# Building a plugin

Let's walk the path from an empty folder to a working plugin with a route, a controller and an admin menu item. It helps to keep `plugins/leads/` in front of you.

## Quick start: a blank plugin

To avoid starting from scratch, download a minimal working plugin:

**[Download the blank plugin (zip)](/public/assets/plugins/handbook/celena-starter-plugin.zip)**

Inside: `manifest.json`, `plugin.php` (a public route `/starter`, an admin page `/admin/starter`, a sidebar item, a migration), controllers, an admin template, languages and `docs/`. Install it via **Plugins → Install from zip** and click "Enable" — or unzip the `starter/` folder into `plugins/`. Then rename `starter` to your own slug.

> A plugin slug **must not contain a hyphen**: it becomes a PHP namespace (`Celena\Plugin\<Slug>`), and hyphens aren't valid there. Use `myplugin` or `my_plugin`.

Below is how it all works, so you can build your own from scratch.

## Where to start

1. Pick a `slug` (latin letters, digits, hyphen), e.g. `reviews`.
2. Create the folder `plugins/reviews/` and inside it `manifest.json` and `plugin.php`.

### manifest.json

```json
{
  "slug": "reviews",
  "name": "Reviews",
  "version": "1.0.0",
  "author": "You",
  "description": "Customer reviews: intake from the front and moderation in the admin.",
  "requires": { "php": ">=8.3", "celena": ">=1.0" },
  "migrations": "migrations/"
}
```

### plugin.php — the entry point

`plugin.php` is included when an active plugin loads. Here you register routes, hooks and tags. The container is available via `Kernel::container()`.

```php
<?php
declare(strict_types=1);

use Celena\Core\Http\Router;
use Celena\Core\Kernel;
use Celena\Core\Database\Connection;
use Celena\Core\Plugin\Hook;
use Celena\Plugin\Reviews\Controllers\ReviewsController;
use Celena\Plugin\Reviews\Admin\ReviewsAdminController;

$container = Kernel::container();

// 1. Idempotent migration run (if any).
try {
    $dir = __DIR__ . '/migrations';
    if (is_dir($dir)) {
        (new \Celena\Core\Database\MigrationRunner(
            $container->make(Connection::class),
            $container->make(\Celena\Core\Logger::class),
        ))->run($dir);
    }
} catch (\Throwable) {}

// 2. Routes.
$router = $container->make(Router::class);
$router->post('/api/reviews/submit', ReviewsController::class . '@submit');   // public
$router->get('/admin/reviews', ReviewsAdminController::class . '@index');      // admin

// 3. Admin sidebar item.
Hook::addFilter('admin.sidebar', function (array $items): array {
    $icon = new \Celena\Core\Template\Tags\IconTag();
    $items[] = [
        'svg'   => $icon(['name' => 'star', 'size' => 22, 'class' => 'sb-ico']),
        'label' => 'Reviews',
        'url'   => '/admin/reviews',
        'slug'  => 'reviews',
    ];
    return $items;
});
```

> `/admin/*` routes are registered WITHOUT shared middleware — the controller checks authorization itself (see below). Public `/api/*` routes are open to everyone.

## Controllers

PSR-4: the class `Celena\Plugin\Reviews\Admin\ReviewsAdminController` lives in `plugins/reviews/src/Admin/ReviewsAdminController.php`.

### Admin controller

Extends `Celena\Module\AdminBase\AdminController`, which provides `view()`, `redirect()`, access to `$this->auth`, `$this->options`, and the shared admin layout:

```php
<?php
declare(strict_types=1);

namespace Celena\Plugin\Reviews\Admin;

use Celena\Core\Database\Connection;
use Celena\Core\Http\Request;
use Celena\Core\Http\Response;
use Celena\Core\Template\Engine;
use Celena\Core\Security\Auth;
use Celena\Module\Settings\Options;
use Celena\Module\AdminBase\AdminController;

final class ReviewsAdminController extends AdminController
{
    public function __construct(Engine $engine, Auth $auth, Options $options, private readonly Connection $conn)
    {
        parent::__construct($engine, $auth, $options);
    }

    public function index(Request $request): Response
    {
        if ($this->auth->user() === null) {
            return Response::redirect('/admin/login');
        }
        $items = $this->conn->builder('reviews')->orderBy('created_at', 'desc')->get();
        return $this->view('plugins/reviews/admin/index', ['items' => $items], 'reviews', 'Reviews');
    }
}
```

`$this->view($template, $vars, $activeMenu, $title)` renders the template in the admin theme with the sidebar, notifications and current user.

### Public controller

A front controller does not extend `AdminController`; dependencies arrive via the constructor (auto-injection):

```php
namespace Celena\Plugin\Reviews\Controllers;

use Celena\Core\Database\Connection;
use Celena\Core\Http\Request;
use Celena\Core\Http\Response;
use Celena\Core\Security\Csrf;

final class ReviewsController
{
    public function __construct(private readonly Connection $conn) {}

    public function submit(Request $request): Response
    {
        if (!Csrf::validate((string) $request->input('_csrf'))) {
            return Response::json(['error' => 'csrf'], 419);
        }
        $this->conn->builder('reviews')->insert([
            'author'     => \Celena\Core\Security\Filter::string((string) $request->input('author')),
            'text'       => \Celena\Core\Security\Filter::string((string) $request->input('text')),
            'created_at' => date('Y-m-d H:i:s'),
        ]);
        return Response::json(['ok' => true]);
    }
}
```

## Templates

Plugin templates live in `plugins/reviews/templates/`. The engine resolves them by the `plugins/<slug>/` prefix:

```php
$this->view('plugins/reviews/admin/index', …);
// → plugins/reviews/templates/admin/index.tpl
```

The active theme can override a template by creating `templates/<theme>/plugins/reviews/admin/index.tpl`.

## Assets, languages, docs

- `assets/reviews.css` and `assets/reviews.js` (name = slug) are included automatically by the `{plugin_assets}` tag. Other files — via a direct link `/public/assets/plugins/reviews/...`.
- `languages/ru.json`, `languages/en.json` are picked up automatically; use `{lang key="reviews.x"}`.
- Add `docs/README.md` — it opens in the admin via the plugin documentation button.

## Enabling

Go to **Plugins**, click "Enable" on your plugin — migrations run, `plugin.php` is included, assets are copied.

Next: [Hooks & events](/docs/code/hooks), [Migrations & database](/docs/code/migrations), [Security](/docs/code/security).
