Add ACP user deletion and split frontend bundles

.gitea/workflows/commit.yaml

@@ -6,47 +6,21 @@ on:
       - dev
       - master
 jobs:
-  stamp_build:
-    if: gitea.ref_name == 'master' && !contains(gitea.event.head_commit.message, '[skip ci]')
-    runs-on: self-hosted
-    steps:
-      - name: Stamp composer build from origin/master
-        env:
-          SPEEDBB_REPO: ${{ vars.SPEEDBB_REPO }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          GITEA_ACTOR: ${{ gitea.actor }}
-        run: |
-          set -e
-          REPO="$SPEEDBB_REPO"
-          if [ -n "$GITEA_TOKEN" ]; then
-            REPO=$(echo "$SPEEDBB_REPO" | sed "s#https://#https://${GITEA_ACTOR}:${GITEA_TOKEN}@#")
-          fi
-
-          git clone --quiet --branch=master "$REPO" repo
-          cd repo
-          git fetch origin master
-
-          BUILD="$(git rev-list --count origin/master)"
-          CURRENT="$(php -r 'echo (string) ((json_decode(file_get_contents("composer.json"), true)["build"] ?? ""));')"
-
-          if [ "$CURRENT" = "$BUILD" ]; then
-            echo "composer.json build already $BUILD; no changes."
-            exit 0
-          fi
-
-          BUILD="$BUILD" php -r '$p="composer.json"; $d=json_decode(file_get_contents($p), true); if (!is_array($d)) { fwrite(STDERR, "Invalid composer.json\n"); exit(1);} $d["build"]=getenv("BUILD"); file_put_contents($p, json_encode($d, JSON_PRETTY_PRINT|JSON_UNESCAPED_SLASHES).PHP_EOL);'
-
-          git config user.name "speedbb-ci"
-          git config user.email "ci@24unix.net"
-          git add composer.json
-          git commit -m "ci: sync composer build to ${BUILD} [skip ci]"
-          git push origin master
-
   deploy:
-    if: gitea.ref_name == 'master' && !contains(gitea.event.head_commit.message, '[skip ci]')
+    if: gitea.ref_name == 'master'
     runs-on: self-hosted
-    needs: stamp_build
     steps:
+      - name: Deploy start marker
+        run: |
+          echo "=== speedBB deploy started ==="
+          echo "time: $(date -u +'%Y-%m-%dT%H:%M:%SZ')"
+          echo "branch: ${{ gitea.ref_name }}"
+          echo "sha: ${{ gitea.sha }}"
+          echo "actor: ${{ gitea.actor }}"
+          echo "message: ${{ gitea.event.head_commit.message }}"
+          echo "runner: $(hostname)"
+          echo "=============================="
+
       - name: Custom Checkout
         env:
           ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
@@ -69,7 +43,7 @@ jobs:
           rm .vault_pass.txt
 
   promote_stable:
-    if: gitea.ref_name == 'master' && !contains(gitea.event.head_commit.message, '[skip ci]')
+    if: gitea.ref_name == 'master'
     runs-on: self-hosted
     needs: deploy
     steps:

.gitignore

@@ -27,6 +27,7 @@
 /storage/framework
 /storage/*.key
 /storage/pail
+/backups
 /storage/framework/views/*.php
 /bootstrap/cache/*.php
 /custom

.mailmap

@@ -0,0 +1,3 @@
+tracer <tracer@24unix.net> Micha <tracer@24unix.net>
+tracer <tracer@24unix.net> Micha <espey@smart-q.de>
+tracer <tracer@24unix.net> speedbb-ci <ci@24unix.net>

CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 2026-03-17
+- Added ACP user deletion end-to-end with admin/founder safeguards, self-delete protection, and backend test coverage.
+- Replaced the ACP user delete browser confirm with a project-style confirmation modal and refined its header/body layout.
+- Added inline clear (`x`) support to ACP user search inputs.
+- Lazy-loaded major SPA routes, including ACP, to reduce the initial frontend bundle size.
+- Added Vite manual vendor chunk splitting for ACP-heavy, React, router, UI, and i18n dependencies.
+
+## 2026-02-28
+- Updated ACP General to use section navigation with `Overview` as the default landing view and a dedicated `Settings` view.
+- Reorganized ACP General placeholders by moving `Client communication` and `Server configuration` into the Settings area as dedicated sub-tabs.
+- Added nested Settings tab grouping and bordered tab-content containers to match the ACP tabbed layout pattern.
+- Refined ACP tab visual states so inactive tabs render muted and active tabs use the configured accent color.
+- Standardized key ACP refresh actions with explicit icon + spacing so repeated controls render consistently.
+- Added icon support to additional primary UI actions (update modal/footer actions, auth screens, and forum/thread actions).
+- Synced board version/build display in stats from `composer.json` and added safe DB setting synchronization fallback logic.
+- Applied global accent-based Bootstrap button variable overrides so primary button styling remains consistent across ACP and user-facing screens.
+
+## 2026-02-27
+- Reworked ACP System navigation into `Health` and `Updates`.
+- Moved update/version actions into the new `Updates` area and grouped update checks under `Live Update`, `CLI`, and `CI/CD`.
+- Added CLI PHP interpreter `Check` action (no persistence) plus save-time validation endpoint.
+- Updated CLI PHP save UX to keep persistent inline errors and avoid duplicate danger toasts.
+- Added iconized, accent-styled `Check` and `Save` actions in ACP CLI settings.
+- Fixed system-status PHP detection to avoid false positives when a configured CLI binary is invalid.
+- Switched `Health` PHP requirement checks to the web runtime interpreter (`PHP_BINARY`/`PHP_VERSION`) instead of configured CLI binary.
+- Limited `Health` checks to runtime-relevant items (removed `tar`/`rsync` from Health view).
+- Fixed `public/storage` symlink health check to correctly resolve absolute and relative symlink targets.
+
 ## 2026-02-24
 - Added login modal actions: `Cancel` button and accent-styled, right-aligned `Sign in` button.
 - Added functional `Forgot password?` flow with dedicated SPA route/page at `/reset-password`.
@@ -13,6 +41,12 @@
 - Added update info modal prompting users to refresh when a newer build is detected.
 - Tuned global dark mode palette to reduce overly bright text/surfaces in dark theme.
 - Refined accent button state styling (hover/active/focus) to avoid Bootstrap blue fallback and preserve contrast.
+- Fixed deployment storage path handling by ensuring `public/storage` symlink is created in Ansible.
+- Changed `version:fetch` to sync DB version/build from `composer.json` metadata (host git recount removed).
+- Updated runtime version/ping responses to prefer `composer.json` metadata over DB values to avoid drift.
+- Restored local `master` as build metadata source of truth by removing CI write-back to `master`.
+- Updated local pre-commit hook to stamp `composer.json` build from local git count and stage the file automatically.
+- Bumped forum version to `26.0.3`.
 
 ## 2026-02-18
 - Added CLI default PHP version detection to system status (`php_default_version`) using the CLI `php` binary.

README.md

@@ -1,7 +1,31 @@
-# SpeedBB Forum
+# speedBB
 
-Placeholder README for the forum application.
+speedBB is a modern forum application with a built-in Admin Control Panel (ACP), customizable branding, user/rank management, attachment support, and integrated update tooling.
 
