inc/code-allowlist.php
Snapshot 2026.09.17-a2894de (current) · 24 lines · 1,999 bytes · tree · plain text
SHA-256
f2fc55c2c617ec89f3fcf07cafc8bdd8ecea9b1ba722094cee30eb1f3af29c6a| 1 | <?php |
| 2 | /* WEB-001: what the Code tab may show. Paths are relative to the Research Labs |
| 3 | application root. Anything not listed here never enters a snapshot; anything |
| 4 | listed under "never" is refused even if a later edit adds it to "include". |
| 5 | Installed to inc/code-allowlist.php by the AI platform's deploy hook; source |
| 6 | deploy/research/code-allowlist.php in districthive/ai. Shown in the tree. */ |
| 7 | return [ |
| 8 | /* Directories and files that are the platform: readers, streams, aggregation, provenance, pages, schema, scripts, the platform's own JavaScript and CSS. */ |
| 9 | 'include' => ['index.php', 'api.php', 'schema.sql', 'README.md', 'inc', 'pages', 'cron', 'docs', 'assets/app.js', 'assets/style.css'], |
| 10 | /* Refused always: credentials and their template, data, logs, the admin console (the write path, not part of how any published number is produced), the server diagnostic. */ |
| 11 | 'never' => ['config.php', 'config.sample.php', 'data', 'logs', 'admin', 'diagnose.php', 'install.php', '.env', '.htaccess', 'inc/snapshots'], |
| 12 | /* File-name patterns skipped inside included directories: editors' backups and the snapshots themselves. */ |
| 13 | 'skip_patterns' => ['/\.before-[a-z0-9-]+$/', '/~$/', '/\.bak$/', '/\.orig$/', '/^\./'], |
| 14 | 'extensions' => ['php', 'js', 'css', 'sql', 'md', 'txt', 'json'], |
| 15 | 'max_file_bytes' => 1000000, |
| 16 | /* Addresses that may appear (the company's own); every other e-mail address is redacted at snapshot time. */ |
| 17 | 'allowed_email_domains' => ['districthive.com'], |
| 18 | /* Strings that must never appear in a shown file: the deploy is refused if one is found. The values of the |
| 19 | configuration's own constants (database name and user, passwords, hashes, keys, tokens, hosts) are checked |
| 20 | as well, read from config.php at snapshot time and never written anywhere. */ |
| 21 | 'forbidden_strings' => ['BEGIN PRIVATE KEY', 'BEGIN RSA', 'BEGIN OPENSSH', 'sk-ant-'], |
| 22 | 'config_constant_pattern' => '/(PASS|SECRET|KEY|TOKEN|HASH|SALT|DB_NAME|DB_USER|DB_HOST|_HOST|CLIENT)$/', |
| 23 | ]; |
| 24 | |
Lines can be cited as inc/code-allowlist.php L120-L140, platform code 2026.09.17-a2894de; add #L120-L140 to this page's address to highlight them. Source shown for scrutiny of the research platform. All rights reserved. Not offered as installable software.