Personal Notes Manager

A lightweight, production-structured personal notes application.

• Frontend: PHP 8 — renders pages and handles the browser session cookie. No business logic.
• API: Perl (Plack/PSGI) — all authentication, validation, and data access.
• Database: SQLite, accessed exclusively from Perl.
• Client: HTML5, CSS3, vanilla JavaScript (progressive enhancement — every page works with JS disabled).

See docs/ARCHITECTURE.md for the full design (communication model, schema, API surface, auth flow, roadmap). This README covers the essentials.

Features

• User registration, login/logout, password hashing (Argon2id, Bcrypt fallback), session authentication.
• Create, edit, delete, archive, and restore notes.
• Categories with per-user uniqueness and color tags.
• Search across title and body.
• Sort (newest/oldest) and filter by category.
• Dashboard: total notes, recent notes, recently edited, category breakdown.
• Responsive layout (mobile-first CSS).

Quick start

# 1. Install Perl dependencies
cd backend
cpanm --installdeps .

# 2. Start the Perl API (binds to 127.0.0.1:5000 by default; applies
#    database migrations automatically on first run)
./bin/notes-manager-api

# 3. In another terminal, serve the PHP frontend
cd ../frontend
php -S 127.0.0.1:8080 -t public
php -S 0.0.0.0:8000 -t public --for wsl

# 4. Copy the example environment file
cd ..
cp .env.example .env

Visit http://127.0.0.1:8080 and register an account.

For production deployment (Starman, PHP-FPM + nginx, systemd units, TLS), see docs/INSTALL.md.

Project layout

notes-manager/
├── frontend/    PHP presentation layer (public/ is the web root)
├── backend/     Perl API (Plack/PSGI) — all business logic and data access
├── database/    SQL schema, migrations, dev seed data
├── storage/     Runtime SQLite file, logs, backups (not web-accessible)
└── docs/        Architecture, API reference, install guide, dev guide

Documentation

• docs/ARCHITECTURE.md — system design, schema, endpoint list, auth model, roadmap.
• docs/API.md — full REST API reference.
• docs/INSTALL.md — installation, configuration, and production deployment.
• docs/DEVELOPMENT.md — running tests, dev workflow, coding conventions.

Security notes

• Passwords are hashed with Argon2id (or Bcrypt if Argon2 is unavailable) — never stored or logged in plaintext.
• Every note/category query is scoped to the authenticated user at the database layer — see backend/lib/NotesManager/Model/.
• CSRF protection (synchronizer token) on every state-changing PHP request, layered on top of SameSite=Lax session cookies.
• The Perl API is intended to run on 127.0.0.1 only, reachable exclusively from the PHP frontend on the same host — never expose it directly to the internet.
• See docs/ARCHITECTURE.md §6 for the full authentication design.