-## Status
+## What It Does
 
-Work in progress.
+- Hosts classic forum discussions with categories, forums, topics, and replies.
+- Provides an ACP for everyday operations (settings, users, groups, ranks, attachments, and audit log).
+- Supports brand customization (name, theme, accents, logos, favicons).
+- Manages user media (avatars, rank badges, logos) with public delivery.
+- Includes built-in update and system-check workflows so admins can verify server health and apply updates from the ACP.
+
+## ACP Areas
+
+The ACP is organized into practical sections for day-to-day forum operations:
+
+- `General`: core board identity and visual setup (name, theme defaults, accents, logos, favicons).
+- `Forums`: structure and ordering of categories/forums.
+- `Users`: account overview and moderation/admin user management actions.
+- `Groups`: role and permission group administration.
+- `Ranks`: rank definitions and badge management.
+- `Attachments`: attachment policy and extension/group controls.
+- `Audit log`: activity trail for administrative actions.
+- `System`: split into `Health` (live website health checks) and `Updates` (update-readiness checks and update actions, including CLI interpreter validation).
+- `Custom`: space for project-specific custom assets/overrides.
+
+## Current Product Status
+
+- Active version: `26.0.3`
+- Forum + ACP features are in active use.
+- Health and update checks are integrated directly into ACP System.

ansible/roles/speedBB/tasks/main.yaml

@@ -33,6 +33,21 @@
     state: directory
     mode: "0775"
 
+- name: Migrate existing public/storage directory content before symlink
+  shell: |
+    set -e
+    cd "{{ prod_base_dir }}"
+    if [ -d public/storage ] && [ ! -L public/storage ]; then
+      if command -v rsync >/dev/null 2>&1; then
+        rsync -a public/storage/ storage/app/public/
+      else
+        cp -a public/storage/. storage/app/public/
+      fi
+      rm -rf public/storage
+    fi
+  args:
+    executable: /bin/bash
+
 - name: Ensure public storage symlink exists
   file:
     src: "{{ prod_base_dir }}/storage/app/public"

app/Http/Controllers/PingController.php

@@ -9,15 +9,38 @@ class PingController extends Controller
 {
     public function __invoke(): JsonResponse
     {
-        $build = Setting::query()->where('key', 'build')->value('value');
-        $reportedBuild = $build !== null ? ((int) $build) + 1 : 1;
+        $build = $this->readComposerBuild();
+        if ($build === null) {
+            $build = Setting::query()->where('key', 'build')->value('value');
+        }
 
         return response()->json([
             'connect' => 'ok',
             'version_status' => [
-                'build' => $reportedBuild,
+                'build' => $build !== null ? (int) $build : null,
             ],
             'notification_state' => false,
         ]);
     }
+
+    private function readComposerBuild(): ?int
+    {
+        $path = base_path('composer.json');
+        if (!is_file($path) || !is_readable($path)) {
+            return null;
+        }
+
+        $raw = file_get_contents($path);
+        if ($raw === false) {
+            return null;
+        }
+
+        $data = json_decode($raw, true);
+        if (!is_array($data)) {
+            return null;
+        }
+
+        $build = trim((string) ($data['build'] ?? ''));
+        return ctype_digit($build) ? (int) $build : null;
+    }
 }

app/Http/Controllers/SettingController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Models\Setting;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Symfony\Component\Process\Process;
 
 class SettingController extends Controller
 {
@@ -38,6 +39,12 @@ class SettingController extends Controller
         ]);
 
         $value = $data['value'] ?? '';
+        if ($data['key'] === 'system.php_binary') {
+            $validationError = $this->validatePhpBinarySetting($value);
+            if ($validationError !== null) {
+                return response()->json(['message' => $validationError], 422);
+            }
+        }
 
         $setting = Setting::updateOrCreate(
             ['key' => $data['key']],
@@ -67,6 +74,12 @@ class SettingController extends Controller
         $updated = [];
 
         foreach ($data['settings'] as $entry) {
+            if (($entry['key'] ?? '') === 'system.php_binary') {
+                $validationError = $this->validatePhpBinarySetting($entry['value'] ?? '');
+                if ($validationError !== null) {
+                    return response()->json(['message' => $validationError], 422);
+                }
+            }
             $setting = Setting::updateOrCreate(
                 ['key' => $entry['key']],
                 ['value' => $entry['value'] ?? '']
@@ -80,4 +93,66 @@ class SettingController extends Controller
 
         return response()->json($updated);
     }
+
+    public function validateSystemPhpBinary(Request $request): JsonResponse
+    {
+        $user = $request->user();
+        if (!$user || !$user->roles()->where('name', 'ROLE_ADMIN')->exists()) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+
+        $data = $request->validate([
+            'value' => ['required', 'string'],
+        ]);
+
+        $validationError = $this->validatePhpBinarySetting($data['value']);
+        if ($validationError !== null) {
+            return response()->json(['message' => $validationError], 422);
+        }
+
+        return response()->json([
+            'message' => 'PHP interpreter is valid.',
+        ]);
+    }
+
+    private function validatePhpBinarySetting(string $value): ?string
+    {
+        $binary = trim($value);
+        if ($binary === '' || $binary === 'php') {
+            return null;
+        }
+
+        if ($binary === 'keyhelp-php-domain') {
+            return '`keyhelp-php-domain` is disabled. Use a concrete binary (e.g. keyhelp-php84).';
+        }
+
+        $resolved = null;
+        if (str_contains($binary, '/')) {
+            if (!is_executable($binary)) {
+                return "Configured PHP binary '{$binary}' is not executable.";
+            }
+            $resolved = $binary;
+        } else {
+            $escapedBinary = escapeshellarg($binary);
+            $process = new Process(['sh', '-lc', "command -v {$escapedBinary}"]);
+            $process->setTimeout(5);
+            $process->run();
+            if (!$process->isSuccessful()) {
+                return "Configured PHP binary '{$binary}' was not found in PATH.";
+            }
+            $resolved = trim($process->getOutput());
+            if ($resolved === '') {
+                return "Configured PHP binary '{$binary}' was not found in PATH.";
+            }
+        }
+
+        $phpCheck = new Process([$resolved, '-r', 'echo PHP_VERSION;']);
+        $phpCheck->setTimeout(5);
+        $phpCheck->run();
+        if (!$phpCheck->isSuccessful() || trim($phpCheck->getOutput()) === '') {
+            return "Configured binary '{$binary}' is not a working PHP CLI executable.";
+        }
+
+        return null;
+    }
 }

app/Http/Controllers/StatsController.php

@@ -32,8 +32,10 @@ class StatsController extends Controller
         $avatarSizeBytes = $this->resolveAvatarDirectorySize();
         $orphanAttachments = $this->resolveOrphanAttachments();
 
-        $version = Setting::query()->where('key', 'version')->value('value');
-        $build = Setting::query()->where('key', 'build')->value('value');
+        $composer = $this->readComposerMetadata();
+        $this->syncVersionBuildSettings($composer);
+        $version = $composer['version'] ?? Setting::query()->where('key', 'version')->value('value');
+        $build = $composer['build'] ?? Setting::query()->where('key', 'build')->value('value');
         $boardVersion = $version
             ? ($build ? "{$version} (build {$build})" : $version)
             : null;
@@ -158,4 +160,59 @@ class StatsController extends Controller
         $value = ini_get('zlib.output_compression');
         return in_array(strtolower((string) $value), ['1', 'on', 'true'], true);
     }
+
+    private function readComposerMetadata(): array
+    {
+        $path = base_path('composer.json');
+        if (!is_file($path) || !is_readable($path)) {
+            return [];
+        }
+
+        $raw = file_get_contents($path);
+        if ($raw === false) {
+            return [];
+        }
+
+        $data = json_decode($raw, true);
+        if (!is_array($data)) {
+            return [];
+        }
+
+        $version = trim((string) ($data['version'] ?? ''));
+        $build = trim((string) ($data['build'] ?? ''));
+
+        return [
+            'version' => $version !== '' ? $version : null,
+            'build' => ctype_digit($build) ? (int) $build : null,
+        ];
+    }
+
+    private function syncVersionBuildSettings(array $composer): void
+    {
+        $version = $composer['version'] ?? null;
+        $build = $composer['build'] ?? null;
+
+        if ($version === null && $build === null) {
+            return;
+        }
+
+        try {
+            if ($version !== null) {
+                $currentVersion = Setting::query()->where('key', 'version')->value('value');
+                if ((string) $currentVersion !== (string) $version) {
+                    Setting::updateOrCreate(['key' => 'version'], ['value' => (string) $version]);
+                }
+            }
+
+            if ($build !== null) {
+                $buildString = (string) $build;
+                $currentBuild = Setting::query()->where('key', 'build')->value('value');
+                if ((string) $currentBuild !== $buildString) {
+                    Setting::updateOrCreate(['key' => 'build'], ['value' => $buildString]);
+                }
+            }
+        } catch (\Throwable) {
+            // Stats endpoint should remain readable even if settings sync fails.
+        }
+    }
 }

