История коммитов

AlbumPhoto::query()->where(Closure) hands the closure an Eloquent\Builder,
not a Query\Builder, so the visibility filter threw a TypeError for
regular users on /album/users. Retype the closure parameter and drop the
now-unused QueryBuilder import.

Split legacy show action into ShowAlbumController (/album/{al}) and
ShowPhotoController (/album/photo/{img}). Add EnsureAlbumAccessUseCase
(private/password guard reused by comments/download), GetAlbumViewUseCase
and GetPhotoViewUseCase with result DTOs, PhotoPresenter::presentDetail,
and grow album/photo repositories. Rewrite templates onto DTOs with
output escaping. Update internal show links in remaining legacy includes
to /album/{al}; remove includes/show.php.

Replace the legacy ?act=list dispatcher action with UserAlbumsController.

- New route GET /album/user/{id} (album.user) with AuthorizedUserMiddleware
- GetUserAlbumsUseCase + UserAlbumsResultDTO hold album visibility and
create/manage permission rules (moderator >=6, admin >=7, max 20 albums)
- AlbumRepositoryInterface gains findUserById and getUserAlbums (withCount)
- AlbumOwnerNotFoundException maps a missing owner to the result page
- list.phtml rebuilt around discrete variables with output escaping
- Update internal/external links to /album/user/{id} (users list,
PhotoPresenter, album index, profile account/view, legacy back_urls)
- Fix legacy sort redirect that pointed to the removed list action

- Add TopController with GetTopUseCase, TopResultDTO and TopFilter enum (8 feeds)
- Add PhotoPresenter and PhotoViewDTO to replace legacy Albums\Photo accessors
- Add AlbumVoteRepository for batch vote checks; compute can_vote in the use case
- Extend AlbumPhoto repository with paginateTop (joinSub/correlated subqueries)
- Use path-segment URLs: /album/top and /album/top/{feed}
- Update top template to the DTO with output escaping
- Update album landing and external links (notifications, Counters) to new top URLs
- Remove legacy includes/top.php and its dispatcher entry

- Add UsersListController with GetUsersListUseCase and UsersListResultDTO
- Use path-segment URLs: /album/users and /album/users/{boys|girls}
- Extend Album/AlbumPhoto repositories with paginateOwnersBySex and countByUsers
- Update users template to discrete vars and simplified layout call
- Fix stale users links on the album landing page
- Remove legacy includes/users.php and its dispatcher entry

- Add AlbumIndexController with GetAlbumIndexUseCase and AlbumIndexDTO
- Add Album/AlbumPhoto repository interfaces and Eloquent implementations
- Add AuthorizedUserMiddleware; register GET /album as top-level route before legacy catch-all
- Update index template to consume the DTO and use absolute links
- Remove legacy includes/index.php and its dispatcher entry

- Add PSR-4 Johncms\Modules\Album\ mapping and config/services.php
- Move Installer to src/Install with Johncms\Modules\Album\Install namespace
- Add Eloquent models Album, AlbumPhoto, AlbumVote
- Add AlbumAccess enum normalizing legacy access values (3 -> Private)

All profile actions are migrated, so delete the legacy index.php dispatcher and drop the legacy profile.index route. Simplify the routes closure signature to (RouteCollection $router) since the User argument is no longer used.

Replace legacy skl.php with public RestorePasswordController and clean URLs under /profile/password-recovery (+ /set/{id}/{code}). Add SendPasswordRecoveryUseCase, GetRecoveryContextUseCase, CompletePasswordRecoveryUseCase, PasswordGenerator service, SendRecoveryCommand and PasswordRecoveryException.

Set-flow uses a confirmation form + POST instead of mutating on GET. Captcha validated via Validator. Extend ProfileUserRepository with findByNameLat/startPasswordRecovery/clearPasswordRecovery/completePasswordRecovery. Update 'Forgot password?' link in login.phtml; remove skl.php and restore_password_result.phtml.

Migrate ban/cancel/delete/clear-history actions and ban history to BanController under /profile/{id}/bans with dedicated use cases (BanUserUseCase, CancelBanUseCase, DeleteBanUseCase, ClearBanHistoryUseCase, GetBanHistoryUseCase, GetBanFormContextUseCase) and BanRepositoryInterface/EloquentBanRepository.

Add CSRF protection to all write actions; map rights guards to HTTP 403; align karma penalty rollback. Update links in view.phtml, GetProfileViewUseCase, notifications GetNotificationListUseCase and admin ban_panel.php. Remove legacy includes/ban.php; index.php reduced to pageNotFound().