first commit

app/.htaccess

@@ -0,0 +1,6 @@
+<IfModule authz_core_module>
+	Require all denied
+</IfModule>
+<IfModule !authz_core_module>
+	Deny from all
+</IfModule>

app/Common.php

@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * The goal of this file is to allow developers a location
+ * where they can overwrite core procedural functions and
+ * replace them with their own. This file is loaded during
+ * the bootstrap process and is called during the framework's
+ * execution.
+ *
+ * This can be looked at as a `master helper` file that is
+ * loaded early on, and may also contain additional functions
+ * that you'd like to use throughout your entire application
+ *
+ * @see: https://codeigniter.com/user_guide/extending/common.html
+ */

app/Config/App.php

@@ -0,0 +1,202 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class App extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Base Site URL
+     * --------------------------------------------------------------------------
+     *
+     * URL to your CodeIgniter root. Typically, this will be your base URL,
+     * WITH a trailing slash:
+     *
+     * E.g., http://example.com/
+     */
+    public string $baseURL = 'http://localhost:8080/';
+
+    /**
+     * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
+     * If you want to accept multiple Hostnames, set this.
+     *
+     * E.g.,
+     * When your site URL ($baseURL) is 'http://example.com/', and your site
+     * also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
+     *     ['media.example.com', 'accounts.example.com']
+     *
+     * @var list<string>
+     */
+    public array $allowedHostnames = [];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Index File
+     * --------------------------------------------------------------------------
+     *
+     * Typically, this will be your `index.php` file, unless you've renamed it to
+     * something else. If you have configured your web server to remove this file
+     * from your site URIs, set this variable to an empty string.
+     */
+    public string $indexPage = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * URI PROTOCOL
+     * --------------------------------------------------------------------------
+     *
+     * This item determines which server global should be used to retrieve the
+     * URI string. The default setting of 'REQUEST_URI' works for most servers.
+     * If your links do not seem to work, try one of the other delicious flavors:
+     *
+     *  'REQUEST_URI': Uses $_SERVER['REQUEST_URI']
+     * 'QUERY_STRING': Uses $_SERVER['QUERY_STRING']
+     *    'PATH_INFO': Uses $_SERVER['PATH_INFO']
+     *
+     * WARNING: If you set this to 'PATH_INFO', URIs will always be URL-decoded!
+     */
+    public string $uriProtocol = 'REQUEST_URI';
+
+    /*
+    |--------------------------------------------------------------------------
+    | Allowed URL Characters
+    |--------------------------------------------------------------------------
+    |
+    | This lets you specify which characters are permitted within your URLs.
+    | When someone tries to submit a URL with disallowed characters they will
+    | get a warning message.
+    |
+    | As a security measure you are STRONGLY encouraged to restrict URLs to
+    | as few characters as possible.
+    |
+    | By default, only these are allowed: `a-z 0-9~%.:_-`
+    |
+    | Set an empty string to allow all characters -- but only if you are insane.
+    |
+    | The configured value is actually a regular expression character group
+    | and it will be used as: '/\A[<permittedURIChars>]+\z/iu'
+    |
+    | DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
+    |
+    */
+    public string $permittedURIChars = 'a-z 0-9~%.:_\-';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Default Locale
+     * --------------------------------------------------------------------------
+     *
+     * The Locale roughly represents the language and location that your visitor
+     * is viewing the site from. It affects the language strings and other
+     * strings (like currency markers, numbers, etc), that your program
+     * should run under for this request.
+     */
+    public string $defaultLocale = 'en';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Negotiate Locale
+     * --------------------------------------------------------------------------
+     *
+     * If true, the current Request object will automatically determine the
+     * language to use based on the value of the Accept-Language header.
+     *
+     * If false, no automatic detection will be performed.
+     */
+    public bool $negotiateLocale = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Supported Locales
+     * --------------------------------------------------------------------------
+     *
+     * If $negotiateLocale is true, this array lists the locales supported
+     * by the application in descending order of priority. If no match is
+     * found, the first locale will be used.
+     *
+     * IncomingRequest::setLocale() also uses this list.
+     *
+     * @var list<string>
+     */
+    public array $supportedLocales = ['en'];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Application Timezone
+     * --------------------------------------------------------------------------
+     *
+     * The default timezone that will be used in your application to display
+     * dates with the date helper, and can be retrieved through app_timezone()
+     *
+     * @see https://www.php.net/manual/en/timezones.php for list of timezones
+     *      supported by PHP.
+     */
+    public string $appTimezone = 'UTC';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Default Character Set
+     * --------------------------------------------------------------------------
+     *
+     * This determines which character set is used by default in various methods
+     * that require a character set to be provided.
+     *
+     * @see http://php.net/htmlspecialchars for a list of supported charsets.
+     */
+    public string $charset = 'UTF-8';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Force Global Secure Requests
+     * --------------------------------------------------------------------------
+     *
+     * If true, this will force every request made to this application to be
+     * made via a secure connection (HTTPS). If the incoming request is not
+     * secure, the user will be redirected to a secure version of the page
+     * and the HTTP Strict Transport Security (HSTS) header will be set.
+     */
+    public bool $forceGlobalSecureRequests = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Reverse Proxy IPs
+     * --------------------------------------------------------------------------
+     *
+     * If your server is behind a reverse proxy, you must whitelist the proxy
+     * IP addresses from which CodeIgniter should trust headers such as
+     * X-Forwarded-For or Client-IP in order to properly identify
+     * the visitor's IP address.
+     *
+     * You need to set a proxy IP address or IP address with subnets and
+     * the HTTP header for the client IP address.
+     *
+     * Here are some examples:
+     *     [
+     *         '10.0.1.200'     => 'X-Forwarded-For',
+     *         '192.168.5.0/24' => 'X-Real-IP',
+     *     ]
+     *
+     * @var array<string, string>
+     */
+    public array $proxyIPs = [];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Content Security Policy
+     * --------------------------------------------------------------------------
+     *
+     * Enables the Response's Content Secure Policy to restrict the sources that
+     * can be used for images, scripts, CSS files, audio, video, etc. If enabled,
+     * the Response object will populate default values for the policy from the
+     * `ContentSecurityPolicy.php` file. Controllers can always add to those
+     * restrictions at run time.
+     *
+     * For a better understanding of CSP, see these documents:
+     *
+     * @see http://www.html5rocks.com/en/tutorials/security/content-security-policy/
+     * @see http://www.w3.org/TR/CSP/
+     */
+    public bool $CSPEnabled = false;
+}

app/Config/Autoload.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\AutoloadConfig;
+
+/**
+ * -------------------------------------------------------------------
+ * AUTOLOADER CONFIGURATION
+ * -------------------------------------------------------------------
+ *
+ * This file defines the namespaces and class maps so the Autoloader
+ * can find the files as needed.
+ *
+ * NOTE: If you use an identical key in $psr4 or $classmap, then
+ *       the values in this file will overwrite the framework's values.
+ *
+ * NOTE: This class is required prior to Autoloader instantiation,
+ *       and does not extend BaseConfig.
+ */
+class Autoload extends AutoloadConfig
+{
+    /**
+     * -------------------------------------------------------------------
+     * Namespaces
+     * -------------------------------------------------------------------
+     * This maps the locations of any namespaces in your application to
+     * their location on the file system. These are used by the autoloader
+     * to locate files the first time they have been instantiated.
+     *
+     * The 'Config' (APPPATH . 'Config') and 'CodeIgniter' (SYSTEMPATH) are
+     * already mapped for you.
+     *
+     * You may change the name of the 'App' namespace if you wish,
+     * but this should be done prior to creating any namespaced classes,
+     * else you will need to modify all of those classes for this to work.
+     *
+     * @var array<string, list<string>|string>
+     */
+    public $psr4 = [
+        APP_NAMESPACE => APPPATH,
+    ];
+
+    /**
+     * -------------------------------------------------------------------
+     * Class Map
+     * -------------------------------------------------------------------
+     * The class map provides a map of class names and their exact
+     * location on the drive. Classes loaded in this manner will have
+     * slightly faster performance because they will not have to be
+     * searched for within one or more directories as they would if they
+     * were being autoloaded through a namespace.
+     *
+     * Prototype:
+     *   $classmap = [
+     *       'MyClass'   => '/path/to/class/file.php'
+     *   ];
+     *
+     * @var array<string, string>
+     */
+    public $classmap = [];
+
+    /**
+     * -------------------------------------------------------------------
+     * Files
+     * -------------------------------------------------------------------
+     * The files array provides a list of paths to __non-class__ files
+     * that will be autoloaded. This can be useful for bootstrap operations
+     * or for loading functions.
+     *
+     * Prototype:
+     *   $files = [
+     *       '/path/to/my/file.php',
+     *   ];
+     *
+     * @var list<string>
+     */
+    public $files = [];
+
+    /**
+     * -------------------------------------------------------------------
+     * Helpers
+     * -------------------------------------------------------------------
+     * Prototype:
+     *   $helpers = [
+     *       'form',
+     *   ];
+     *
+     * @var list<string>
+     */
+    public $helpers = [];
+}

app/Config/Boot/development.php

@@ -0,0 +1,34 @@
+<?php
+
+/*
+ |--------------------------------------------------------------------------
+ | ERROR DISPLAY
+ |--------------------------------------------------------------------------
+ | In development, we want to show as many errors as possible to help
+ | make sure they don't make it to production. And save us hours of
+ | painful debugging.
+ |
+ | If you set 'display_errors' to '1', CI4's detailed error report will show.
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', '1');
+
+/*
+ |--------------------------------------------------------------------------
+ | DEBUG BACKTRACES
+ |--------------------------------------------------------------------------
+ | If true, this constant will tell the error screens to display debug
+ | backtraces along with the other error information. If you would
+ | prefer to not see this, set this value to false.
+ */
+defined('SHOW_DEBUG_BACKTRACE') || define('SHOW_DEBUG_BACKTRACE', true);
+
+/*
+ |--------------------------------------------------------------------------
+ | DEBUG MODE
+ |--------------------------------------------------------------------------
+ | Debug mode is an experimental flag that can allow changes throughout
+ | the system. This will control whether Kint is loaded, and a few other
+ | items. It can always be used within your own application too.
+ */
+defined('CI_DEBUG') || define('CI_DEBUG', true);