app/Http/Controllers/SystemStatusController.php

@@ -19,11 +19,22 @@ class SystemStatusController extends Controller
         $phpDefaultPath = $this->resolveBinary('php');
         $phpDefaultVersion = $phpDefaultPath ? $this->resolvePhpVersion($phpDefaultPath) : null;
         $phpConfiguredPath = trim((string) Setting::where('key', 'system.php_binary')->value('value'));
-        $phpSelectedPath = $phpConfiguredPath ?: (PHP_BINARY ?: $phpDefaultPath);
-        $phpSelectedOk = (bool) $phpSelectedPath;
-        $phpSelectedVersion = $phpSelectedPath
-            ? ($this->resolvePhpVersion($phpSelectedPath) ?? PHP_VERSION)
-            : PHP_VERSION;
+        $phpSelectedPath = null;
+        $phpSelectedVersion = null;
+        $phpSelectedOk = false;
+
+        if ($phpConfiguredPath !== '') {
+            $resolvedConfiguredPhpPath = $this->resolveConfiguredPhpBinaryPath($phpConfiguredPath);
+            $phpSelectedPath = $resolvedConfiguredPhpPath ?: $phpConfiguredPath;
+            $phpSelectedVersion = $resolvedConfiguredPhpPath ? $this->resolvePhpVersion($resolvedConfiguredPhpPath) : null;
+            $phpSelectedOk = $resolvedConfiguredPhpPath !== null && $phpSelectedVersion !== null;
+        } else {
+            $phpSelectedPath = PHP_BINARY ?: $phpDefaultPath;
+            $phpSelectedVersion = $phpSelectedPath
+                ? ($this->resolvePhpVersion($phpSelectedPath) ?? $phpDefaultVersion ?? PHP_VERSION)
+                : null;
+            $phpSelectedOk = $phpSelectedPath !== null && $phpSelectedVersion !== null;
+        }
         $minVersions = $this->resolveMinVersions();
         $composerPath = $this->resolveBinary('composer');
         $nodePath = $this->resolveBinary('node');
@@ -44,6 +55,8 @@ class SystemStatusController extends Controller
 
         return response()->json([
             'php' => PHP_VERSION,
+            'php_web_path' => PHP_BINARY ?: null,
+            'php_web_version' => PHP_VERSION ?: null,
             'php_default' => $phpDefaultPath,
             'php_default_version' => $phpDefaultVersion,
             'php_configured' => $phpConfiguredPath ?: null,
@@ -63,10 +76,36 @@ class SystemStatusController extends Controller
             'rsync_version' => $this->resolveBinaryVersion($rsyncPath, ['--version']),
             'proc_functions' => $procFunctionStatus,
             'storage_writable' => is_writable(storage_path()),
+            'storage_public_linked' => $this->isPublicStorageLinked(),
             'updates_writable' => is_writable(storage_path('app/updates')) || @mkdir(storage_path('app/updates'), 0755, true),
         ]);
     }
 
+    private function isPublicStorageLinked(): bool
+    {
+        $publicStorage = public_path('storage');
+        $storagePublic = storage_path('app/public');
+
+        if (!is_link($publicStorage)) {
+            return false;
+        }
+
+        $target = readlink($publicStorage);
+        if ($target === false) {
+            return false;
+        }
+
+        $targetPath = $target;
+        if (!str_starts_with($target, DIRECTORY_SEPARATOR) && !preg_match('/^[A-Za-z]:[\\\\\\/]/', $target)) {
+            $targetPath = dirname($publicStorage) . DIRECTORY_SEPARATOR . $target;
+        }
+
+        $resolvedTarget = realpath($targetPath);
+        $expectedTarget = realpath($storagePublic);
+
+        return $resolvedTarget !== false && $expectedTarget !== false && $resolvedTarget === $expectedTarget;
+    }
+
     private function resolveBinary(string $name): ?string
     {
         $process = new Process(['sh', '-lc', "command -v {$name}"]);
@@ -95,6 +134,20 @@ class SystemStatusController extends Controller
         return $output !== '' ? $output : null;
     }
 
+    private function resolveConfiguredPhpBinaryPath(string $binary): ?string
+    {
+        $value = trim($binary);
+        if ($value === '') {
+            return null;
+        }
+
+        if (str_contains($value, '/')) {
+            return is_executable($value) ? $value : null;
+        }
+
+        return $this->resolveBinary($value);
+    }
+
     private function resolveBinaryVersion(?string $path, array $args): ?string
     {
         if (!$path) {

app/Http/Controllers/SystemUpdateController.php

@@ -8,6 +8,7 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
+use RuntimeException;
 use Symfony\Component\Process\Process;
 
 class SystemUpdateController extends Controller
@@ -113,7 +114,7 @@ class SystemUpdateController extends Controller
             $append('Syncing files...');
             $usedRsync = false;
             $rsyncPath = trim((string) shell_exec('command -v rsync'));
-            $protectedPaths = ['custom', 'public/custom'];
+            $protectedPaths = ['storage', 'public/storage', 'custom', 'public/custom'];
             if ($rsyncPath !== '') {
                 $usedRsync = true;
                 $rsync = new Process([
@@ -149,38 +150,9 @@ class SystemUpdateController extends Controller
                 File::copyDirectory($sourceDir, base_path());
             }
 
-            $append('Installing composer dependencies...');
-            $composer = new Process(['composer', 'install', '--no-dev', '--optimize-autoloader'], base_path());
-            $composer->setTimeout(600);
-            $composer->run();
-            if (!$composer->isSuccessful()) {
-                return response()->json([
-                    'message' => 'Composer install failed.',
-                    'log' => array_merge($log, [$composer->getErrorOutput()]),
-                ], 500);
-            }
+            $this->ensurePublicStorageLink();
 
-            $append('Installing npm dependencies...');
-            $npmInstall = new Process(['npm', 'install'], base_path());
-            $npmInstall->setTimeout(600);
-            $npmInstall->run();
-            if (!$npmInstall->isSuccessful()) {
-                return response()->json([
-                    'message' => 'npm install failed.',
-                    'log' => array_merge($log, [$npmInstall->getErrorOutput()]),
-                ], 500);
-            }
-
-            $append('Building assets...');
-            $npmBuild = new Process(['npm', 'run', 'build'], base_path());
-            $npmBuild->setTimeout(900);
-            $npmBuild->run();
-            if (!$npmBuild->isSuccessful()) {
-                return response()->json([
-                    'message' => 'npm run build failed.',
-                    'log' => array_merge($log, [$npmBuild->getErrorOutput()]),
-                ], 500);
-            }
+            $append('Using prebuilt release package (skipping composer/npm steps).');
 
             $phpBinary = trim((string) Setting::where('key', 'system.php_binary')->value('value'));
             if ($phpBinary === '') {
@@ -212,4 +184,39 @@ class SystemUpdateController extends Controller
             ], 500);
         }
     }
+
+    private function ensurePublicStorageLink(): void
+    {
+        $storagePublic = storage_path('app/public');
+        $publicStorage = public_path('storage');
+
+        if (file_exists($storagePublic) && !is_dir($storagePublic)) {
+            @rename($storagePublic, $storagePublic.'.bak.'.date('Ymd_His'));
+        }
+        if (!is_dir($storagePublic) && !@mkdir($storagePublic, 0775, true) && !is_dir($storagePublic)) {
+            throw new RuntimeException('Failed to prepare storage/app/public directory.');
+        }
+
+        if (is_link($publicStorage)) {
+            $target = readlink($publicStorage);
+            $resolved = $target !== false ? realpath(dirname($publicStorage).DIRECTORY_SEPARATOR.$target) : false;
+            $expected = realpath($storagePublic);
+            if ($resolved !== $expected) {
+                @unlink($publicStorage);
+            }
+        } elseif (is_dir($publicStorage)) {
+            File::copyDirectory($publicStorage, $storagePublic);
+            File::deleteDirectory($publicStorage);
+        } elseif (file_exists($publicStorage)) {
+            @rename($publicStorage, $publicStorage.'.bak.'.date('Ymd_His'));
+        }
+
+        if (!is_link($publicStorage) && !@symlink($storagePublic, $publicStorage)) {
+            throw new RuntimeException('Failed to recreate public/storage symlink.');
+        }
+
+        foreach (['avatars', 'logos', 'favicons', 'rank-badges'] as $dir) {
+            File::ensureDirectoryExists($storagePublic.DIRECTORY_SEPARATOR.$dir);
+        }
+    }
 }

app/Http/Controllers/UploadController.php

@@ -4,7 +4,9 @@ namespace App\Http\Controllers;
 
