CP-17268 debugbar

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.idea
+.env
+vendor
+composer.lock
+tests/_output/*
+*.md

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+charset = utf-8
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{xml,sh,yml,yaml}]
+indent_size = 2

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,42 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[BUG]: "
+labels: 'bug, status: unverified'
+assignees: ''
+
+---
+
+Questions? Discussions: https://phalcon.io/discussions or Discord: https://phalcon.io/discord
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+> Provide output if related.
+
+Steps to reproduce the behavior:
+
+```php
+// paste output here
+```
+
+> Provide minimal script to reproduce the issue
+
+```php
+// paste output here
+```
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Details**
+ - Phalcon version: (`php --ri phalcon`)
+ - PHP Version: (`php -v`)
+ - Operating System:
+ - Installation type: Compiling from source || installing via package manager
+ - Server: Nginx | Apache | Other
+ - Other related info (Database, table schema):
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: "[NFR]: "
+labels: new feature request
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Keep the SHA-pinned GitHub Actions current. Dependabot opens reviewable
+  # pull requests that bump both the commit SHA and the trailing "# version"
+  # comment; it never merges on its own.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "docker"
+    directory: "/resources/docker"
+    schedule:
+      interval: "weekly"

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+Hello!
+
+* Type: bug fix | new feature | code quality | documentation
+* Link to issue:
+
+**In raising this pull request, I confirm the following:**
+
+- [ ] I have read and understood the [Contributing Guidelines](https://github.com/phalcon/debugbar/blob/master/CONTRIBUTING.md)
+- [ ] I have checked that another pull request for this purpose does not exist
+- [ ] I wrote some tests for this PR
+- [ ] I have updated the relevant CHANGELOG
+- [ ] I have created a PR for the documentation about this change
+
+Small description of change:
+
+Thanks

.github/workflows/docker-build.yml

@@ -0,0 +1,38 @@
+name: "Docker build"
+
+on:
+  push:
+    paths:
+      - 'resources/docker/**'
+      - 'docker-compose.yml'
+      - '.github/workflows/docker-build.yml'
+  pull_request:
+    paths:
+      - 'resources/docker/**'
+      - 'docker-compose.yml'
+  workflow_dispatch:
+
+permissions: { }
+
+jobs:
+  build:
+    name: "Build image (PHP ${{ matrix.php }}, ${{ matrix.variant }})"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.4', '8.5']
+        variant: ['v5', 'v6']
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: "Build the image"
+        run: |
+          docker build \
+            --file resources/docker/Dockerfile \
+            --build-arg PHP_VERSION=${{ matrix.php }} \
+            --build-arg PHALCON_VARIANT=${{ matrix.variant }} \
+            --tag debugbar:php${{ matrix.php }}-${{ matrix.variant }} \
+            .

.github/workflows/main.yml

@@ -0,0 +1,149 @@
+name: "Phalcon DebugBar CI"
+
+on:
+  push:
+    paths-ignore:
+      - '**.md'
+      - '**.txt'
+  pull_request:
+  workflow_dispatch:
+
+env:
+  # Phalcon v5 C extension constraint (installed from source via PIE)
+  PHALCON_CONSTRAINT: "^5.0"
+  EXTENSIONS: "fileinfo, json, mbstring, pdo, xml"
+
+permissions: { }
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
+jobs:
+  quality:
+    name: "Code quality"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: ${{ env.EXTENSIONS }}
+          tools: composer:v2
+
+      # Quality tools do not need the Phalcon extension: phpstan analyses the
+      # phalcon/phalcon (v6) source pulled in by Composer.
+      - name: "Validate composer"
+        run: composer validate --no-check-all --no-check-publish
+
+      - name: "Install dependencies"
+        uses: ramsey/composer-install@v4
+        with:
+          composer-options: "--prefer-dist"
+
+      - name: "PHPCS"
+        run: composer cs
+
+      - name: "PHPStan"
+        run: composer analyze
+
+      - name: "PHP CS Fixer (dry-run)"
+        run: composer cs-fixer
+
+  tests:
+    name: "Tests (PHP ${{ matrix.php }}, Phalcon ${{ matrix.variant }})"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    needs:
+      - quality
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.1', '8.2', '8.3', '8.4', '8.5']
+        variant:
+          # v5 = cphalcon C extension; v6 = phalcon/phalcon composer package
+          - 'v5'
+          - 'v6'
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: ${{ env.EXTENSIONS }}
+          tools: composer:v2
+
+      # v5 = cphalcon C extension, built from source via PIE (pecl caps at PHP 8.4).
+      # v6 needs no extension: it runs on the phalcon/phalcon composer dev dependency.
+      - name: "Install Phalcon v5 (cphalcon) via PIE"
+        if: matrix.variant == 'v5'
+        run: |
+          curl -fsSL https://github.com/php/pie/releases/latest/download/pie.phar -o pie.phar
+          sudo "$(which php)" pie.phar install --no-interaction "phalcon/cphalcon:${{ env.PHALCON_CONSTRAINT }}"
+          php -m | grep -i phalcon
+
+      - name: "Install dependencies"
+        uses: ramsey/composer-install@v4
+        with:
+          composer-options: "--prefer-dist"
+
+      - name: "Tests"
+        run: composer test
+
+  coverage:
+    name: "Coverage"
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
+    runs-on: ubuntu-latest
+    needs:
+      - quality
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # octocov uses full history for the base-branch diff.
+          fetch-depth: 0
+
+      # Coverage runs on the v6 composer package (no extension needed) with pcov.
+      - name: "Setup PHP"
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          extensions: ${{ env.EXTENSIONS }}
+          coverage: pcov
+          tools: composer:v2
+
+      - name: "Install dependencies"
+        uses: ramsey/composer-install@v4
+        with:
+          composer-options: "--prefer-dist"
+
+      - name: "Tests with coverage"
+        run: composer test-coverage
+
+      # SonarQube first (push only) so a failing octocov gate can't skip the upload.
+      - name: "SonarQube Scan"
+        if: github.event_name == 'push'
+        uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=phalcon
+            -Dsonar.projectKey=phalcon_debugbar
+            -Dsonar.sources=src
+            -Dsonar.tests=tests
+            -Dsonar.exclusions=resources/**
+            -Dsonar.php.coverage.reportPaths=tests/_output/coverage.xml
+
+      - name: "octocov"
+        uses: k1LoW/octocov-action@v1
+        with:
+          config: ${{ github.event_name == 'pull_request' && 'resources/octocov.pr.yml' || 'resources/octocov.yml' }}