app/Config/Boot/production.php

@@ -0,0 +1,25 @@
+<?php
+
+/*
+ |--------------------------------------------------------------------------
+ | ERROR DISPLAY
+ |--------------------------------------------------------------------------
+ | Don't show ANY in production environments. Instead, let the system catch
+ | it and display a generic error message.
+ |
+ | If you set 'display_errors' to '1', CI4's detailed error report will show.
+ */
+error_reporting(E_ALL & ~E_DEPRECATED);
+// If you want to suppress more types of errors.
+// error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT & ~E_USER_NOTICE & ~E_USER_DEPRECATED);
+ini_set('display_errors', '0');
+
+/*
+ |--------------------------------------------------------------------------
+ | DEBUG MODE
+ |--------------------------------------------------------------------------
+ | Debug mode is an experimental flag that can allow changes throughout
+ | the system. It's not widely used currently, and may not survive
+ | release of the framework.
+ */
+defined('CI_DEBUG') || define('CI_DEBUG', false);

app/Config/Boot/testing.php

@@ -0,0 +1,38 @@
+<?php
+
+/*
+ * The environment testing is reserved for PHPUnit testing. It has special
+ * conditions built into the framework at various places to assist with that.
+ * You can’t use it for your development.
+ */
+
+/*
+ |--------------------------------------------------------------------------
+ | ERROR DISPLAY
+ |--------------------------------------------------------------------------
+ | In development, we want to show as many errors as possible to help
+ | make sure they don't make it to production. And save us hours of
+ | painful debugging.
+ */
+error_reporting(E_ALL);
+ini_set('display_errors', '1');
+
+/*
+ |--------------------------------------------------------------------------
+ | DEBUG BACKTRACES
+ |--------------------------------------------------------------------------
+ | If true, this constant will tell the error screens to display debug
+ | backtraces along with the other error information. If you would
+ | prefer to not see this, set this value to false.
+ */
+defined('SHOW_DEBUG_BACKTRACE') || define('SHOW_DEBUG_BACKTRACE', true);
+
+/*
+ |--------------------------------------------------------------------------
+ | DEBUG MODE
+ |--------------------------------------------------------------------------
+ | Debug mode is an experimental flag that can allow changes throughout
+ | the system. It's not widely used currently, and may not survive
+ | release of the framework.
+ */
+defined('CI_DEBUG') || define('CI_DEBUG', true);

app/Config/CURLRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class CURLRequest extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * CURLRequest Share Connection Options
+     * --------------------------------------------------------------------------
+     *
+     * Share connection options between requests.
+     *
+     * @var list<int>
+     *
+     * @see https://www.php.net/manual/en/curl.constants.php#constant.curl-lock-data-connect
+     */
+    public array $shareConnectionOptions = [
+        CURL_LOCK_DATA_CONNECT,
+        CURL_LOCK_DATA_DNS,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * CURLRequest Share Options
+     * --------------------------------------------------------------------------
+     *
+     * Whether share options between requests or not.
+     *
+     * If true, all the options won't be reset between requests.
+     * It may cause an error request with unnecessary headers.
+     */
+    public bool $shareOptions = false;
+}

app/Config/Cache.php

@@ -0,0 +1,198 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Cache\CacheInterface;
+use CodeIgniter\Cache\Handlers\ApcuHandler;
+use CodeIgniter\Cache\Handlers\DummyHandler;
+use CodeIgniter\Cache\Handlers\FileHandler;
+use CodeIgniter\Cache\Handlers\MemcachedHandler;
+use CodeIgniter\Cache\Handlers\PredisHandler;
+use CodeIgniter\Cache\Handlers\RedisHandler;
+use CodeIgniter\Cache\Handlers\WincacheHandler;
+use CodeIgniter\Config\BaseConfig;
+
+class Cache extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Primary Handler
+     * --------------------------------------------------------------------------
+     *
+     * The name of the preferred handler that should be used. If for some reason
+     * it is not available, the $backupHandler will be used in its place.
+     */
+    public string $handler = 'file';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Backup Handler
+     * --------------------------------------------------------------------------
+     *
+     * The name of the handler that will be used in case the first one is
+     * unreachable. Often, 'file' is used here since the filesystem is
+     * always available, though that's not always practical for the app.
+     */
+    public string $backupHandler = 'dummy';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Key Prefix
+     * --------------------------------------------------------------------------
+     *
+     * This string is added to all cache item names to help avoid collisions
+     * if you run multiple applications with the same cache engine.
+     */
+    public string $prefix = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Default TTL
+     * --------------------------------------------------------------------------
+     *
+     * The default number of seconds to save items when none is specified.
+     *
+     * WARNING: This is not used by framework handlers where 60 seconds is
+     * hard-coded, but may be useful to projects and modules. This will replace
+     * the hard-coded value in a future release.
+     */
+    public int $ttl = 60;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Reserved Characters
+     * --------------------------------------------------------------------------
+     *
+     * A string of reserved characters that will not be allowed in keys or tags.
+     * Strings that violate this restriction will cause handlers to throw.
+     * Default: {}()/\@:
+     *
+     * NOTE: The default set is required for PSR-6 compliance.
+     */
+    public string $reservedCharacters = '{}()/\@:';
+
+    /**
+     * --------------------------------------------------------------------------
+     * File settings
+     * --------------------------------------------------------------------------
+     *
+     * Your file storage preferences can be specified below, if you are using
+     * the File driver.
+     *
+     * @var array{storePath?: string, mode?: int}
+     */
+    public array $file = [
+        'storePath' => WRITEPATH . 'cache/',
+        'mode'      => 0640,
+    ];
+
+    /**
+     * -------------------------------------------------------------------------
+     * Memcached settings
+     * -------------------------------------------------------------------------
+     *
+     * Your Memcached servers can be specified below, if you are using
+     * the Memcached drivers.
+     *
+     * @see https://codeigniter.com/user_guide/libraries/caching.html#memcached
+     *
+     * @var array{host?: string, port?: int, weight?: int, raw?: bool}
+     */
+    public array $memcached = [
+        'host'   => '127.0.0.1',
+        'port'   => 11211,
+        'weight' => 1,
+        'raw'    => false,
+    ];
+
+    /**
+     * -------------------------------------------------------------------------
+     * Redis settings
+     * -------------------------------------------------------------------------
+     *
+     * Your Redis server can be specified below, if you are using
+     * the Redis or Predis drivers.
+     *
+     * @var array{
+     *     host?: string,
+     *     password?: string|null,
+     *     port?: int,
+     *     timeout?: int,
+     *     async?: bool,
+     *     persistent?: bool,
+     *     database?: int
+     * }
+     */
+    public array $redis = [
+        'host'       => '127.0.0.1',
+        'password'   => null,
+        'port'       => 6379,
+        'timeout'    => 0,
+        'async'      => false, // specific to Predis and ignored by the native Redis extension
+        'persistent' => false,
+        'database'   => 0,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Available Cache Handlers
+     * --------------------------------------------------------------------------
+     *
+     * This is an array of cache engine alias' and class names. Only engines
+     * that are listed here are allowed to be used.
+     *
+     * @var array<string, class-string<CacheInterface>>
+     */
+    public array $validHandlers = [
+        'apcu'      => ApcuHandler::class,
+        'dummy'     => DummyHandler::class,
+        'file'      => FileHandler::class,
+        'memcached' => MemcachedHandler::class,
+        'predis'    => PredisHandler::class,
+        'redis'     => RedisHandler::class,
+        'wincache'  => WincacheHandler::class,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Web Page Caching: Cache Include Query String
+     * --------------------------------------------------------------------------
+     *
+     * Whether to take the URL query string into consideration when generating
+     * output cache files. Valid options are:
+     *
+     *    false = Disabled
+     *    true  = Enabled, take all query parameters into account.
+     *            Please be aware that this may result in numerous cache
+     *            files generated for the same page over and over again.
+     *    ['q'] = Enabled, but only take into account the specified list
+     *            of query parameters.
+     *
+     * @var bool|list<string>
+     */
+    public $cacheQueryString = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Web Page Caching: Cache Status Codes
+     * --------------------------------------------------------------------------
+     *
+     * HTTP status codes that are allowed to be cached. Only responses with
+     * these status codes will be cached by the PageCache filter.
+     *
+     * Default: [] - Cache all status codes (backward compatible)
+     *
+     * Recommended: [200] - Only cache successful responses
+     *
+     * You can also use status codes like:
+     *   [200, 404, 410] - Cache successful responses and specific error codes
+     *   [200, 201, 202, 203, 204] - All 2xx successful responses
+     *
+     * WARNING: Using [] may cache temporary error pages (404, 500, etc).
+     * Consider restricting to [200] for production applications to avoid
+     * caching errors that should be temporary.
+     *
+     * @var list<int>
+     */
+    public array $cacheStatusCodes = [];
+}