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Storage;
+use RuntimeException;
 
 class UploadController extends Controller
 {
@@ -14,6 +16,7 @@ class UploadController extends Controller
         if (!$user) {
             return response()->json(['message' => 'Unauthorized'], 401);
         }
+        $this->ensurePublicStorageReady();
 
         $data = $request->validate([
             'file' => [
@@ -45,6 +48,7 @@ class UploadController extends Controller
         if (!$user || !$user->roles()->where('name', 'ROLE_ADMIN')->exists()) {
             return response()->json(['message' => 'Forbidden'], 403);
         }
+        $this->ensurePublicStorageReady();
 
         $data = $request->validate([
             'file' => ['required', 'file', 'mimes:jpg,jpeg,png,gif,webp,svg,ico', 'max:5120'],
@@ -64,6 +68,7 @@ class UploadController extends Controller
         if (!$user || !$user->roles()->where('name', 'ROLE_ADMIN')->exists()) {
             return response()->json(['message' => 'Forbidden'], 403);
         }
+        $this->ensurePublicStorageReady();
 
         $data = $request->validate([
             'file' => ['required', 'file', 'mimes:png,ico', 'max:2048'],
@@ -76,4 +81,49 @@ class UploadController extends Controller
             'url' => Storage::url($path),
         ]);
     }
+
+    private function ensurePublicStorageReady(): void
+    {
+        $storagePublic = storage_path('app/public');
+        $publicStorage = public_path('storage');
+
+        if (file_exists($storagePublic) && !is_dir($storagePublic)) {
+            @rename($storagePublic, $storagePublic.'.bak.'.date('Ymd_His'));
+        }
+        if (!is_dir($storagePublic) && !@mkdir($storagePublic, 0775, true) && !is_dir($storagePublic)) {
+            throw new RuntimeException('Failed to create storage/app/public directory.');
+        }
+
+        if (is_link($publicStorage)) {
+            $target = readlink($publicStorage);
+            $resolved = $target !== false ? realpath(dirname($publicStorage).DIRECTORY_SEPARATOR.$target) : false;
+            $expected = realpath($storagePublic);
+            if ($resolved === $expected) {
+                $this->ensureUploadSubdirs($storagePublic);
+                return;
+            }
+            @unlink($publicStorage);
+        } elseif (is_dir($publicStorage)) {
+            File::copyDirectory($publicStorage, $storagePublic);
+            File::deleteDirectory($publicStorage);
+        } elseif (file_exists($publicStorage)) {
+            @rename($publicStorage, $publicStorage.'.bak.'.date('Ymd_His'));
+        }
+
+        if (!@symlink($storagePublic, $publicStorage) && !is_link($publicStorage)) {
+            throw new RuntimeException('Failed to create public/storage symlink.');
+        }
+
+        $this->ensureUploadSubdirs($storagePublic);
+    }
+
+    private function ensureUploadSubdirs(string $storagePublic): void
+    {
+        foreach (['avatars', 'favicons', 'logos', 'rank-badges'] as $dir) {
+            $path = $storagePublic.DIRECTORY_SEPARATOR.$dir;
+            if (!is_dir($path)) {
+                @mkdir($path, 0775, true);
+            }
+        }
+    }
 }

app/Http/Controllers/UserController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Models\Role;
 use App\Models\User;
+use App\Services\AuditLogger;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Storage;
@@ -232,6 +233,29 @@ class UserController extends Controller
         ]);
     }
 
+    public function destroy(Request $request, User $user): JsonResponse
+    {
+        $actor = $request->user();
+        if (!$actor || !$actor->roles()->where('name', 'ROLE_ADMIN')->exists()) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+        if ($this->isFounder($user) && !$this->isFounder($actor)) {
+            return response()->json(['message' => 'Forbidden'], 403);
+        }
+        if ($actor->is($user)) {
+            return response()->json(['message' => 'You cannot delete your own account.'], 422);
+        }
+
+        app(AuditLogger::class)->log($request, 'user.deleted', $user, [
+            'email' => $user->email,
+            'name' => $user->name,
+        ], $actor);
+
+        $user->delete();
+
+        return response()->json(null, 204);
+    }
+
     private function resolveAvatarUrl(User $user): ?string
     {
         if (!$user->avatar_path) {

app/Http/Controllers/VersionController.php

@@ -9,12 +9,39 @@ class VersionController extends Controller
 {
     public function __invoke(): JsonResponse
     {
-        $version = Setting::where('key', 'version')->value('value');
-        $build = Setting::where('key', 'build')->value('value');
+        $composer = $this->readComposerMetadata();
+        $version = $composer['version'] ?? Setting::where('key', 'version')->value('value');
+        $build = $composer['build'] ?? Setting::where('key', 'build')->value('value');
 
         return response()->json([
             'version' => $version,
             'build' => $build !== null ? (int) $build : null,
         ]);
     }
+
+    private function readComposerMetadata(): array
+    {
+        $path = base_path('composer.json');
+        if (!is_file($path) || !is_readable($path)) {
+            return [];
+        }
+
+        $raw = file_get_contents($path);
+        if ($raw === false) {
+            return [];
+        }
+
+        $data = json_decode($raw, true);
+        if (!is_array($data)) {
+            return [];
+        }
+
+        $version = trim((string) ($data['version'] ?? ''));
+        $build = trim((string) ($data['build'] ?? ''));
+
+        return [
+            'version' => $version !== '' ? $version : null,
+            'build' => ctype_digit($build) ? (int) $build : null,
+        ];
+    }
 }

composer.json

@@ -97,6 +97,6 @@
     },
     "minimum-stability": "stable",
     "prefer-stable": true,
-    "version": "26.0.2",
-    "build": "92"
+    "version": "26.0.3",
+    "build": "112"
 }

git_update.sh

@@ -20,6 +20,39 @@ resolve_php_bin() {
   echo "php"
 }
 
+ensure_storage_link() {
+  local storage_public="storage/app/public"
+  local public_storage="public/storage"
+
+  echo "Ensuring public storage link..."
+
+  if [[ -e "$storage_public" && ! -d "$storage_public" ]]; then
+    local backup_path="${storage_public}.bak.$(date +%Y%m%d_%H%M%S)"
+    echo "Found invalid $storage_public (not a directory). Backing up to $backup_path"
+    mv "$storage_public" "$backup_path"
+  fi
+
+  mkdir -p "$storage_public"
+
+  # If public/storage is a real directory, migrate files before converting to symlink.
+  if [[ -d "$public_storage" && ! -L "$public_storage" ]]; then
+    echo "Migrating existing files from $public_storage to $storage_public"
+    if command -v rsync >/dev/null 2>&1; then
+      rsync -a "$public_storage"/ "$storage_public"/
+    else
+      cp -a "$public_storage"/. "$storage_public"/
+    fi
+    rm -rf "$public_storage"
+  elif [[ -e "$public_storage" && ! -L "$public_storage" ]]; then
+    local public_backup="${public_storage}.bak.$(date +%Y%m%d_%H%M%S)"
+    echo "Found invalid $public_storage (not a directory/symlink). Backing up to $public_backup"
+    mv "$public_storage" "$public_backup"
+  fi
+
+  ln -sfn ../storage/app/public "$public_storage"
+  mkdir -p "$storage_public/logos" "$storage_public/favicons" "$storage_public/rank-badges"
+}
+
 resolve_configured_php_bin() {
   local configured="${1:-}"
   local current="${2:-php}"
@@ -248,6 +281,8 @@ main() {
   echo "Running with PHP binary: $PHP_BIN artisan migrate --force"
   "$PHP_BIN" artisan migrate --force
 
