Building a plugin

Building a plugin

Let's walk the path from an empty folder to a working plugin with a route, a controller and an admin menu item. It helps to keep plugins/leads/ in front of you.

Quick start: a blank plugin

To avoid starting from scratch, download a minimal working plugin:

Download the blank plugin (zip)

Inside: manifest.json, plugin.php (a public route /starter, an admin page /admin/starter, a sidebar item, a migration), controllers, an admin template, languages and docs/. Install it via Plugins → Install from zip and click "Enable" — or unzip the starter/ folder into plugins/. Then rename starter to your own slug.

A plugin slug must not contain a hyphen: it becomes a PHP namespace (Celena\Plugin\<Slug>), and hyphens aren't valid there. Use myplugin or my_plugin.

Below is how it all works, so you can build your own from scratch.

Where to start

  1. Pick a slug (latin letters, digits, hyphen), e.g. reviews.
  2. Create the folder plugins/reviews/ and inside it manifest.json and plugin.php.

manifest.json

{
  "slug": "reviews",
  "name": "Reviews",
  "version": "1.0.0",
  "author": "You",
  "description": "Customer reviews: intake from the front and moderation in the admin.",
  "requires": { "php": ">=8.3", "celena": ">=1.0" },
  "migrations": "migrations/"
}

plugin.php — the entry point

plugin.php is included when an active plugin loads. Here you register routes, hooks and tags. The container is available via Kernel::container().

<?php
declare(strict_types=1);

use Celena\Core\Http\Router;
use Celena\Core\Kernel;
use Celena\Core\Database\Connection;
use Celena\Core\Plugin\Hook;
use Celena\Plugin\Reviews\Controllers\ReviewsController;
use Celena\Plugin\Reviews\Admin\ReviewsAdminController;

$container = Kernel::container();

// 1. Idempotent migration run (if any).
try {
    $dir = __DIR__ . '/migrations';
    if (is_dir($dir)) {
        (new \Celena\Core\Database\MigrationRunner(
            $container->make(Connection::class),
            $container->make(\Celena\Core\Logger::class),
        ))->run($dir);
    }
} catch (\Throwable) {}

// 2. Routes.
$router = $container->make(Router::class);
$router->post('/api/reviews/submit', ReviewsController::class . '@submit');   // public
$router->get('/admin/reviews', ReviewsAdminController::class . '@index');      // admin

// 3. Admin sidebar item.
Hook::addFilter('admin.sidebar', function (array $items): array {
    $icon = new \Celena\Core\Template\Tags\IconTag();
    $items[] = [
        'svg'   => $icon(['name' => 'star', 'size' => 22, 'class' => 'sb-ico']),
        'label' => 'Reviews',
        'url'   => '/admin/reviews',
        'slug'  => 'reviews',
    ];
    return $items;
});
/admin/ routes are registered WITHOUT shared middleware — the controller checks authorization itself (see below). Public /api/ routes are open to everyone.

Controllers

PSR-4: the class Celena\Plugin\Reviews\Admin\ReviewsAdminController lives in plugins/reviews/src/Admin/ReviewsAdminController.php.

Admin controller

Extends Celena\Module\AdminBase\AdminController, which provides view(), redirect(), access to $this->auth, $this->options, and the shared admin layout:

<?php
declare(strict_types=1);

namespace Celena\Plugin\Reviews\Admin;

use Celena\Core\Database\Connection;
use Celena\Core\Http\Request;
use Celena\Core\Http\Response;
use Celena\Core\Template\Engine;
use Celena\Core\Security\Auth;
use Celena\Module\Settings\Options;
use Celena\Module\AdminBase\AdminController;

final class ReviewsAdminController extends AdminController
{
    public function __construct(Engine $engine, Auth $auth, Options $options, private readonly Connection $conn)
    {
        parent::__construct($engine, $auth, $options);
    }

    public function index(Request $request): Response
    {
        if ($this->auth->user() === null) {
            return Response::redirect('/admin/login');
        }
        $items = $this->conn->builder('reviews')->orderBy('created_at', 'desc')->get();
        return $this->view('plugins/reviews/admin/index', ['items' => $items], 'reviews', 'Reviews');
    }
}

$this->view($template, $vars, $activeMenu, $title) renders the template in the admin theme with the sidebar, notifications and current user.

Public controller

A front controller does not extend AdminController; dependencies arrive via the constructor (auto-injection):

namespace Celena\Plugin\Reviews\Controllers;

use Celena\Core\Database\Connection;
use Celena\Core\Http\Request;
use Celena\Core\Http\Response;
use Celena\Core\Security\Csrf;

final class ReviewsController
{
    public function __construct(private readonly Connection $conn) {}

    public function submit(Request $request): Response
    {
        if (!Csrf::validate((string) $request->input('_csrf'))) {
            return Response::json(['error' => 'csrf'], 419);
        }
        $this->conn->builder('reviews')->insert([
            'author'     => \Celena\Core\Security\Filter::string((string) $request->input('author')),
            'text'       => \Celena\Core\Security\Filter::string((string) $request->input('text')),
            'created_at' => date('Y-m-d H:i:s'),
        ]);
        return Response::json(['ok' => true]);
    }
}

Templates

Plugin templates live in plugins/reviews/templates/. The engine resolves them by the plugins/<slug>/ prefix:

$this->view('plugins/reviews/admin/index', …);
// → plugins/reviews/templates/admin/index.tpl

The active theme can override a template by creating templates/<theme>/plugins/reviews/admin/index.tpl.

Assets, languages, docs

  • assets/reviews.css and assets/reviews.js (name = slug) are included automatically by the {plugin_assets} tag. Other files — via a direct link /public/assets/plugins/reviews/....
  • languages/ru.json, languages/en.json are picked up automatically; use {lang key="reviews.x"}.
  • Add docs/README.md — it opens in the admin via the plugin documentation button.

Enabling

Go to Plugins, click "Enable" on your plugin — migrations run, plugin.php is included, assets are copied.

Next: Hooks & events, Migrations & database, Security.