app/Config/Constants.php

@@ -0,0 +1,79 @@
+<?php
+
+/*
+ | --------------------------------------------------------------------
+ | App Namespace
+ | --------------------------------------------------------------------
+ |
+ | This defines the default Namespace that is used throughout
+ | CodeIgniter to refer to the Application directory. Change
+ | this constant to change the namespace that all application
+ | classes should use.
+ |
+ | NOTE: changing this will require manually modifying the
+ | existing namespaces of App\* namespaced-classes.
+ */
+defined('APP_NAMESPACE') || define('APP_NAMESPACE', 'App');
+
+/*
+ | --------------------------------------------------------------------------
+ | Composer Path
+ | --------------------------------------------------------------------------
+ |
+ | The path that Composer's autoload file is expected to live. By default,
+ | the vendor folder is in the Root directory, but you can customize that here.
+ */
+defined('COMPOSER_PATH') || define('COMPOSER_PATH', ROOTPATH . 'vendor/autoload.php');
+
+/*
+ |--------------------------------------------------------------------------
+ | Timing Constants
+ |--------------------------------------------------------------------------
+ |
+ | Provide simple ways to work with the myriad of PHP functions that
+ | require information to be in seconds.
+ */
+defined('SECOND') || define('SECOND', 1);
+defined('MINUTE') || define('MINUTE', 60);
+defined('HOUR')   || define('HOUR', 3600);
+defined('DAY')    || define('DAY', 86400);
+defined('WEEK')   || define('WEEK', 604800);
+defined('MONTH')  || define('MONTH', 2_592_000);
+defined('YEAR')   || define('YEAR', 31_536_000);
+defined('DECADE') || define('DECADE', 315_360_000);
+
+/*
+ | --------------------------------------------------------------------------
+ | Exit Status Codes
+ | --------------------------------------------------------------------------
+ |
+ | Used to indicate the conditions under which the script is exit()ing.
+ | While there is no universal standard for error codes, there are some
+ | broad conventions.  Three such conventions are mentioned below, for
+ | those who wish to make use of them.  The CodeIgniter defaults were
+ | chosen for the least overlap with these conventions, while still
+ | leaving room for others to be defined in future versions and user
+ | applications.
+ |
+ | The three main conventions used for determining exit status codes
+ | are as follows:
+ |
+ |    Standard C/C++ Library (stdlibc):
+ |       http://www.gnu.org/software/libc/manual/html_node/Exit-Status.html
+ |       (This link also contains other GNU-specific conventions)
+ |    BSD sysexits.h:
+ |       http://www.gsp.com/cgi-bin/man.cgi?section=3&topic=sysexits
+ |    Bash scripting:
+ |       http://tldp.org/LDP/abs/html/exitcodes.html
+ |
+ */
+defined('EXIT_SUCCESS')        || define('EXIT_SUCCESS', 0);        // no errors
+defined('EXIT_ERROR')          || define('EXIT_ERROR', 1);          // generic error
+defined('EXIT_CONFIG')         || define('EXIT_CONFIG', 3);         // configuration error
+defined('EXIT_UNKNOWN_FILE')   || define('EXIT_UNKNOWN_FILE', 4);   // file not found
+defined('EXIT_UNKNOWN_CLASS')  || define('EXIT_UNKNOWN_CLASS', 5);  // unknown class
+defined('EXIT_UNKNOWN_METHOD') || define('EXIT_UNKNOWN_METHOD', 6); // unknown class member
+defined('EXIT_USER_INPUT')     || define('EXIT_USER_INPUT', 7);     // invalid user input
+defined('EXIT_DATABASE')       || define('EXIT_DATABASE', 8);       // database error
+defined('EXIT__AUTO_MIN')      || define('EXIT__AUTO_MIN', 9);      // lowest automatically-assigned error code
+defined('EXIT__AUTO_MAX')      || define('EXIT__AUTO_MAX', 125);    // highest automatically-assigned error code

app/Config/ContentSecurityPolicy.php

@@ -0,0 +1,216 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Stores the default settings for the ContentSecurityPolicy, if you
+ * choose to use it. The values here will be read in and set as defaults
+ * for the site. If needed, they can be overridden on a page-by-page basis.
+ *
+ * Suggested reference for explanations:
+ *
+ * @see https://www.html5rocks.com/en/tutorials/security/content-security-policy/
+ */
+class ContentSecurityPolicy extends BaseConfig
+{
+    // -------------------------------------------------------------------------
+    // Broadbrush CSP management
+    // -------------------------------------------------------------------------
+
+    /**
+     * Default CSP report context
+     */
+    public bool $reportOnly = false;
+
+    /**
+     * Specifies a URL where a browser will send reports
+     * when a content security policy is violated.
+     */
+    public ?string $reportURI = null;
+
+    /**
+     * Specifies a reporting endpoint to which violation reports ought to be sent.
+     */
+    public ?string $reportTo = null;
+
+    /**
+     * Instructs user agents to rewrite URL schemes, changing
+     * HTTP to HTTPS. This directive is for websites with
+     * large numbers of old URLs that need to be rewritten.
+     */
+    public bool $upgradeInsecureRequests = false;
+
+    // -------------------------------------------------------------------------
+    // CSP DIRECTIVES SETTINGS
+    // NOTE: once you set a policy to 'none', it cannot be further restricted
+    // -------------------------------------------------------------------------
+
+    /**
+     * Will default to `'self'` if not overridden
+     *
+     * @var list<string>|string|null
+     */
+    public $defaultSrc;
+
+    /**
+     * Lists allowed scripts' URLs.
+     *
+     * @var list<string>|string
+     */
+    public $scriptSrc = 'self';
+
+    /**
+     * Specifies valid sources for JavaScript <script> elements.
+     *
+     * @var list<string>|string
+     */
+    public array|string $scriptSrcElem = 'self';
+
+    /**
+     * Specifies valid sources for JavaScript inline event
+     * handlers and JavaScript URLs.
+     *
+     * @var list<string>|string
+     */
+    public array|string $scriptSrcAttr = 'self';
+
+    /**
+     * Lists allowed stylesheets' URLs.
+     *
+     * @var list<string>|string
+     */
+    public $styleSrc = 'self';
+
+    /**
+     * Specifies valid sources for stylesheets <link> elements.
+     *
+     * @var list<string>|string
+     */
+    public array|string $styleSrcElem = 'self';
+
+    /**
+     * Specifies valid sources for stylesheets inline
+     * style attributes and `<style>` elements.
+     *
+     * @var list<string>|string
+     */
+    public array|string $styleSrcAttr = 'self';
+
+    /**
+     * Defines the origins from which images can be loaded.
+     *
+     * @var list<string>|string
+     */
+    public $imageSrc = 'self';
+
+    /**
+     * Restricts the URLs that can appear in a page's `<base>` element.
+     *
+     * Will default to self if not overridden
+     *
+     * @var list<string>|string|null
+     */
+    public $baseURI;
+
+    /**
+     * Lists the URLs for workers and embedded frame contents
+     *
+     * @var list<string>|string
+     */
+    public $childSrc = 'self';
+
+    /**
+     * Limits the origins that you can connect to (via XHR,
+     * WebSockets, and EventSource).
+     *
+     * @var list<string>|string
+     */
+    public $connectSrc = 'self';
+
+    /**
+     * Specifies the origins that can serve web fonts.
+     *
+     * @var list<string>|string
+     */
+    public $fontSrc;
+
+    /**
+     * Lists valid endpoints for submission from `<form>` tags.
+     *
+     * @var list<string>|string
+     */
+    public $formAction = 'self';
+
+    /**
+     * Specifies the sources that can embed the current page.
+     * This directive applies to `<frame>`, `<iframe>`, `<embed>`,
+     * and `<applet>` tags. This directive can't be used in
+     * `<meta>` tags and applies only to non-HTML resources.
+     *
+     * @var list<string>|string|null
+     */
+    public $frameAncestors;
+
+    /**
+     * The frame-src directive restricts the URLs which may
+     * be loaded into nested browsing contexts.
+     *
+     * @var list<string>|string|null
+     */
+    public $frameSrc;
+
+    /**
+     * Restricts the origins allowed to deliver video and audio.
+     *
+     * @var list<string>|string|null
+     */
+    public $mediaSrc;
+
+    /**
+     * Allows control over Flash and other plugins.
+     *
+     * @var list<string>|string
+     */
+    public $objectSrc = 'self';
+
+    /**
+     * @var list<string>|string|null
+     */
+    public $manifestSrc;
+
+    /**
+     * @var list<string>|string
+     */
+    public array|string $workerSrc = [];
+
+    /**
+     * Limits the kinds of plugins a page may invoke.
+     *
+     * @var list<string>|string|null
+     */
+    public $pluginTypes;
+
+    /**
+     * List of actions allowed.
+     *
+     * @var list<string>|string|null
+     */
+    public $sandbox;
+
+    /**
+     * Nonce placeholder for style tags.
+     */
+    public string $styleNonceTag = '{csp-style-nonce}';
+
+    /**
+     * Nonce placeholder for script tags.
+     */
+    public string $scriptNonceTag = '{csp-script-nonce}';
+
+    /**
+     * Replace nonce tag automatically?
+     */
+    public bool $autoNonce = true;
+}

app/Config/Cookie.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use DateTimeInterface;
+
+class Cookie extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Prefix
+     * --------------------------------------------------------------------------
+     *
+     * Set a cookie name prefix if you need to avoid collisions.
+     */
+    public string $prefix = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Expires Timestamp
+     * --------------------------------------------------------------------------
+     *
+     * Default expires timestamp for cookies. Setting this to `0` will mean the
+     * cookie will not have the `Expires` attribute and will behave as a session
+     * cookie.
+     *
+     * @var DateTimeInterface|int|string
+     */
+    public $expires = 0;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Path
+     * --------------------------------------------------------------------------
+     *
+     * Typically will be a forward slash.
+     */
+    public string $path = '/';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Domain
+     * --------------------------------------------------------------------------
+     *
+     * Set to `.your-domain.com` for site-wide cookies.
+     */
+    public string $domain = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Secure
+     * --------------------------------------------------------------------------
+     *
+     * Cookie will only be set if a secure HTTPS connection exists.
+     */
+    public bool $secure = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie HTTPOnly
+     * --------------------------------------------------------------------------
+     *
+     * Cookie will only be accessible via HTTP(S) (no JavaScript).
+     */
+    public bool $httponly = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie SameSite
+     * --------------------------------------------------------------------------
+     *
+     * Configure cookie SameSite setting. Allowed values are:
+     * - None
+     * - Lax
+     * - Strict
+     * - ''
+     *
+     * Alternatively, you can use the constant names:
+     * - `Cookie::SAMESITE_NONE`
+     * - `Cookie::SAMESITE_LAX`
+     * - `Cookie::SAMESITE_STRICT`
+     *
+     * Defaults to `Lax` for compatibility with modern browsers. Setting `''`
+     * (empty string) means default SameSite attribute set by browsers (`Lax`)
+     * will be set on cookies. If set to `None`, `$secure` must also be set.
+     *
+     * @var ''|'Lax'|'None'|'Strict'
+     */
+    public string $samesite = 'Lax';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Cookie Raw
+     * --------------------------------------------------------------------------
+     *
+     * This flag allows setting a "raw" cookie, i.e., its name and value are
+     * not URL encoded using `rawurlencode()`.
+     *
+     * If this is set to `true`, cookie names should be compliant of RFC 2616's
+     * list of allowed characters.
+     *
+     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes
+     * @see https://tools.ietf.org/html/rfc2616#section-2.2
+     */
+    public bool $raw = false;
+}