+  ensure_storage_link
+
   echo "Syncing version/build to settings..."
   echo "Running with PHP binary: $PHP_BIN -r <read composer.json version>"
   VERSION="$("$PHP_BIN" -r '$c=json_decode(file_get_contents("composer.json"), true); echo $c["version"] ?? "";')"

resources/js/App.jsx

@@ -1,20 +1,21 @@
-import { useEffect, useRef, useState } from 'react'
+import { Suspense, lazy, useEffect, useRef, useState } from 'react'
 import { BrowserRouter, Link, Route, Routes, useLocation } from 'react-router-dom'
 import { Button, Container, Modal, NavDropdown } from 'react-bootstrap'
 import { AuthProvider, useAuth } from './context/AuthContext'
-import Home from './pages/Home'
-import ForumView from './pages/ForumView'
-import ThreadView from './pages/ThreadView'
-import Login from './pages/Login'
-import Register from './pages/Register'
-import ResetPassword from './pages/ResetPassword'
-import { Acp } from './pages/Acp'
-import BoardIndex from './pages/BoardIndex'
-import Ucp from './pages/Ucp'
-import Profile from './pages/Profile'
 import { useTranslation } from 'react-i18next'
 import { fetchPing, fetchSettings, fetchVersion, getForum, getThread } from './api/client'
 
+const Home = lazy(() => import('./pages/Home'))
+const ForumView = lazy(() => import('./pages/ForumView'))
+const ThreadView = lazy(() => import('./pages/ThreadView'))
+const Login = lazy(() => import('./pages/Login'))
+const Register = lazy(() => import('./pages/Register'))
+const ResetPassword = lazy(() => import('./pages/ResetPassword'))
+const Acp = lazy(() => import('./pages/Acp').then((module) => ({ default: module.Acp ?? module.default })))
+const BoardIndex = lazy(() => import('./pages/BoardIndex'))
+const Ucp = lazy(() => import('./pages/Ucp'))
+const Profile = lazy(() => import('./pages/Profile'))
+
 function PortalHeader({
         userMenu,
         isAuthenticated,
@@ -271,7 +272,13 @@ function AppShell() {
                 favicon64: '',
                 favicon128: '',
                 favicon256: '',
-        })
+                })
+
+        const routeFallback = (
+                <Container fluid className="py-5">
+                        <p className="bb-muted mb-0">{t('acp.loading')}</p>
+                </Container>
+        )
 
         useEffect(() => {
                 fetchVersion()
@@ -535,28 +542,30 @@ function AppShell() {
                                 canAccessAcp={isAdmin}
                                 canAccessMcp={isModerator}
                         />
-                        <Routes>
-                                <Route path="/" element={<Home />} />
-                                <Route path="/forums" element={<BoardIndex />} />
-                                <Route path="/forum/:id" element={<ForumView />} />
-                                <Route path="/thread/:id" element={<ThreadView />} />
-                                <Route path="/login" element={<Login />} />
-                                <Route path="/reset-password" element={<ResetPassword />} />
-                                <Route path="/register" element={<Register />} />
-                                <Route path="/profile/:id" element={<Profile />} />
-                                <Route path="/acp/*" element={<Acp isAdmin={isAdmin} />} />
-                                <Route
-                                        path="/ucp"
-                                        element={
-                                                <Ucp
-                                                        theme={theme}
-                                                        setTheme={setTheme}
-                                                        accentOverride={accentOverride}
-                                                        setAccentOverride={setAccentOverride}
-                                                />
-                                        }
-                                />
-                        </Routes>
+                        <Suspense fallback={routeFallback}>
+                                <Routes>
+                                        <Route path="/" element={<Home />} />
+                                        <Route path="/forums" element={<BoardIndex />} />
+                                        <Route path="/forum/:id" element={<ForumView />} />
+                                        <Route path="/thread/:id" element={<ThreadView />} />
+                                        <Route path="/login" element={<Login />} />
+                                        <Route path="/reset-password" element={<ResetPassword />} />
+                                        <Route path="/register" element={<Register />} />
+                                        <Route path="/profile/:id" element={<Profile />} />
+                                        <Route path="/acp/*" element={<Acp isAdmin={isAdmin} />} />
+                                        <Route
+                                                path="/ucp"
+                                                element={
+                                                        <Ucp
+                                                                theme={theme}
+                                                                setTheme={setTheme}
+                                                                accentOverride={accentOverride}
+                                                                setAccentOverride={setAccentOverride}
+                                                        />
+                                                }
+                                        />
+                                </Routes>
+                        </Suspense>
                         <footer className="bb-footer">
                                 <div className="ms-3 d-flex align-items-center gap-3">
                                         <span>{t('footer.copy')}</span>
@@ -576,6 +585,7 @@ function AppShell() {
                                                         className="bb-accent-button"
                                                         onClick={() => window.location.reload()}
                                                 >
+                                                        <i className="bi bi-arrow-clockwise me-2" aria-hidden="true" />
                                                         {t('version.update_available_short')} (build {availableBuild}) ·{' '}
                                                         {t('version.update_now')}
                                                 </Button>
@@ -591,9 +601,11 @@ function AppShell() {
                                 </Modal.Body>
                                 <Modal.Footer className="justify-content-between">
                                         <Button variant="outline-secondary" onClick={() => setShowUpdateModal(false)}>
+                                                <i className="bi bi-clock me-2" aria-hidden="true" />
                                                 {t('version.remind_later')}
                                         </Button>
                                         <Button className="bb-accent-button" onClick={() => window.location.reload()}>
+                                                <i className="bi bi-arrow-repeat me-2" aria-hidden="true" />
                                                 {t('version.update_now')}
                                         </Button>
                                 </Modal.Footer>

resources/js/api/client.js

@@ -130,12 +130,7 @@ export async function fetchVersion() {
 }
 
 export async function fetchPing() {
-    const response = await fetch('/ping', {
-        headers: {
-            Accept: 'application/json',
-        },
-    })
-    return parseResponse(response)
+    return apiFetch('/ping')
 }
 
 export async function fetchVersionCheck() {
@@ -203,6 +198,13 @@ export async function saveSettings(settings) {
     })
 }
 
+export async function validateSystemPhpBinary(value) {
+    return apiFetch('/settings/system/php-binary/validate', {
+        method: 'POST',
+        body: JSON.stringify({ value }),
+    })
+}
+
 export async function uploadLogo(file) {
     const body = new FormData()
     body.append('file', file)
@@ -432,6 +434,12 @@ export async function listUsers() {
     return getCollection('/users')
 }
 
+export async function deleteUser(userId) {
+    return apiFetch(`/users/${userId}`, {
+        method: 'DELETE',
+    })
+}
+
 export async function listAuditLogs(limit = 200) {
     const query = Number.isFinite(limit) ? `?limit=${limit}` : ''
     return getCollection(`/audit-logs${query}`)

resources/js/index.css

@@ -947,7 +947,7 @@ a {
 }
 
 .nav-tabs .nav-link {
-  color: var(--bb-accent, #f29b3f);
+  color: var(--bb-ink-muted);
   border: 1px solid var(--bb-border);
   border-bottom-color: transparent;
   border-radius: 10px 10px 0 0;
@@ -956,7 +956,7 @@ a {
 }
 
 .nav-tabs .nav-link.active {
-  color: inherit;
+  color: var(--bb-accent, #f29b3f);
   background: rgba(255, 255, 255, 0.04);
   border-color: var(--bb-border);
   border-bottom-color: transparent;
@@ -975,7 +975,7 @@ a {
 }
 
 .bb-acp-action.btn-outline-dark {
-  --bs-btn-color: var(--bb-accent, #f29b3f);
+  --bs-btn-color: #0f1218;
   --bs-btn-border-color: var(--bb-accent, #f29b3f);
   --bs-btn-hover-color: #0f1218;
   --bs-btn-hover-bg: var(--bb-accent, #f29b3f);
@@ -984,7 +984,7 @@ a {
   --bs-btn-active-bg: var(--bb-accent, #f29b3f);
   --bs-btn-active-border-color: var(--bb-accent, #f29b3f);
   --bs-btn-focus-shadow-rgb: 242, 155, 63;
-  color: var(--bb-accent, #f29b3f) !important;
+  color: #0f1218 !important;
   border-color: var(--bb-accent, #f29b3f) !important;
 }
 
