Prepare TimeClock Pro for public open-source release

.gitattributes

@@ -0,0 +1,8 @@
+* text=auto eol=lf
+
+*.ico binary
+*.jpg binary
+*.jpeg binary
+*.png binary
+*.pdf binary
+*.zip binary

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,50 @@
+name: Bug report
+description: Report a reproducible problem without including private employee or server data.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: "Do not include credentials, employee information, production reports, or unsanitized logs. Report vulnerabilities through the Security tab."
+  - type: input
+    id: version
+    attributes:
+      label: TimeClock Pro version
+      placeholder: "For example: 1.0.0 or a commit SHA"
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Include PHP, database, web-server, and browser versions.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Provide the smallest sanitized sequence that reproduces the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: checkboxes
+    id: privacy
+    attributes:
+      label: Privacy confirmation
+      options:
+        - label: I removed credentials, employee information, reports, and other production data.
+          required: true
+

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,6 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/drumhead39/Timeclock-pro/security/advisories/new
+    about: Report vulnerabilities privately instead of opening a public issue.
+

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest an improvement for TimeClock Pro.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or need
+      description: Explain the workflow problem this feature would solve.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: contribution
+    attributes:
+      label: Contribution
+      options:
+        - label: I may be willing to help implement this feature.
+

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+Describe the purpose and scope of this change.
+
+## Verification
+
+Explain how the change was tested.
+
+## Checklist
+
+- [ ] PHP syntax checks pass.
+- [ ] Tests and documentation were updated where needed.
+- [ ] Authentication, authorization, and CSRF behavior were reviewed.
+- [ ] No credentials, employee information, logs, sessions, reports, or database exports are included.
+- [ ] The change is compatible with the documented PHP version.
+

.github/workflows/php-syntax.yml

@@ -1,4 +1,4 @@
-name: PHP syntax check
+name: PHP checks
 
 on:
   push:
@@ -8,7 +8,7 @@ permissions:
   contents: read
 
 jobs:
-  lint:
+  test:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
@@ -22,3 +22,16 @@ jobs:
       - name: Check PHP syntax
         run: find . -type f -name '*.php' -not -path './vendor/*' -print0 | xargs -0 -n1 php -l
 
+      - name: Run regression tests
+        run: php tests/TimeServiceTest.php
+
+      - name: Check repository hygiene
+        shell: bash
+        run: |
+          forbidden="$(git ls-files | grep -E '^(app/config\.php|public/(boot-test|diag|phpver)\.php|public/error_log|storage/DEBUG_ON|storage/.*\.(log|pdf)|storage/sessions/sess_)' || true)"
+          if [ -n "$forbidden" ]; then
+            echo "Production-only files were committed:"
+            echo "$forbidden"
+            exit 1
+          fi
+

.gitignore

@@ -14,6 +14,8 @@
 !/storage/reports/.gitkeep
 /storage/sessions/*
 !/storage/sessions/.gitkeep
+/storage/rate-limits/*
+!/storage/rate-limits/.gitkeep
 
 # Public diagnostic files and server logs
 /public/boot-test.php
@@ -27,4 +29,3 @@
 Thumbs.db
 .idea/
 .vscode/
-

.htaccess

@@ -1,8 +1,12 @@
-# If you place this entire folder under a web-accessible directory (e.g., public_html/timeclock-pro),
-# this helps keep private folders from being served.
-<IfModule mod_rewrite.c>
-  RewriteEngine On
-</IfModule>
-
-# Deny direct access to app, database, and storage folders if misconfigured
-RedirectMatch 403 ^/(app|database|storage|cron)(/|$)
+# If you place this entire folder under a web-accessible directory (e.g., public_html/timeclock-pro),
+# this helps keep private folders from being served.
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  RewriteRule ^(?:app|database|storage|cron|bin)(?:/|$) - [F,L,NC]
+</IfModule>
+
+<IfModule mod_authz_core.c>
+  <FilesMatch "(^\.|config\.php$|\.sql$|\.log$)">
+    Require all denied
+  </FilesMatch>
+</IfModule>

CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+Notable changes to TimeClock Pro are documented here.
+
+## Unreleased
+
+### Added
+
+- Complete fresh-install database schema
+- Command-line first-administrator setup
+- Login throttling
+- Open-source contribution and security documentation
+- Generic project icon and GitHub community templates
+- Regression checks for time-entry validation and repository hygiene
+
+### Security
+
+- Restricted the all-employee timecard overview to administrators
+- Added session ID and CSRF token rotation after login
+- Changed logout to a CSRF-protected POST request
+- Added strict time-entry date and time validation
+- Hid server filesystem paths from production error pages
+- Strengthened private-directory and security-header protection
+

CODE_OF_CONDUCT.md

@@ -0,0 +1,22 @@
+# Code of Conduct
+
+## Our commitment
+
+We are committed to providing a welcoming, respectful, and harassment-free project environment for everyone, regardless of experience, identity, background, or ability.
+
+## Expected behavior
+
+- Be respectful and constructive.
+- Focus criticism on ideas and code, not people.
+- Welcome questions and different experience levels.
+- Protect private information shared while diagnosing problems.
+- Accept moderation decisions intended to keep the project safe and productive.
+
+## Unacceptable behavior
+
+Harassment, threats, discrimination, deliberate intimidation, publishing private information, and sustained disruptive conduct are not acceptable.
+
+## Enforcement
+
+Project maintainers may edit or remove contributions and may temporarily or permanently restrict participation when this code is violated. Concerns should be reported privately to the repository owner.
+

CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing to TimeClock Pro
+
+Thank you for helping improve TimeClock Pro.
+
+## Before opening an issue
+
+- Search existing issues for the same problem or request.
+- Confirm the problem still occurs on the latest release or `main` branch.
+- Remove employee names, email addresses, credentials, server paths, and production data from screenshots and logs.
+- Report security vulnerabilities privately according to `SECURITY.md`.
+
+## Bug reports
+
+Include the PHP version, MySQL or MariaDB version, hosting environment, relevant steps, expected behavior, actual behavior, and sanitized error output.
+
+## Pull requests
+
+1. Create a focused branch from `main`.
+2. Keep the change limited to one concern.
+3. Preserve compatibility with PHP 8.0 unless a version change has been discussed.
+4. Use prepared database statements for all user-controlled values.
+5. Require authentication, authorization, and CSRF checks for sensitive actions.
+6. Add or update tests and documentation when behavior changes.
+7. Confirm that no configuration, employee data, reports, logs, or session files are included.
+8. Describe the change and its verification in the pull request.
+
+By contributing, you agree that your contribution will be licensed under GPLv3.
+