app/Config/Cors.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Cross-Origin Resource Sharing (CORS) Configuration
+ *
+ * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+ */
+class Cors extends BaseConfig
+{
+    /**
+     * The default CORS configuration.
+     *
+     * @var array{
+     *      allowedOrigins: list<string>,
+     *      allowedOriginsPatterns: list<string>,
+     *      supportsCredentials: bool,
+     *      allowedHeaders: list<string>,
+     *      exposedHeaders: list<string>,
+     *      allowedMethods: list<string>,
+     *      maxAge: int,
+     *  }
+     */
+    public array $default = [
+        /**
+         * Origins for the `Access-Control-Allow-Origin` header.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+         *
+         * E.g.:
+         *   - ['http://localhost:8080']
+         *   - ['https://www.example.com']
+         */
+        'allowedOrigins' => [],
+
+        /**
+         * Origin regex patterns for the `Access-Control-Allow-Origin` header.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+         *
+         * NOTE: A pattern specified here is part of a regular expression. It will
+         *       be actually `#\A<pattern>\z#`.
+         *
+         * E.g.:
+         *   - ['https://\w+\.example\.com']
+         */
+        'allowedOriginsPatterns' => [],
+
+        /**
+         * Weather to send the `Access-Control-Allow-Credentials` header.
+         *
+         * The Access-Control-Allow-Credentials response header tells browsers whether
+         * the server allows cross-origin HTTP requests to include credentials.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+         */
+        'supportsCredentials' => false,
+
+        /**
+         * Set headers to allow.
+         *
+         * The Access-Control-Allow-Headers response header is used in response to
+         * a preflight request which includes the Access-Control-Request-Headers to
+         * indicate which HTTP headers can be used during the actual request.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+         */
+        'allowedHeaders' => [],
+
+        /**
+         * Set headers to expose.
+         *
+         * The Access-Control-Expose-Headers response header allows a server to
+         * indicate which response headers should be made available to scripts running
+         * in the browser, in response to a cross-origin request.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
+         */
+        'exposedHeaders' => [],
+
+        /**
+         * Set methods to allow.
+         *
+         * The Access-Control-Allow-Methods response header specifies one or more
+         * methods allowed when accessing a resource in response to a preflight
+         * request.
+         *
+         * E.g.:
+         *   - ['GET', 'POST', 'PUT', 'DELETE']
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+         */
+        'allowedMethods' => [],
+
+        /**
+         * Set how many seconds the results of a preflight request can be cached.
+         *
+         * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+         */
+        'maxAge' => 7200,
+    ];
+}

app/Config/Database.php

@@ -0,0 +1,215 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Database\Config;
+
+/**
+ * Database Configuration
+ */
+class Database extends Config
+{
+    /**
+     * The directory that holds the Migrations and Seeds directories.
+     */
+    public string $filesPath = APPPATH . 'Database' . DIRECTORY_SEPARATOR;
+
+    /**
+     * Lets you choose which connection group to use if no other is specified.
+     */
+    public string $defaultGroup = 'default';
+
+    /**
+     * The default database connection.
+     *
+     * @var array<string, mixed>
+     */
+    public array $default = [
+        'DSN'          => '',
+        'hostname'     => 'localhost',
+        'username'     => '',
+        'password'     => '',
+        'database'     => '',
+        'DBDriver'     => 'MySQLi',
+        'DBPrefix'     => '',
+        'pConnect'     => false,
+        'DBDebug'      => true,
+        'charset'      => 'utf8mb4',
+        'DBCollat'     => 'utf8mb4_general_ci',
+        'swapPre'      => '',
+        'encrypt'      => false,
+        'compress'     => false,
+        'strictOn'     => false,
+        'failover'     => [],
+        'port'         => 3306,
+        'numberNative' => false,
+        'foundRows'    => false,
+        'dateFormat'   => [
+            'date'     => 'Y-m-d',
+            'datetime' => 'Y-m-d H:i:s',
+            'time'     => 'H:i:s',
+        ],
+    ];
+
+    //    /**
+    //     * Sample database connection for SQLite3.
+    //     *
+    //     * @var array<string, mixed>
+    //     */
+    //    public array $default = [
+    //        'database'    => 'database.db',
+    //        'DBDriver'    => 'SQLite3',
+    //        'DBPrefix'    => '',
+    //        'DBDebug'     => true,
+    //        'swapPre'     => '',
+    //        'failover'    => [],
+    //        'foreignKeys' => true,
+    //        'busyTimeout' => 1000,
+    //        'synchronous' => null,
+    //        'dateFormat'  => [
+    //            'date'     => 'Y-m-d',
+    //            'datetime' => 'Y-m-d H:i:s',
+    //            'time'     => 'H:i:s',
+    //        ],
+    //    ];
+
+    //    /**
+    //     * Sample database connection for Postgre.
+    //     *
+    //     * @var array<string, mixed>
+    //     */
+    //    public array $default = [
+    //        'DSN'        => '',
+    //        'hostname'   => 'localhost',
+    //        'username'   => 'root',
+    //        'password'   => 'root',
+    //        'database'   => 'ci4',
+    //        'schema'     => 'public',
+    //        'DBDriver'   => 'Postgre',
+    //        'DBPrefix'   => '',
+    //        'pConnect'   => false,
+    //        'DBDebug'    => true,
+    //        'charset'    => 'utf8',
+    //        'swapPre'    => '',
+    //        'failover'   => [],
+    //        'port'       => 5432,
+    //        'dateFormat' => [
+    //            'date'     => 'Y-m-d',
+    //            'datetime' => 'Y-m-d H:i:s',
+    //            'time'     => 'H:i:s',
+    //        ],
+    //    ];
+
+    //    /**
+    //     * Sample database connection for SQLSRV.
+    //     *
+    //     * @var array<string, mixed>
+    //     */
+    //    public array $default = [
+    //        'DSN'        => '',
+    //        'hostname'   => 'localhost',
+    //        'username'   => 'root',
+    //        'password'   => 'root',
+    //        'database'   => 'ci4',
+    //        'schema'     => 'dbo',
+    //        'DBDriver'   => 'SQLSRV',
+    //        'DBPrefix'   => '',
+    //        'pConnect'   => false,
+    //        'DBDebug'    => true,
+    //        'charset'    => 'utf8',
+    //        'swapPre'    => '',
+    //        'encrypt'    => false,
+    //        'failover'   => [],
+    //        'port'       => 1433,
+    //        'dateFormat' => [
+    //            'date'     => 'Y-m-d',
+    //            'datetime' => 'Y-m-d H:i:s',
+    //            'time'     => 'H:i:s',
+    //        ],
+    //    ];
+
+    //    /**
+    //     * Sample database connection for OCI8.
+    //     *
+    //     * You may need the following environment variables:
+    //     *   NLS_LANG                = 'AMERICAN_AMERICA.UTF8'
+    //     *   NLS_DATE_FORMAT         = 'YYYY-MM-DD HH24:MI:SS'
+    //     *   NLS_TIMESTAMP_FORMAT    = 'YYYY-MM-DD HH24:MI:SS'
+    //     *   NLS_TIMESTAMP_TZ_FORMAT = 'YYYY-MM-DD HH24:MI:SS'
+    //     *
+    //     * @var array<string, mixed>
+    //     */
+    //    public array $default = [
+    //        'DSN'        => 'localhost:1521/FREEPDB1',
+    //        'username'   => 'root',
+    //        'password'   => 'root',
+    //        'DBDriver'   => 'OCI8',
+    //        'DBPrefix'   => '',
+    //        'pConnect'   => false,
+    //        'DBDebug'    => true,
+    //        'charset'    => 'AL32UTF8',
+    //        'swapPre'    => '',
+    //        'failover'   => [],
+    //        'dateFormat' => [
+    //            'date'     => 'Y-m-d',
+    //            'datetime' => 'Y-m-d H:i:s',
+    //            'time'     => 'H:i:s',
+    //        ],
+    //    ];
+
+    /**
+     * This database connection is used when running PHPUnit database tests.
+     *
+     * @var array<string, mixed>
+     */
+    public array $tests = [
+        'DSN'         => '',
+        'hostname'    => '127.0.0.1',
+        'username'    => '',
+        'password'    => '',
+        'database'    => ':memory:',
+        'DBDriver'    => 'SQLite3',
+        'DBPrefix'    => 'db_',  // Needed to ensure we're working correctly with prefixes live. DO NOT REMOVE FOR CI DEVS
+        'pConnect'    => false,
+        'DBDebug'     => true,
+        'charset'     => 'utf8',
+        'DBCollat'    => '',
+        'swapPre'     => '',
+        'encrypt'     => false,
+        'compress'    => false,
+        'strictOn'    => true,
+        'failover'    => [],
+        'port'        => 3306,
+        'foreignKeys' => true,
+        'busyTimeout' => 1000,
+        'synchronous' => null,
+        'dateFormat'  => [
+            'date'     => 'Y-m-d',
+            'datetime' => 'Y-m-d H:i:s',
+            'time'     => 'H:i:s',
+        ],
+    ];
+
+    public function __construct()
+    {
+        parent::__construct();
+
+        // finansePRO: konfiguracja DB czytana z istniejacego .env (db_host/db_user/db_name/db_password).
+        // Na hostido (production) aplikacja i baza sa na tym samym serwerze -> localhost.
+        // Lokalny dev laczy sie do bazy zdalnej (db_host_remote), bo lokalny MySQL bywa wylaczony.
+        // ponytail: jedno zrodlo prawdy dla DB = .env, bez duplikowania wartosci w configu.
+        $this->default['hostname'] = (ENVIRONMENT === 'production')
+            ? (env('db_host') ?: 'localhost')
+            : (env('db_host_remote') ?: (env('db_host') ?: 'localhost'));
+        $this->default['username'] = env('db_user') ?: '';
+        $this->default['password'] = env('db_password') ?: '';
+        $this->default['database'] = env('db_name') ?: '';
+
+        // Ensure that we always set the database group to 'tests' if
+        // we are currently running an automated test suite, so that
+        // we don't overwrite live data on accident.
+        if (ENVIRONMENT === 'testing') {
+            $this->defaultGroup = 'tests';
+        }
+    }
+}