@@ -1072,7 +1072,7 @@ a {
 }
 
 [data-bs-theme="dark"] .bb-acp-action.btn-outline-dark {
-  --bs-btn-color: var(--bb-accent, #f29b3f);
+  --bs-btn-color: #0f1218;
   --bs-btn-border-color: var(--bb-accent, #f29b3f);
   --bs-btn-hover-color: #0f1218;
   --bs-btn-hover-bg: var(--bb-accent, #f29b3f);
@@ -1080,7 +1080,7 @@ a {
   --bs-btn-active-color: #0f1218;
   --bs-btn-active-bg: var(--bb-accent, #f29b3f);
   --bs-btn-active-border-color: var(--bb-accent, #f29b3f);
-  color: var(--bb-accent, #f29b3f) !important;
+  color: #0f1218 !important;
   border-color: var(--bb-accent, #f29b3f) !important;
 }
 
@@ -2227,6 +2227,25 @@ a {
   opacity: 0.6;
 }
 
+.btn:not(.btn-close) {
+  --bs-btn-bg: var(--bb-accent, #f29b3f) !important;
+  --bs-btn-border-color: var(--bb-accent, #f29b3f) !important;
+  --bs-btn-color: #0e121b !important;
+  --bs-btn-hover-bg: color-mix(in srgb, var(--bb-accent, #f29b3f) 85%, #000) !important;
+  --bs-btn-hover-border-color: color-mix(in srgb, var(--bb-accent, #f29b3f) 85%, #000) !important;
+  --bs-btn-hover-color: #fff !important;
+  --bs-btn-active-bg: color-mix(in srgb, var(--bb-accent, #f29b3f) 80%, #000) !important;
+  --bs-btn-active-border-color: color-mix(in srgb, var(--bb-accent, #f29b3f) 80%, #000) !important;
+  --bs-btn-active-color: #fff !important;
+  --bs-btn-disabled-bg: var(--bb-accent, #f29b3f) !important;
+  --bs-btn-disabled-border-color: var(--bb-accent, #f29b3f) !important;
+  --bs-btn-disabled-color: #0e121b !important;
+}
+
+.btn:not(.btn-close):focus-visible {
+  box-shadow: 0 0 0 0.2rem color-mix(in srgb, var(--bb-accent, #f29b3f) 35%, transparent);
+}
+
 .modal-content .modal-header {
   background: #0f1218;
   color: #e6e8eb;
@@ -2243,6 +2262,24 @@ a {
   margin: 0;
 }
 
+.bb-confirm-modal .modal-content .modal-header {
+  display: flex;
+  align-items: center;
+  justify-content: flex-start;
+}
+
+.bb-confirm-modal .modal-content .modal-title {
+  position: absolute;
+  left: 50%;
+  transform: translateX(-50%);
+  margin: 0;
+  max-width: none;
+  font-size: clamp(1.1rem, 2vw, 1.9rem);
+  line-height: 1.2;
+  text-align: center;
+  white-space: nowrap;
+}
+
 .modal-content .modal-header .btn-close {
   filter: none;
   opacity: 1;
@@ -2844,6 +2881,36 @@ a {
   max-width: 320px;
 }
 
+.bb-search-field {
+  position: relative;
+  width: 100%;
+  max-width: 320px;
+}
+
+.bb-search-field-input {
+  padding-right: 2.75rem;
+}
+
+.bb-search-clear {
+  position: absolute;
+  top: 50%;
+  right: 0.7rem;
+  transform: translateY(-50%);
+  border: 0;
+  background: transparent;
+  color: var(--bb-ink-muted);
+  padding: 0;
+  line-height: 1;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+
+.bb-search-clear:hover,
+.bb-search-clear:focus-visible {
+  color: var(--bb-accent, #f29b3f);
+}
+
 .bb-audit-limit {
   max-width: 120px;
 }

resources/js/pages/ForumView.jsx

@@ -397,6 +397,7 @@ export default function ForumView() {
                     className={`bb-attachment-tab ${attachmentTab === 'options' ? 'is-active' : ''}`}
                     onClick={() => setAttachmentTab('options')}
                 >
+                    <i className="bi bi-sliders me-2" aria-hidden="true" />
                     {t('attachment.tab_options')}
                 </button>
                 <button
@@ -404,6 +405,7 @@ export default function ForumView() {
                     className={`bb-attachment-tab ${attachmentTab === 'attachments' ? 'is-active' : ''}`}
                     onClick={() => setAttachmentTab('attachments')}
                 >
+                    <i className="bi bi-paperclip me-2" aria-hidden="true" />
                     {t('attachment.tab_attachments')}
                 </button>
             </div>
@@ -499,6 +501,7 @@ export default function ForumView() {
                                 variant="outline-secondary"
                                 onClick={() => document.getElementById('bb-thread-attachment-input')?.click()}
                             >
+                                <i className="bi bi-upload me-2" aria-hidden="true" />
                                 {t('attachment.add_files')}
                             </Button>
                         </div>
@@ -635,13 +638,14 @@ export default function ForumView() {
                                             </span>
                                             <div className="bb-topic-pagination">
                                                 <Button size="sm" variant="outline-secondary" disabled>
-                                                    ‹
+                                                    <i className="bi bi-chevron-left" aria-hidden="true" />
                                                 </Button>
                                                 <Button size="sm" variant="outline-secondary" className="is-active" disabled>
+                                                    <i className="bi bi-dot me-1" aria-hidden="true" />
                                                     1
                                                 </Button>
                                                 <Button size="sm" variant="outline-secondary" disabled>
-                                                    ›
+                                                    <i className="bi bi-chevron-right" aria-hidden="true" />
                                                 </Button>
                                             </div>
                                         </div>
@@ -755,6 +759,7 @@ export default function ForumView() {
                                             document.getElementById('bb-thread-attachment-input')?.click()
                                         }}
                                     >
+                                        <i className="bi bi-folder2-open me-2" aria-hidden="true" />
                                         {t('attachment.drop_browse')}
                                     </button>
                                 </span>
@@ -762,6 +767,7 @@ export default function ForumView() {
                             {renderAttachmentFooter()}
                             <Modal.Footer className="d-flex gap-2 justify-content-between mt-auto pt-2 px-0 border-0 mb-0 pb-0">
                                 <Button type="button" variant="outline-secondary" onClick={() => setShowModal(false)}>
+                                    <i className="bi bi-x-circle me-2" aria-hidden="true" />
                                     {t('acp.cancel')}
                                 </Button>
                                 <div className="d-flex gap-2">
@@ -771,6 +777,7 @@ export default function ForumView() {
                                         onClick={handlePreview}
                                         disabled={!token || saving || uploading || previewLoading}
                                     >
+                                        <i className="bi bi-eye me-2" aria-hidden="true" />
                                         {t('form.preview')}
                                     </Button>
                                     <Button
@@ -778,6 +785,7 @@ export default function ForumView() {
                                         className="bb-accent-button"
                                         disabled={!token || saving || uploading}
                                     >
+                                        <i className="bi bi-plus-circle me-2" aria-hidden="true" />
                                         {saving || uploading ? t('form.posting') : t('form.create_thread')}
                                     </Button>
                                 </div>

resources/js/pages/Login.jsx

@@ -59,9 +59,11 @@ export default function Login() {
                         </Form.Group>
                         <div className="d-flex w-100 align-items-center gap-2">
                             <Button as={Link} to="/" type="button" variant="outline-secondary" disabled={loading}>
+                                <i className="bi bi-x-circle me-2" aria-hidden="true" />
                                 {t('acp.cancel')}
                             </Button>
                             <Button type="submit" className="ms-auto bb-accent-button" disabled={loading}>
+                                <i className="bi bi-box-arrow-in-right me-2" aria-hidden="true" />
                                 {loading ? t('form.signing_in') : t('form.sign_in')}
                             </Button>
                         </div>

