# Ty Clifford's Content Management System

Ty Clifford's Content Management System is a small PHP blog CMS with a Bludit-style content layout:

```text
bl-content/pages/<slug>/index.txt
```

Posts and static pages are Markdown `.txt` files with front matter. Comments are stored in SQLite, site configuration and generated indexes are JSON, and visit stats are CSV for easy Excel import.

Post and page bodies are treated as trusted author content. Markdown is rendered while allowing raw HTML, iframes, JavaScript, and executable PHP blocks inside the `.txt` files.

Shortcodes are declared in `config/shortcodes.php` as a PHP array, with optional JSON overrides in `config/shortcodes.json`. Built-in examples:

```text
[youtube=dQw4w9WgXcQ]
[video poster=poster.jpg file=file.mp4]
```

`[video]` renders an iframe pointed at `lone-embed.php`, which serves a full-frame HTML5 video player. Bare filenames resolve from `bl-content/uploads`.

## Requirements

- PHP 8.1 or newer
- PDO SQLite enabled
- Apache with `mod_rewrite` for `.htaccess` pretty URLs, or the PHP built-in server for local testing

## Local Server

```bash
php -S 127.0.0.1:8080 router.php
```

## CLI

```bash
php cli/blog.php help
php cli/blog.php list --all
php cli/blog.php create "New Post" --status=published --category=Notes --tags=php,markdown
php cli/blog.php update hello-neon --title="Hello Neon"
php cli/blog.php delete old-slug
php cli/blog.php rebuild
```

## Mac Client and API

The native AppKit macOS 12+ client lives in `macclient/`.

```bash
cd macclient
./build-app.sh
open TCMSMacClient.app
```

Point the client at any TCMS site URL. It will call `api.php` at that site for posts, pages, media, comments, local autosave, and optional remote draft autosave.

API credentials are stored in the site root `.env` file:

```text
TCMS_API_ENABLED=true
TCMS_API_USERNAME=admin
TCMS_API_PASSWORD=change-this-password
TCMS_API_PASSWORD_HASH=
TCMS_API_TOKEN=change-this-token
```

The Mac client can authenticate with the `.env` username/password. Scripts can also send `TCMS_API_TOKEN` as a Bearer token or `X-TCMS-Token`. Use `TCMS_API_PASSWORD_HASH` with `password_hash()` output instead of `TCMS_API_PASSWORD` for production.

## Comments

Comments are moderated by default and protected by captcha plus a honeypot field.

```bash
php cli/blog.php comments:list --status=pending
php cli/blog.php comments:approve 1
php cli/blog.php comments:spam 2
php cli/blog.php comments:delete 3
```

## Import Bludit

Import from a local directory on the server. The source can be the old Bludit root or the old `bl-content` folder.

```bash
php cli/import-bludit.php /var/www/old-bludit --dry-run
php cli/import-bludit.php /var/www/old-bludit
php cli/import-bludit.php /var/www/old-bludit/bl-content
php cli/import-bludit.php --source=/var/www/old-bludit --overwrite
```

The importer preserves original publish dates, modified dates, post/static-page type, draft/published state, categories, tags, authors, cover image metadata, allow-comments flags, page order, page-local files, and `bl-content/uploads`.

It also scans local comment export files under the old `bl-content/databases` and `bl-content/workspaces` directories. To point it at a specific local comment export:

```bash
php cli/import-bludit.php /var/www/old-bludit --comments=/var/www/old-bludit/comments.json
```

## Stats

Visits are appended to `storage/stats/visits.csv` with a header row suitable for spreadsheet import.

```bash
php cli/blog.php stats:summary
```

## Apache

The included `.htaccess` enables pretty URLs and blocks direct access to app code, configuration, `.env`, the Mac client source, SQLite, CSV, JSON databases, and Markdown content files.

For a subdirectory install such as `https://example.com/blog`, either place the app in that folder and let the CMS auto-detect the path, or set:

```json
{
  "base_url": "https://example.com/blog",
  "base_path": "/blog"
}
```

`base_path` controls generated links, assets, forms, RSS, and sitemap paths.