app/Config/DocTypes.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Config;
+
+class DocTypes
+{
+    /**
+     * List of valid document types.
+     *
+     * @var array<string, string>
+     */
+    public array $list = [
+        'xhtml11'           => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">',
+        'xhtml1-strict'     => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">',
+        'xhtml1-trans'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">',
+        'xhtml1-frame'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">',
+        'xhtml-basic11'     => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML Basic 1.1//EN" "http://www.w3.org/TR/xhtml-basic/xhtml-basic11.dtd">',
+        'html5'             => '<!DOCTYPE html>',
+        'html4-strict'      => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">',
+        'html4-trans'       => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">',
+        'html4-frame'       => '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN" "http://www.w3.org/TR/html4/frameset.dtd">',
+        'mathml1'           => '<!DOCTYPE math SYSTEM "http://www.w3.org/Math/DTD/mathml1/mathml.dtd">',
+        'mathml2'           => '<!DOCTYPE math PUBLIC "-//W3C//DTD MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/mathml2.dtd">',
+        'svg10'             => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.0//EN" "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">',
+        'svg11'             => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">',
+        'svg11-basic'       => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Basic//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd">',
+        'svg11-tiny'        => '<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">',
+        'xhtml-math-svg-xh' => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
+        'xhtml-math-svg-sh' => '<!DOCTYPE svg:svg PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">',
+        'xhtml-rdfa-1'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">',
+        'xhtml-rdfa-2'      => '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.1//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-2.dtd">',
+    ];
+
+    /**
+     * Whether to remove the solidus (`/`) character for void HTML elements (e.g. `<input>`)
+     * for HTML5 compatibility.
+     *
+     * Set to:
+     *    `true` - to be HTML5 compatible
+     *    `false` - to be XHTML compatible
+     */
+    public bool $html5 = true;
+}

app/Config/Email.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Email extends BaseConfig
+{
+    public string $fromEmail  = '';
+    public string $fromName   = '';
+    public string $recipients = '';
+
+    /**
+     * The "user agent"
+     */
+    public string $userAgent = 'CodeIgniter';
+
+    /**
+     * The mail sending protocol: mail, sendmail, smtp
+     */
+    public string $protocol = 'mail';
+
+    /**
+     * The server path to Sendmail.
+     */
+    public string $mailPath = '/usr/sbin/sendmail';
+
+    /**
+     * SMTP Server Hostname
+     */
+    public string $SMTPHost = '';
+
+    /**
+     * Which SMTP authentication method to use: login, plain
+     */
+    public string $SMTPAuthMethod = 'login';
+
+    /**
+     * SMTP Username
+     */
+    public string $SMTPUser = '';
+
+    /**
+     * SMTP Password
+     */
+    public string $SMTPPass = '';
+
+    /**
+     * SMTP Port
+     */
+    public int $SMTPPort = 25;
+
+    /**
+     * SMTP Timeout (in seconds)
+     */
+    public int $SMTPTimeout = 5;
+
+    /**
+     * Enable persistent SMTP connections
+     */
+    public bool $SMTPKeepAlive = false;
+
+    /**
+     * SMTP Encryption.
+     *
+     * @var string '', 'tls' or 'ssl'. 'tls' will issue a STARTTLS command
+     *             to the server. 'ssl' means implicit SSL. Connection on port
+     *             465 should set this to ''.
+     */
+    public string $SMTPCrypto = 'tls';
+
+    /**
+     * Enable word-wrap
+     */
+    public bool $wordWrap = true;
+
+    /**
+     * Character count to wrap at
+     */
+    public int $wrapChars = 76;
+
+    /**
+     * Type of mail, either 'text' or 'html'
+     */
+    public string $mailType = 'text';
+
+    /**
+     * Character set (utf-8, iso-8859-1, etc.)
+     */
+    public string $charset = 'UTF-8';
+
+    /**
+     * Whether to validate the email address
+     */
+    public bool $validate = false;
+
+    /**
+     * Email Priority. 1 = highest. 5 = lowest. 3 = normal
+     */
+    public int $priority = 3;
+
+    /**
+     * Newline character. (Use “\r\n” to comply with RFC 822)
+     */
+    public string $CRLF = "\r\n";
+
+    /**
+     * Newline character. (Use “\r\n” to comply with RFC 822)
+     */
+    public string $newline = "\r\n";
+
+    /**
+     * Enable BCC Batch Mode.
+     */
+    public bool $BCCBatchMode = false;
+
+    /**
+     * Number of emails in each BCC batch
+     */
+    public int $BCCBatchSize = 200;
+
+    /**
+     * Enable notify message from server
+     */
+    public bool $DSN = false;
+}

app/Config/Encryption.php

@@ -0,0 +1,109 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Encryption configuration.
+ *
+ * These are the settings used for encryption, if you don't pass a parameter
+ * array to the encrypter for creation/initialization.
+ */
+class Encryption extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Encryption Key Starter
+     * --------------------------------------------------------------------------
+     *
+     * If you use the Encryption class you must set an encryption key (seed).
+     * You need to ensure it is long enough for the cipher and mode you plan to use.
+     * See the user guide for more info.
+     */
+    public string $key = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Previous Encryption Keys
+     * --------------------------------------------------------------------------
+     *
+     * When rotating encryption keys, add old keys here to maintain ability
+     * to decrypt data encrypted with previous keys. Encryption always uses
+     * the current $key. Decryption tries current key first, then falls back
+     * to previous keys if decryption fails.
+     *
+     * In .env file, use comma-separated string:
+     *   encryption.previousKeys = hex2bin:9be8c64fcea509867...,hex2bin:3f5a1d8e9c2b7a4f6...
+     *
+     * @var list<string>|string
+     */
+    public array|string $previousKeys = '';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Encryption Driver to Use
+     * --------------------------------------------------------------------------
+     *
+     * One of the supported encryption drivers.
+     *
+     * Available drivers:
+     * - OpenSSL
+     * - Sodium
+     */
+    public string $driver = 'OpenSSL';
+
+    /**
+     * --------------------------------------------------------------------------
+     * SodiumHandler's Padding Length in Bytes
+     * --------------------------------------------------------------------------
+     *
+     * This is the number of bytes that will be padded to the plaintext message
+     * before it is encrypted. This value should be greater than zero.
+     *
+     * See the user guide for more information on padding.
+     */
+    public int $blockSize = 16;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Encryption digest
+     * --------------------------------------------------------------------------
+     *
+     * HMAC digest to use, e.g. 'SHA512' or 'SHA256'. Default value is 'SHA512'.
+     */
+    public string $digest = 'SHA512';
+
+    /**
+     * Whether the cipher-text should be raw. If set to false, then it will be base64 encoded.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to false for CI3 Encryption compatibility.
+     */
+    public bool $rawData = true;
+
+    /**
+     * Encryption key info.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'encryption' for CI3 Encryption compatibility.
+     */
+    public string $encryptKeyInfo = '';
+
+    /**
+     * Authentication key info.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'authentication' for CI3 Encryption compatibility.
+     */
+    public string $authKeyInfo = '';
+
+    /**
+     * Cipher to use.
+     * This setting is only used by OpenSSLHandler.
+     *
+     * Set to 'AES-128-CBC' to decrypt encrypted data that encrypted
+     * by CI3 Encryption default configuration.
+     */
+    public string $cipher = 'AES-256-CTR';
+}

app/Config/Events.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Events\Events;
+use CodeIgniter\Exceptions\FrameworkException;
+use CodeIgniter\HotReloader\HotReloader;
+
+/*
+ * --------------------------------------------------------------------
+ * Application Events
+ * --------------------------------------------------------------------
+ * Events allow you to tap into the execution of the program without
+ * modifying or extending core files. This file provides a central
+ * location to define your events, though they can always be added
+ * at run-time, also, if needed.
+ *
+ * You create code that can execute by subscribing to events with
+ * the 'on()' method. This accepts any form of callable, including
+ * Closures, that will be executed when the event is triggered.
+ *
+ * Example:
+ *      Events::on('create', [$myInstance, 'myMethod']);
+ */
+
+Events::on('pre_system', static function (): void {
+    if (ENVIRONMENT !== 'testing') {
+        $value = ini_get('zlib.output_compression');
+
+        if (filter_var($value, FILTER_VALIDATE_BOOLEAN) || (int) $value > 0) {
+            throw FrameworkException::forEnabledZlibOutputCompression();
+        }
+
+        while (ob_get_level() > 0) {
+            ob_end_flush();
+        }
+
+        ob_start(static fn ($buffer) => $buffer);
+    }
+
+    /*
+     * --------------------------------------------------------------------
+     * Debug Toolbar Listeners.
+     * --------------------------------------------------------------------
+     * If you delete, they will no longer be collected.
+     */
+    if (CI_DEBUG && ! is_cli()) {
+        Events::on('DBQuery', 'CodeIgniter\Debug\Toolbar\Collectors\Database::collect');
+        service('toolbar')->respond();
+        // Hot Reload route - for framework use on the hot reloader.
+        if (ENVIRONMENT === 'development') {
+            service('routes')->get('__hot-reload', static function (): void {
+                (new HotReloader())->run();
+            });
+        }
+    }
+});