resources/js/pages/Register.jsx

@@ -70,6 +70,7 @@ export default function Register() {
                             />
                         </Form.Group>
                         <Button type="submit" variant="dark" disabled={loading}>
+                            <i className="bi bi-person-plus me-2" aria-hidden="true" />
                             {loading ? t('form.registering') : t('form.create_account')}
                         </Button>
                     </Form>

resources/js/pages/ResetPassword.jsx

@@ -93,9 +93,14 @@ export default function ResetPassword() {
                         )}
                         <div className="d-flex w-100 align-items-center gap-2">
                             <Button as={Link} to="/login" type="button" variant="outline-secondary" disabled={loading}>
+                                <i className="bi bi-x-circle me-2" aria-hidden="true" />
                                 {t('acp.cancel')}
                             </Button>
                             <Button type="submit" className="ms-auto bb-accent-button" disabled={loading}>
+                                <i
+                                    className={`bi ${isResetFlow ? 'bi-key-fill' : 'bi-envelope-arrow-up-fill'} me-2`}
+                                    aria-hidden="true"
+                                />
                                 {loading
                                     ? isResetFlow
                                         ? t('auth.resetting_password')

resources/js/pages/ThreadView.jsx

@@ -284,6 +284,7 @@ export default function ThreadView() {
                     className={`bb-attachment-tab ${replyAttachmentTab === 'options' ? 'is-active' : ''}`}
                     onClick={() => setReplyAttachmentTab('options')}
                 >
+                    <i className="bi bi-sliders me-2" aria-hidden="true" />
                     {t('attachment.tab_options')}
                 </button>
                 <button
@@ -291,6 +292,7 @@ export default function ThreadView() {
                     className={`bb-attachment-tab ${replyAttachmentTab === 'attachments' ? 'is-active' : ''}`}
                     onClick={() => setReplyAttachmentTab('attachments')}
                 >
+                    <i className="bi bi-paperclip me-2" aria-hidden="true" />
                     {t('attachment.tab_attachments')}
                 </button>
             </div>
@@ -374,6 +376,7 @@ export default function ThreadView() {
                                 variant="outline-secondary"
                                 onClick={() => document.getElementById('bb-reply-attachment-input')?.click()}
                             >
+                                <i className="bi bi-upload me-2" aria-hidden="true" />
                                 {t('attachment.add_files')}
                             </Button>
                         </div>
@@ -1040,6 +1043,7 @@ export default function ThreadView() {
                                             document.getElementById('bb-reply-attachment-input')?.click()
                                         }}
                                     >
+                                        <i className="bi bi-folder2-open me-2" aria-hidden="true" />
                                         {t('attachment.drop_browse')}
                                     </button>
                                 </span>
@@ -1053,6 +1057,7 @@ export default function ThreadView() {
                                         onClick={handlePreview}
                                         disabled={!token || saving || replyUploading || previewLoading}
                                     >
+                                        <i className="bi bi-eye me-2" aria-hidden="true" />
                                         {t('form.preview')}
                                     </Button>
                                     <Button
@@ -1060,6 +1065,7 @@ export default function ThreadView() {
                                         className="bb-accent-button"
                                         disabled={!token || saving || replyUploading}
                                     >
+                                        <i className="bi bi-reply-fill me-2" aria-hidden="true" />
                                         {saving || replyUploading ? t('form.posting') : t('form.post_reply')}
                                     </Button>
                                 </div>
@@ -1119,6 +1125,7 @@ export default function ThreadView() {
                 </Modal.Body>
                 <Modal.Footer className="justify-content-between">
                     <Button variant="outline-secondary" onClick={() => setEditPost(null)}>
+                        <i className="bi bi-x-circle me-2" aria-hidden="true" />
                         {t('acp.cancel')}
                     </Button>
                     <Button
@@ -1126,6 +1133,7 @@ export default function ThreadView() {
                         onClick={handleEditSave}
                         disabled={editSaving || !editBody.trim() || (editPost?.isRoot && !editTitle.trim())}
                     >
+                        <i className="bi bi-floppy me-2" aria-hidden="true" />
                         {editSaving ? t('form.saving') : t('acp.save')}
                     </Button>
                 </Modal.Footer>
@@ -1180,6 +1188,7 @@ export default function ThreadView() {
                         onClick={() => setDeleteTarget(null)}
                         disabled={deleteLoading}
                     >
+                        <i className="bi bi-x-circle me-2" aria-hidden="true" />
                         {t('acp.cancel')}
                     </Button>
                     <Button
@@ -1187,6 +1196,7 @@ export default function ThreadView() {
                         onClick={handleDeleteConfirm}
                         disabled={deleteLoading}
                     >
+                        <i className="bi bi-trash me-2" aria-hidden="true" />
                         {deleteLoading ? t('form.saving') : t('acp.delete')}
                     </Button>
                 </Modal.Footer>

resources/js/pages/Ucp.jsx

@@ -116,6 +116,7 @@ export default function Ucp({ theme, setTheme, accentOverride, setAccentOverride
                                 }
                             }}
                         >
+                            <i className="bi bi-floppy me-2" aria-hidden="true" />
                             {profileSaving ? t('form.saving') : t('ucp.save_profile')}
                         </Button>
                     </Col>

resources/lang/de.json

@@ -1,6 +1,7 @@
 {
   "acp.cancel": "Abbrechen",
   "acp.collapse_all": "Alle einklappen",
+  "acp.clear": "Leeren",
   "acp.create": "Erstellen",
   "acp.delete": "Löschen",
   "acp.drag_handle": "Zum Sortieren ziehen",
@@ -204,6 +205,7 @@
   "system.none": "Keine",
   "system.not_found": "Nicht gefunden",
   "system.storage_writable": "Storage beschreibbar",
+  "system.storage_linked": "Storage Public-Link",
   "system.updates_writable": "Updates beschreibbar",
   "system.ok": "OK",
   "system.not_ok": "Nicht OK",
@@ -233,6 +235,8 @@
   "user.impersonate": "Imitieren",
   "user.edit": "Bearbeiten",
   "user.delete": "Löschen",
+  "user.delete_title": "Benutzer löschen",
+  "user.delete_confirm": "Diesen Benutzer löschen? Das kann nicht rückgängig gemacht werden.",
   "user.founder_locked": "Nur Gründer können die Gründerrolle bearbeiten oder zuweisen.",
   "group.create": "Gruppe erstellen",
   "group.create_title": "Gruppe erstellen",

resources/lang/en.json

@@ -1,6 +1,7 @@
 {
   "acp.cancel": "Cancel",
   "acp.collapse_all": "Collapse all",
+  "acp.clear": "Clear",
   "acp.create": "Create",
   "acp.delete": "Delete",
   "acp.drag_handle": "Drag to reorder",
@@ -194,6 +195,7 @@
   "system.none": "None",
   "system.not_found": "Not found",
   "system.storage_writable": "Storage writable",
+  "system.storage_linked": "Storage public link",
   "system.updates_writable": "Updates writable",
   "system.ok": "OK",
   "system.not_ok": "Not OK",
@@ -233,6 +235,8 @@
   "user.impersonate": "Impersonate",
   "user.edit": "Edit",
   "user.delete": "Delete",
+  "user.delete_title": "Delete User",
+  "user.delete_confirm": "Delete this user? This cannot be undone.",
   "user.founder_locked": "Only founders can edit or assign the Founder role.",
   "group.create": "Create group",
   "group.create_title": "Create group",

routes/api.php

@@ -8,6 +8,7 @@ use App\Http\Controllers\AuthController;
 use App\Http\Controllers\ForumController;
 use App\Http\Controllers\I18nController;
 use App\Http\Controllers\PortalController;
+use App\Http\Controllers\PingController;
 use App\Http\Controllers\PostController;
 use App\Http\Controllers\PostThankController;
 use App\Http\Controllers\PreviewController;
@@ -35,6 +36,7 @@ Route::get('/email/verify/{id}/{hash}', [AuthController::class, 'verifyEmail'])
 Route::post('/logout', [AuthController::class, 'logout'])->middleware('auth:sanctum');
 Route::post('/user/password', [AuthController::class, 'updatePassword'])->middleware('auth:sanctum');
 