.gitignore

@@ -1,2 +1,7 @@
-vendor/
+/vendor/
+/.phpunit.cache/
+/tests/_output/*
+!/tests/_output/.gitkeep
+.phpunit.result.cache
+.env
 composer.phar

CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog
+
+All notable changes to `phalcon/debugbar` are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- Migrated the `Phalcon\Debug` exception/error page component (`Debug`, `Dump`,
+  `ReportBuilder`, `HtmlRenderer`, the `Report` value objects, `Contracts`, and
+  the exception classes) out of the framework's `Phalcon\Support\Debug`, with its
+  full test suite carried over green under PHPStan level max, plus the
+  `debug.css` / `debug.js` page assets.
+- The web debug bar core: a `Provider` that boots the bar against an MVC
+  `Application` purely through its EventsManager — no DI service and no
+  container-specific wiring — and refuses to boot in blocked/production
+  environments. It attaches a `ResponseListener` on
+  `application:beforeSendResponse` that aggregates the collectors and injects the
+  bar into HTML responses, backed by the `DebugBar` aggregator and the
+  `Renderer` / `Injector` / `BarOptions` output pipeline.
+- A static `Debug` facade for manual instrumentation — `Debug::info()`,
+  `Debug::debug()`, `Debug::notice()`, `Debug::warning()`, `Debug::error()`,
+  `Debug::message()`, `Debug::startMeasure()` / `Debug::stopMeasure()`, and
+  `Debug::addException()` — that no-ops when no bar is registered.
+- Eleven collectors — `version`, `messages`, `time`, `exceptions`, `request`,
+  `route`, `database`, `view`, `cache`, `config`, and `session`. Streamed
+  collectors (database, view, route, cache) read their data off the event source
+  and never resolve services; snapshot collectors read injected objects
+  (`request`, `config`) or PHP state (`session`). Durations are measured with
+  `hrtime()`.
+- `Security\Redactor` with two tiers — masking the values of sensitive keys and
+  dropping configured "never shown" keys entirely — applied to the request,
+  config, and session collectors, plus `Security\AccessGate` (IP allowlist and
+  optional callback) restricting who receives the bar.
+- Per-collector enable/disable, asset, header, environment, access, and
+  redaction (`mask` / `hidden`) configuration on the `Provider`. The bar ships
+  under PHPStan level max with 100% line, method, and class coverage.

CODE_OF_CONDUCT.md

@@ -0,0 +1,25 @@
+# Contributor Covenant Code of Conduct
+
+## TL;DR
+
+Common sense rules. Treat people the same way you want to be treated.
+
+## Detail
+
+This is an open source project. Everyone and anyone is welcome to contribute
+to it as much or as little as they want to.
+
+Personal views of contributors have no effect on the project and should be
+kept in the personal realm not this project.
+
+It is a requirement to treat other contributors as well as maintainers with
+respect, when communicating in the realm of this project. It is OK to agree to
+disagree.
+
+## Conflict
+
+If ever conflict arises, please bring it to the attention of the maintainers
+privately. You can always find us on our [Discord](https://phalcon.io/discord)
+server or you can send us an email at [team@phalcon.io](mailto:team@phalcon.io)
+
+The core team maintains the final decision on any conflict that may arise.