app/Config/Exceptions.php

@@ -0,0 +1,106 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Debug\ExceptionHandler;
+use CodeIgniter\Debug\ExceptionHandlerInterface;
+use Psr\Log\LogLevel;
+use Throwable;
+
+/**
+ * Setup how the exception handler works.
+ */
+class Exceptions extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * LOG EXCEPTIONS?
+     * --------------------------------------------------------------------------
+     * If true, then exceptions will be logged
+     * through Services::Log.
+     *
+     * Default: true
+     */
+    public bool $log = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * DO NOT LOG STATUS CODES
+     * --------------------------------------------------------------------------
+     * Any status codes here will NOT be logged if logging is turned on.
+     * By default, only 404 (Page Not Found) exceptions are ignored.
+     *
+     * @var list<int>
+     */
+    public array $ignoreCodes = [404];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Error Views Path
+     * --------------------------------------------------------------------------
+     * This is the path to the directory that contains the 'cli' and 'html'
+     * directories that hold the views used to generate errors.
+     *
+     * Default: APPPATH.'Views/errors'
+     */
+    public string $errorViewPath = APPPATH . 'Views/errors';
+
+    /**
+     * --------------------------------------------------------------------------
+     * HIDE FROM DEBUG TRACE
+     * --------------------------------------------------------------------------
+     * Any data that you would like to hide from the debug trace.
+     * In order to specify 2 levels, use "/" to separate.
+     * ex. ['server', 'setup/password', 'secret_token']
+     *
+     * @var list<string>
+     */
+    public array $sensitiveDataInTrace = [];
+
+    /**
+     * --------------------------------------------------------------------------
+     * WHETHER TO THROW AN EXCEPTION ON DEPRECATED ERRORS
+     * --------------------------------------------------------------------------
+     * If set to `true`, DEPRECATED errors are only logged and no exceptions are
+     * thrown. This option also works for user deprecations.
+     */
+    public bool $logDeprecations = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * LOG LEVEL THRESHOLD FOR DEPRECATIONS
+     * --------------------------------------------------------------------------
+     * If `$logDeprecations` is set to `true`, this sets the log level
+     * to which the deprecation will be logged. This should be one of the log
+     * levels recognized by PSR-3.
+     *
+     * The related `Config\Logger::$threshold` should be adjusted, if needed,
+     * to capture logging the deprecations.
+     */
+    public string $deprecationLogLevel = LogLevel::WARNING;
+
+    /*
+     * DEFINE THE HANDLERS USED
+     * --------------------------------------------------------------------------
+     * Given the HTTP status code, returns exception handler that
+     * should be used to deal with this error. By default, it will run CodeIgniter's
+     * default handler and display the error information in the expected format
+     * for CLI, HTTP, or AJAX requests, as determined by is_cli() and the expected
+     * response format.
+     *
+     * Custom handlers can be returned if you want to handle one or more specific
+     * error codes yourself like:
+     *
+     *      if (in_array($statusCode, [400, 404, 500])) {
+     *          return new \App\Libraries\MyExceptionHandler();
+     *      }
+     *      if ($exception instanceOf PageNotFoundException) {
+     *          return new \App\Libraries\MyExceptionHandler();
+     *      }
+     */
+    public function handler(int $statusCode, Throwable $exception): ExceptionHandlerInterface
+    {
+        return new ExceptionHandler($this);
+    }
+}

app/Config/Feature.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * Enable/disable backward compatibility breaking features.
+ */
+class Feature extends BaseConfig
+{
+    /**
+     * Use improved new auto routing instead of the legacy version.
+     */
+    public bool $autoRoutesImproved = true;
+
+    /**
+     * Use filter execution order in 4.4 or before.
+     */
+    public bool $oldFilterOrder = false;
+
+    /**
+     * The behavior of `limit(0)` in Query Builder.
+     *
+     * If true, `limit(0)` returns all records. (the behavior of 4.4.x or before in version 4.x.)
+     * If false, `limit(0)` returns no records. (the behavior of 3.1.9 or later in version 3.x.)
+     */
+    public bool $limitZeroAsAll = true;
+
+    /**
+     * Use strict location negotiation.
+     *
+     * By default, the locale is selected based on a loose comparison of the language code (ISO 639-1)
+     * Enabling strict comparison will also consider the region code (ISO 3166-1 alpha-2).
+     */
+    public bool $strictLocaleNegotiation = false;
+}

app/Config/Filters.php

@@ -0,0 +1,111 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\Filters as BaseFilters;
+use CodeIgniter\Filters\Cors;
+use CodeIgniter\Filters\CSRF;
+use CodeIgniter\Filters\DebugToolbar;
+use CodeIgniter\Filters\ForceHTTPS;
+use CodeIgniter\Filters\Honeypot;
+use CodeIgniter\Filters\InvalidChars;
+use CodeIgniter\Filters\PageCache;
+use CodeIgniter\Filters\PerformanceMetrics;
+use CodeIgniter\Filters\SecureHeaders;
+
+class Filters extends BaseFilters
+{
+    /**
+     * Configures aliases for Filter classes to
+     * make reading things nicer and simpler.
+     *
+     * @var array<string, class-string|list<class-string>>
+     *
+     * [filter_name => classname]
+     * or [filter_name => [classname1, classname2, ...]]
+     */
+    public array $aliases = [
+        'csrf'          => CSRF::class,
+        'toolbar'       => DebugToolbar::class,
+        'honeypot'      => Honeypot::class,
+        'invalidchars'  => InvalidChars::class,
+        'secureheaders' => SecureHeaders::class,
+        'cors'          => Cors::class,
+        'forcehttps'    => ForceHTTPS::class,
+        'pagecache'     => PageCache::class,
+        'performance'   => PerformanceMetrics::class,
+        'auth'          => \App\Filters\AuthFilter::class,
+    ];
+
+    /**
+     * List of special required filters.
+     *
+     * The filters listed here are special. They are applied before and after
+     * other kinds of filters, and always applied even if a route does not exist.
+     *
+     * Filters set by default provide framework functionality. If removed,
+     * those functions will no longer work.
+     *
+     * @see https://codeigniter.com/user_guide/incoming/filters.html#provided-filters
+     *
+     * @var array{before: list<string>, after: list<string>}
+     */
+    public array $required = [
+        'before' => [
+            'forcehttps', // Force Global Secure Requests
+            'pagecache',  // Web Page Caching
+        ],
+        'after' => [
+            'pagecache',   // Web Page Caching
+            'performance', // Performance Metrics
+            'toolbar',     // Debug Toolbar
+        ],
+    ];
+
+    /**
+     * List of filter aliases that are always
+     * applied before and after every request.
+     *
+     * @var array{
+     *     before: array<string, array{except: list<string>|string}>|list<string>,
+     *     after: array<string, array{except: list<string>|string}>|list<string>
+     * }
+     */
+    public array $globals = [
+        'before' => [
+            // 'honeypot',
+            // 'csrf',
+            // 'invalidchars',
+        ],
+        'after' => [
+            // 'honeypot',
+            // 'secureheaders',
+        ],
+    ];
+
+    /**
+     * List of filter aliases that works on a
+     * particular HTTP method (GET, POST, etc.).
+     *
+     * Example:
+     * 'POST' => ['foo', 'bar']
+     *
+     * If you use this, you should disable auto-routing because auto-routing
+     * permits any HTTP method to access a controller. Accessing the controller
+     * with a method you don't expect could bypass the filter.
+     *
+     * @var array<string, list<string>>
+     */
+    public array $methods = [];
+
+    /**
+     * List of filter aliases that should run on any
+     * before or after URI patterns.
+     *
+     * Example:
+     * 'isLoggedIn' => ['before' => ['account/*', 'profiles/*']]
+     *
+     * @var array<string, array<string, list<string>>>
+     */
+    public array $filters = [];
+}

app/Config/ForeignCharacters.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\ForeignCharacters as BaseForeignCharacters;
+
+/**
+ * @immutable
+ */
+class ForeignCharacters extends BaseForeignCharacters
+{
+}

app/Config/Format.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Format\JSONFormatter;
+use CodeIgniter\Format\XMLFormatter;
+
+class Format extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Available Response Formats
+     * --------------------------------------------------------------------------
+     *
+     * When you perform content negotiation with the request, these are the
+     * available formats that your application supports. This is currently
+     * only used with the API\ResponseTrait. A valid Formatter must exist
+     * for the specified format.
+     *
+     * These formats are only checked when the data passed to the respond()
+     * method is an array.
+     *
+     * @var list<string>
+     */
+    public array $supportedResponseFormats = [
+        'application/json',
+        'application/xml', // machine-readable XML
+        'text/xml', // human-readable XML
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Formatters
+     * --------------------------------------------------------------------------
+     *
+     * Lists the class to use to format responses with of a particular type.
+     * For each mime type, list the class that should be used. Formatters
+     * can be retrieved through the getFormatter() method.
+     *
+     * @var array<string, string>
+     */
+    public array $formatters = [
+        'application/json' => JSONFormatter::class,
+        'application/xml'  => XMLFormatter::class,
+        'text/xml'         => XMLFormatter::class,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Formatters Options
+     * --------------------------------------------------------------------------
+     *
+     * Additional Options to adjust default formatters behaviour.
+     * For each mime type, list the additional options that should be used.
+     *
+     * @var array<string, int>
+     */
+    public array $formatterOptions = [
+        'application/json' => JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES,
+        'application/xml'  => 0,
+        'text/xml'         => 0,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Maximum depth for JSON encoding.
+     * --------------------------------------------------------------------------
+     *
+     * This value determines how deep the JSON encoder will traverse nested structures.
+     */
+    public int $jsonEncodeDepth = 512;
+}