+Route::get('/ping', PingController::class);
 Route::get('/version', VersionController::class);
 Route::get('/version/check', VersionCheckController::class);
 Route::post('/system/update', SystemUpdateController::class)->middleware('auth:sanctum');
@@ -44,6 +46,7 @@ Route::get('/stats', StatsController::class);
 Route::get('/settings', [SettingController::class, 'index']);
 Route::post('/settings', [SettingController::class, 'store'])->middleware('auth:sanctum');
 Route::post('/settings/bulk', [SettingController::class, 'bulkStore'])->middleware('auth:sanctum');
+Route::post('/settings/system/php-binary/validate', [SettingController::class, 'validateSystemPhpBinary'])->middleware('auth:sanctum');
 Route::get('/audit-logs', [AuditLogController::class, 'index'])->middleware('auth:sanctum');
 Route::get('/user-settings', [UserSettingController::class, 'index'])->middleware('auth:sanctum');
 Route::post('/user-settings', [UserSettingController::class, 'store'])->middleware('auth:sanctum');
@@ -53,6 +56,7 @@ Route::post('/user/avatar', [UploadController::class, 'storeAvatar'])->middlewar
 Route::get('/i18n/{locale}', I18nController::class);
 Route::get('/users', [UserController::class, 'index'])->middleware('auth:sanctum');
 Route::patch('/users/{user}', [UserController::class, 'update'])->middleware('auth:sanctum');
+Route::delete('/users/{user}', [UserController::class, 'destroy'])->middleware('auth:sanctum');
 Route::get('/user/me', [UserController::class, 'me'])->middleware('auth:sanctum');
 Route::patch('/user/me', [UserController::class, 'updateMe'])->middleware('auth:sanctum');
 Route::get('/user/profile/{user}', [UserController::class, 'profile'])->middleware('auth:sanctum');

scripts/hooks/pre-commit

@@ -1,8 +1,28 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Keep commits possible when local DB is offline.
-if ! php artisan version:fetch >/dev/null 2>&1; then
-  echo "pre-commit: skipped 'php artisan version:fetch' (database unreachable)." >&2
-  echo "pre-commit: start MySQL and run it manually when needed." >&2
-fi
+# Stamp composer.json build from local git commit count on master/HEAD.
+BUILD="$(git rev-list --count master 2>/dev/null || git rev-list --count HEAD)"
+
+BUILD="$BUILD" php -r '
+$path = "composer.json";
+$data = json_decode(file_get_contents($path), true);
+if (!is_array($data)) {
+    fwrite(STDERR, "pre-commit: invalid composer.json\n");
+    exit(1);
+}
+$build = getenv("BUILD");
+if ($build === false || $build === "") {
+    fwrite(STDERR, "pre-commit: missing BUILD value\n");
+    exit(1);
+}
+$current = (string)($data["build"] ?? "");
+if ($current === $build) {
+    exit(0);
+}
+$data["build"] = $build;
+file_put_contents($path, json_encode($data, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . PHP_EOL);
+fwrite(STDOUT, "pre-commit: composer.json build updated to {$build}\n");
+'
+
+git add composer.json

tests/Feature/PingControllerTest.php

@@ -1,9 +1,8 @@
 <?php
 
-use App\Models\Setting;
-
 it('returns ping status with build and notification state', function (): void {
-    Setting::updateOrCreate(['key' => 'build'], ['value' => '1337']);
+    $composer = json_decode((string) file_get_contents(base_path('composer.json')), true);
+    $expectedBuild = isset($composer['build']) ? (int) $composer['build'] : null;
 
     $response = $this->getJson('/ping');
 
@@ -11,7 +10,7 @@ it('returns ping status with build and notification state', function (): void {
     $response->assertJson([
         'connect' => 'ok',
         'version_status' => [
-            'build' => 1337,
+            'build' => $expectedBuild,
         ],
         'notification_state' => false,
     ]);

tests/Feature/UserControllerTest.php

@@ -164,6 +164,39 @@ it('allows admins to update user rank', function (): void {
     expect($target->rank_id)->toBe($rank->id);
 });
 
+it('allows admins to delete users', function (): void {
+    $admin = makeAdmin();
+    $target = User::factory()->create();
+
+    Sanctum::actingAs($admin);
+    $response = $this->deleteJson("/api/users/{$target->id}");
+
+    $response->assertStatus(204);
+    $this->assertDatabaseMissing('users', ['id' => $target->id]);
+});
+
+it('forbids deleting founder user when actor is not founder', function (): void {
+    $admin = makeAdmin();
+    $founderRole = Role::firstOrCreate(['name' => 'ROLE_FOUNDER'], ['color' => '#111111']);
+    $founder = User::factory()->create();
+    $founder->roles()->attach($founderRole);
+
+    Sanctum::actingAs($admin);
+    $response = $this->deleteJson("/api/users/{$founder->id}");
+
+    $response->assertStatus(403);
+});
+
+it('prevents admins from deleting their own account', function (): void {
+    $admin = makeAdmin();
+
+    Sanctum::actingAs($admin);
+    $response = $this->deleteJson("/api/users/{$admin->id}");
+
+    $response->assertStatus(422);
+    $response->assertJsonFragment(['message' => 'You cannot delete your own account.']);
+});
+
 it('rejects update without admin role', function (): void {
     $user = User::factory()->create();
     $target = User::factory()->create();

tests/Feature/VersionControllerTest.php

@@ -1,16 +1,15 @@
 <?php
 
-use App\Models\Setting;
-
-it('returns version and build info', function (): void {
-    Setting::updateOrCreate(['key' => 'version'], ['value' => '1.2.3']);
-    Setting::updateOrCreate(['key' => 'build'], ['value' => '42']);
+it('returns version and build info from composer metadata', function (): void {
+    $composer = json_decode((string) file_get_contents(base_path('composer.json')), true);
+    $expectedVersion = (string) ($composer['version'] ?? '');
+    $expectedBuild = isset($composer['build']) ? (int) $composer['build'] : null;
 
     $response = $this->getJson('/api/version');
 
     $response->assertOk();
     $response->assertJsonFragment([
-        'version' => '1.2.3',
-        'build' => 42,
+        'version' => $expectedVersion,
+        'build' => $expectedBuild,
     ]);
 });

tests/Unit/SystemStatusControllerUnitTest.php

@@ -86,6 +86,7 @@ it('returns system status for admins', function (): void {
             'rsync_version',
             'proc_functions',
             'storage_writable',
+            'storage_public_linked',
             'updates_writable',
         ]);
     });

vite.config.js

@@ -10,6 +10,58 @@ export default defineConfig({
         }),
         react(),
     ],
+    build: {
+        rollupOptions: {
+            output: {
+                manualChunks(id) {
+                    if (!id.includes('/node_modules/')) {
+                        return undefined;
+                    }
+
+                    if (
+                        id.includes('/react-data-table-component/') ||
+                        id.includes('/react-dropzone/')
+                    ) {
+                        return 'acp-vendor';
+                    }
+
+                    if (
+                        id.includes('/react-router/') ||
+                        id.includes('/react-router-dom/') ||
+                        id.includes('/@remix-run/')
+                    ) {
+                        return 'router-vendor';
+                    }
+
+                    if (
+                        id.includes('/react/') ||
+                        id.includes('/react-dom/') ||
+                        id.includes('/scheduler/')
+                    ) {
+                        return 'react-vendor';
+                    }
+
+                    if (
+                        id.includes('/react-bootstrap/') ||
+                        id.includes('/bootstrap/') ||
+                        id.includes('/bootstrap-icons/')
+                    ) {
+                        return 'ui-vendor';
+                    }
+
+                    if (
+                        id.includes('/i18next/') ||
+                        id.includes('/react-i18next/') ||
+                        id.includes('/i18next-http-backend/')
+                    ) {
+                        return 'i18n-vendor';
+                    }
+
+                    return 'vendor';
+                },
+            },
+        },
+    },
     server: {
         watch: {
             ignored: ['**/storage/framework/views/**'],