core\PluginManager::bootActivePlugins()
          │  (Active plugins register custom routes and subscribe to hooks)
          │
          ▼
    App\Core\Router::dispatch($request)
          │
          ▼
  Controller Action Execution (e.g. AdminController::dashboard)
          │
          ▼
    App\Core\Response::send()

2. Directory Organization

Encrypt CMS/
├── index.php                 # Front controller entry point
├── app/
│   ├── Core/                 # Framework kernel
│   │   ├── Autoloader.php    # PSR-4 dynamic autoloader
│   │   ├── Router.php        # HTTP router supporting route parameters
│   │   ├── Request.php       # HTTP request abstraction (GET, POST, headers)
│   │   ├── Response.php      # HTTP response abstraction (HTML, JSON, status)
│   │   ├── Database.php      # PDO wrapper with prepared query execution
│   │   ├── Auth.php          # Session-based authentication & password verification
│   │   ├── CSRF.php          # Cryptographic token generator & validator
│   │   ├── Hook.php          # Action & filter event bus
│   │   └── PluginManager.php # Isolated plugin bootstrapper
│   ├── Controllers/          # Admin, Post, Page, Media, Theme, Plugin controllers
│   ├── Models/               # Post, Page, User, Taxonomy, Media, Comment models
│   └── Services/             # CoreUpdateService, ExtensionUpdateService, LicensingService
├── config/                   # Protected app, database, and licensing configurations
├── database/migrations/      # Schema migration files
├── storage/                  # Protected uploads, cache, logs, and update locks
├── templates/                # Native server-rendered PHP templates
├── themes/                   # Presentation themes directory
└── plugins/                  # Modular extensions directory

3. Database Layer (App\Core\Database)

Database access is encapsulated in App\Core\Database. It enforces strict prepared statements using PDO:

use App\Core\Database;

// Fetch multiple records safely
$posts = Database::query(
    "SELECT * FROM posts WHERE status = :status ORDER BY created_at DESC LIMIT :limit",
    ['status' => 'published', 'limit' => 10]
);

// Execute an insert or update and retrieve affected rows
$affected = Database::execute(
    "UPDATE posts SET views_count = views_count + 1 WHERE id = :id",
    ['id' => $postId]
);

4. PSR-4 Autoloading

Encrypt CMS provides its own zero-dependency PSR-4 autoloader (App\Core\Autoloader). Any class under the App\ namespace maps directly to the app/ folder without requiring Composer in production.