app/Config/Generators.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Generators extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Generator Commands' Views
+     * --------------------------------------------------------------------------
+     *
+     * This array defines the mapping of generator commands to the view files
+     * they are using. If you need to customize them for your own, copy these
+     * view files in your own folder and indicate the location here.
+     *
+     * You will notice that the views have special placeholders enclosed in
+     * curly braces `{...}`. These placeholders are used internally by the
+     * generator commands in processing replacements, thus you are warned
+     * not to delete them or modify the names. If you will do so, you may
+     * end up disrupting the scaffolding process and throw errors.
+     *
+     * YOU HAVE BEEN WARNED!
+     *
+     * @var array<string, array<string, string>|string>
+     */
+    public array $views = [
+        'make:cell' => [
+            'class' => 'CodeIgniter\Commands\Generators\Views\cell.tpl.php',
+            'view'  => 'CodeIgniter\Commands\Generators\Views\cell_view.tpl.php',
+        ],
+        'make:command'      => 'CodeIgniter\Commands\Generators\Views\command.tpl.php',
+        'make:config'       => 'CodeIgniter\Commands\Generators\Views\config.tpl.php',
+        'make:controller'   => 'CodeIgniter\Commands\Generators\Views\controller.tpl.php',
+        'make:entity'       => 'CodeIgniter\Commands\Generators\Views\entity.tpl.php',
+        'make:filter'       => 'CodeIgniter\Commands\Generators\Views\filter.tpl.php',
+        'make:migration'    => 'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
+        'make:model'        => 'CodeIgniter\Commands\Generators\Views\model.tpl.php',
+        'make:seeder'       => 'CodeIgniter\Commands\Generators\Views\seeder.tpl.php',
+        'make:validation'   => 'CodeIgniter\Commands\Generators\Views\validation.tpl.php',
+        'session:migration' => 'CodeIgniter\Commands\Generators\Views\migration.tpl.php',
+    ];
+}

app/Config/Honeypot.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Honeypot extends BaseConfig
+{
+    /**
+     * Makes Honeypot visible or not to human
+     */
+    public bool $hidden = true;
+
+    /**
+     * Honeypot Label Content
+     */
+    public string $label = 'Fill This Field';
+
+    /**
+     * Honeypot Field Name
+     */
+    public string $name = 'honeypot';
+
+    /**
+     * Honeypot HTML Template
+     */
+    public string $template = '<label>{label}</label><input type="text" name="{name}" value="">';
+
+    /**
+     * Honeypot container
+     *
+     * If you enabled CSP, you can remove `style="display:none"`.
+     */
+    public string $container = '<div style="display:none">{template}</div>';
+
+    /**
+     * The id attribute for Honeypot container tag
+     *
+     * Used when CSP is enabled.
+     */
+    public string $containerId = 'hpc';
+}

app/Config/Hostnames.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Config;
+
+class Hostnames
+{
+    // List of known two-part TLDs for subdomain extraction
+    public const TWO_PART_TLDS = [
+        'co.uk', 'org.uk', 'gov.uk', 'ac.uk', 'sch.uk', 'ltd.uk', 'plc.uk',
+        'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au', 'asn.au', 'id.au',
+        'co.jp', 'ac.jp', 'go.jp', 'or.jp', 'ne.jp', 'gr.jp',
+        'co.nz', 'org.nz', 'govt.nz', 'ac.nz', 'net.nz', 'geek.nz', 'maori.nz', 'school.nz',
+        'co.in', 'net.in', 'org.in', 'ind.in', 'ac.in', 'gov.in', 'res.in',
+        'com.cn', 'net.cn', 'org.cn', 'gov.cn', 'edu.cn',
+        'com.sg', 'net.sg', 'org.sg', 'gov.sg', 'edu.sg', 'per.sg',
+        'co.za', 'org.za', 'gov.za', 'ac.za', 'net.za',
+        'co.kr', 'or.kr', 'go.kr', 'ac.kr', 'ne.kr', 'pe.kr',
+        'co.th', 'or.th', 'go.th', 'ac.th', 'net.th', 'in.th',
+        'com.my', 'net.my', 'org.my', 'edu.my', 'gov.my', 'mil.my', 'name.my',
+        'com.mx', 'org.mx', 'net.mx', 'edu.mx', 'gob.mx',
+        'com.br', 'net.br', 'org.br', 'gov.br', 'edu.br', 'art.br', 'eng.br',
+        'co.il', 'org.il', 'ac.il', 'gov.il', 'net.il', 'muni.il',
+        'co.id', 'or.id', 'ac.id', 'go.id', 'net.id', 'web.id', 'my.id',
+        'com.hk', 'edu.hk', 'gov.hk', 'idv.hk', 'net.hk', 'org.hk',
+        'com.tw', 'net.tw', 'org.tw', 'edu.tw', 'gov.tw', 'idv.tw',
+        'com.sa', 'net.sa', 'org.sa', 'gov.sa', 'edu.sa', 'sch.sa', 'med.sa',
+        'co.ae', 'net.ae', 'org.ae', 'gov.ae', 'ac.ae', 'sch.ae',
+        'com.tr', 'net.tr', 'org.tr', 'gov.tr', 'edu.tr', 'av.tr', 'gen.tr',
+        'co.ke', 'or.ke', 'go.ke', 'ac.ke', 'sc.ke', 'me.ke', 'mobi.ke', 'info.ke',
+        'com.ng', 'org.ng', 'gov.ng', 'edu.ng', 'net.ng', 'sch.ng', 'name.ng',
+        'com.pk', 'net.pk', 'org.pk', 'gov.pk', 'edu.pk', 'fam.pk',
+        'com.eg', 'edu.eg', 'gov.eg', 'org.eg', 'net.eg',
+        'com.cy', 'net.cy', 'org.cy', 'gov.cy', 'ac.cy',
+        'com.lk', 'org.lk', 'edu.lk', 'gov.lk', 'net.lk', 'int.lk',
+        'com.bd', 'net.bd', 'org.bd', 'ac.bd', 'gov.bd', 'mil.bd',
+        'com.ar', 'net.ar', 'org.ar', 'gov.ar', 'edu.ar', 'mil.ar',
+        'gob.cl', 'com.pl', 'net.pl', 'org.pl', 'gov.pl', 'edu.pl',
+        'co.ir', 'ac.ir', 'org.ir', 'id.ir', 'gov.ir', 'sch.ir', 'net.ir',
+    ];
+}

app/Config/Images.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Images\Handlers\GDHandler;
+use CodeIgniter\Images\Handlers\ImageMagickHandler;
+
+class Images extends BaseConfig
+{
+    /**
+     * Default handler used if no other handler is specified.
+     */
+    public string $defaultHandler = 'gd';
+
+    /**
+     * The path to the image library.
+     * Required for ImageMagick, GraphicsMagick, or NetPBM.
+     *
+     * @deprecated 4.7.0 No longer used.
+     */
+    public string $libraryPath = '/usr/local/bin/convert';
+
+    /**
+     * The available handler classes.
+     *
+     * @var array<string, string>
+     */
+    public array $handlers = [
+        'gd'      => GDHandler::class,
+        'imagick' => ImageMagickHandler::class,
+    ];
+}

app/Config/Kint.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Config;
+
+use Kint\Parser\ConstructablePluginInterface;
+use Kint\Renderer\Rich\TabPluginInterface;
+use Kint\Renderer\Rich\ValuePluginInterface;
+
+/**
+ * --------------------------------------------------------------------------
+ * Kint
+ * --------------------------------------------------------------------------
+ *
+ * We use Kint's `RichRenderer` and `CLIRenderer`. This area contains options
+ * that you can set to customize how Kint works for you.
+ *
+ * @see https://kint-php.github.io/kint/ for details on these settings.
+ */
+class Kint
+{
+    /*
+    |--------------------------------------------------------------------------
+    | Global Settings
+    |--------------------------------------------------------------------------
+    */
+
+    /**
+     * @var list<class-string<ConstructablePluginInterface>|ConstructablePluginInterface>|null
+     */
+    public $plugins;
+
+    public int $maxDepth           = 6;
+    public bool $displayCalledFrom = true;
+    public bool $expanded          = false;
+
+    /*
+    |--------------------------------------------------------------------------
+    | RichRenderer Settings
+    |--------------------------------------------------------------------------
+    */
+    public string $richTheme = 'aante-light.css';
+    public bool $richFolder  = false;
+
+    /**
+     * @var array<string, class-string<ValuePluginInterface>>|null
+     */
+    public $richObjectPlugins;
+
+    /**
+     * @var array<string, class-string<TabPluginInterface>>|null
+     */
+    public $richTabPlugins;
+
+    /*
+    |--------------------------------------------------------------------------
+    | CLI Settings
+    |--------------------------------------------------------------------------
+    */
+    public bool $cliColors      = true;
+    public bool $cliForceUTF8   = false;
+    public bool $cliDetectWidth = true;
+    public int $cliMinWidth     = 40;
+}

app/Config/Logger.php

@@ -0,0 +1,151 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Log\Handlers\FileHandler;
+use CodeIgniter\Log\Handlers\HandlerInterface;
+
+class Logger extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Error Logging Threshold
+     * --------------------------------------------------------------------------
+     *
+     * You can enable error logging by setting a threshold over zero. The
+     * threshold determines what gets logged. Any values below or equal to the
+     * threshold will be logged.
+     *
+     * Threshold options are:
+     *
+     * - 0 = Disables logging, Error logging TURNED OFF
+     * - 1 = Emergency Messages - System is unusable
+     * - 2 = Alert Messages - Action Must Be Taken Immediately
+     * - 3 = Critical Messages - Application component unavailable, unexpected exception.
+     * - 4 = Runtime Errors - Don't need immediate action, but should be monitored.
+     * - 5 = Warnings - Exceptional occurrences that are not errors.
+     * - 6 = Notices - Normal but significant events.
+     * - 7 = Info - Interesting events, like user logging in, etc.
+     * - 8 = Debug - Detailed debug information.
+     * - 9 = All Messages
+     *
+     * You can also pass an array with threshold levels to show individual error types
+     *
+     *     array(1, 2, 3, 8) = Emergency, Alert, Critical, and Debug messages
+     *
+     * For a live site you'll usually enable Critical or higher (3) to be logged otherwise
+     * your log files will fill up very fast.
+     *
+     * @var int|list<int>
+     */
+    public $threshold = (ENVIRONMENT === 'production') ? 4 : 9;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Date Format for Logs
+     * --------------------------------------------------------------------------
+     *
+     * Each item that is logged has an associated date. You can use PHP date
+     * codes to set your own date formatting
+     */
+    public string $dateFormat = 'Y-m-d H:i:s';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Log Handlers
+     * --------------------------------------------------------------------------
+     *
+     * The logging system supports multiple actions to be taken when something
+     * is logged. This is done by allowing for multiple Handlers, special classes
+     * designed to write the log to their chosen destinations, whether that is
+     * a file on the getServer, a cloud-based service, or even taking actions such
+     * as emailing the dev team.
+     *
+     * Each handler is defined by the class name used for that handler, and it
+     * MUST implement the `CodeIgniter\Log\Handlers\HandlerInterface` interface.
+     *
+     * The value of each key is an array of configuration items that are sent
+     * to the constructor of each handler. The only required configuration item
+     * is the 'handles' element, which must be an array of integer log levels.
+     * This is most easily handled by using the constants defined in the
+     * `Psr\Log\LogLevel` class.
+     *
+     * Handlers are executed in the order defined in this array, starting with
+     * the handler on top and continuing down.
+     *
+     * @var array<class-string<HandlerInterface>, array<string, int|list<string>|string>>
+     */
+    public array $handlers = [
+        /*
+         * --------------------------------------------------------------------
+         * File Handler
+         * --------------------------------------------------------------------
+         */
+        FileHandler::class => [
+            // The log levels that this handler will handle.
+            'handles' => [
+                'critical',
+                'alert',
+                'emergency',
+                'debug',
+                'error',
+                'info',
+                'notice',
+                'warning',
+            ],
+
+            /*
+             * The default filename extension for log files.
+             * An extension of 'php' allows for protecting the log files via basic
+             * scripting, when they are to be stored under a publicly accessible directory.
+             *
+             * NOTE: Leaving it blank will default to 'log'.
+             */
+            'fileExtension' => '',
+
+            /*
+             * The file system permissions to be applied on newly created log files.
+             *
+             * IMPORTANT: This MUST be an integer (no quotes) and you MUST use octal
+             * integer notation (i.e. 0700, 0644, etc.)
+             */
+            'filePermissions' => 0644,
+
+            /*
+             * Logging Directory Path
+             *
+             * By default, logs are written to WRITEPATH . 'logs/'
+             * Specify a different destination here, if desired.
+             */
+            'path' => '',
+        ],
+
+        /*
+         * The ChromeLoggerHandler requires the use of the Chrome web browser
+         * and the ChromeLogger extension. Uncomment this block to use it.
+         */
+        // 'CodeIgniter\Log\Handlers\ChromeLoggerHandler' => [
+        //     /*
+        //      * The log levels that this handler will handle.
+        //      */
+        //     'handles' => ['critical', 'alert', 'emergency', 'debug',
+        //                   'error', 'info', 'notice', 'warning'],
+        // ],
+
+        /*
+         * The ErrorlogHandler writes the logs to PHP's native `error_log()` function.
+         * Uncomment this block to use it.
+         */
+        // 'CodeIgniter\Log\Handlers\ErrorlogHandler' => [
+        //     /* The log levels this handler can handle. */
+        //     'handles' => ['critical', 'alert', 'emergency', 'debug', 'error', 'info', 'notice', 'warning'],
+        //
+        //     /*
+        //     * The message type where the error should go. Can be 0 or 4, or use the
+        //     * class constants: `ErrorlogHandler::TYPE_OS` (0) or `ErrorlogHandler::TYPE_SAPI` (4)
+        //     */
+        //     'messageType' => 0,
+        // ],
+    ];
+}

app/Config/Migrations.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Migrations extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Enable/Disable Migrations
+     * --------------------------------------------------------------------------
+     *
+     * Migrations are enabled by default.
+     *
+     * You should enable migrations whenever you intend to do a schema migration
+     * and disable it back when you're done.
+     */
+    public bool $enabled = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Migrations Table
+     * --------------------------------------------------------------------------
+     *
+     * This is the name of the table that will store the current migrations state.
+     * When migrations runs it will store in a database table which migration
+     * files have already been run.
+     */
+    public string $table = 'migrations';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Timestamp Format
+     * --------------------------------------------------------------------------
+     *
+     * This is the format that will be used when creating new migrations
+     * using the CLI command:
+     *   > php spark make:migration
+     *
+     * NOTE: if you set an unsupported format, migration runner will not find
+     *       your migration files.
+     *
+     * Supported formats:
+     * - YmdHis_
+     * - Y-m-d-His_
+     * - Y_m_d_His_
+     */
+    public string $timestampFormat = 'Y-m-d-His_';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Enable/Disable Migration Lock
+     * --------------------------------------------------------------------------
+     *
+     * Locking is disabled by default.
+     *
+     * When enabled, it will prevent multiple migration processes
+     * from running at the same time by using a lock mechanism.
+     *
+     * This is useful in production environments to avoid conflicts
+     * or race conditions during concurrent deployments.
+     */
+    public bool $lock = false;
+}

app/Config/Mimes.php

@@ -0,0 +1,534 @@
+<?php
+
+namespace Config;
+
+/**
+ * This file contains an array of mime types.  It is used by the
+ * Upload class to help identify allowed file types.
+ *
+ * When more than one variation for an extension exist (like jpg, jpeg, etc)
+ * the most common one should be first in the array to aid the guess*
+ * methods. The same applies when more than one mime-type exists for a
+ * single extension.
+ *
+ * When working with mime types, please make sure you have the ´fileinfo´
+ * extension enabled to reliably detect the media types.
+ */
+class Mimes
+{
+    /**
+     * Map of extensions to mime types.
+     *
+     * @var array<string, list<string>|string>
+     */
+    public static array $mimes = [
+        'hqx' => [
+            'application/mac-binhex40',
+            'application/mac-binhex',
+            'application/x-binhex40',
+            'application/x-mac-binhex40',
+        ],
+        'cpt' => 'application/mac-compactpro',
+        'csv' => [
+            'text/csv',
+            'text/x-comma-separated-values',
+            'text/comma-separated-values',
+            'application/vnd.ms-excel',
+            'application/x-csv',
+            'text/x-csv',
+            'application/csv',
+            'application/excel',
+            'application/vnd.msexcel',
+            'text/plain',
+        ],
+        'bin' => [
+            'application/macbinary',
+            'application/mac-binary',
+            'application/octet-stream',
+            'application/x-binary',
+            'application/x-macbinary',
+        ],
+        'dms' => 'application/octet-stream',
+        'lha' => 'application/octet-stream',
+        'lzh' => 'application/octet-stream',
+        'exe' => [
+            'application/octet-stream',
+            'application/vnd.microsoft.portable-executable',
+            'application/x-dosexec',
+            'application/x-msdownload',
+        ],
+        'class' => 'application/octet-stream',
+        'psd'   => [
+            'application/x-photoshop',
+            'image/vnd.adobe.photoshop',
+        ],
+        'so'  => 'application/octet-stream',
+        'sea' => 'application/octet-stream',
+        'dll' => 'application/octet-stream',
+        'oda' => 'application/oda',
+        'pdf' => [
+            'application/pdf',
+            'application/force-download',
+            'application/x-download',
+        ],
+        'ai' => [
+            'application/pdf',
+            'application/postscript',
+        ],
+        'eps'  => 'application/postscript',
+        'ps'   => 'application/postscript',
+        'smi'  => 'application/smil',
+        'smil' => 'application/smil',
+        'mif'  => 'application/vnd.mif',
+        'xls'  => [
+            'application/vnd.ms-excel',
+            'application/msexcel',
+            'application/x-msexcel',
+            'application/x-ms-excel',
+            'application/x-excel',
+            'application/x-dos_ms_excel',
+            'application/xls',
+            'application/x-xls',
+            'application/excel',
+            'application/download',
+            'application/vnd.ms-office',
+            'application/msword',
+        ],
+        'ppt' => [
+            'application/vnd.ms-powerpoint',
+            'application/powerpoint',
+            'application/vnd.ms-office',
+            'application/msword',
+        ],
+        'pptx' => [
+            'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        ],
+        'wbxml' => 'application/wbxml',
+        'wmlc'  => 'application/wmlc',
+        'dcr'   => 'application/x-director',
+        'dir'   => 'application/x-director',
+        'dxr'   => 'application/x-director',
+        'dvi'   => 'application/x-dvi',
+        'gtar'  => 'application/x-gtar',
+        'gz'    => 'application/x-gzip',
+        'gzip'  => 'application/x-gzip',
+        'php'   => [
+            'application/x-php',
+            'application/x-httpd-php',
+            'application/php',
+            'text/php',
+            'text/x-php',
+            'application/x-httpd-php-source',
+        ],
+        'php4'  => 'application/x-httpd-php',
+        'php3'  => 'application/x-httpd-php',
+        'phtml' => 'application/x-httpd-php',
+        'phps'  => 'application/x-httpd-php-source',
+        'js'    => [
+            'application/x-javascript',
+            'text/plain',
+        ],
+        'swf' => 'application/x-shockwave-flash',
+        'sit' => 'application/x-stuffit',
+        'tar' => 'application/x-tar',
+        'tgz' => [
+            'application/x-tar',
+            'application/x-gzip-compressed',
+        ],
+        'z'     => 'application/x-compress',
+        'xhtml' => 'application/xhtml+xml',
+        'xht'   => 'application/xhtml+xml',
+        'zip'   => [
+            'application/x-zip',
+            'application/zip',
+            'application/x-zip-compressed',
+            'application/s-compressed',
+            'multipart/x-zip',
+        ],
+        'rar' => [
+            'application/vnd.rar',
+            'application/x-rar',
+            'application/rar',
+            'application/x-rar-compressed',
+        ],
+        'mid'  => 'audio/midi',
+        'midi' => 'audio/midi',
+        'mpga' => 'audio/mpeg',
+        'mp2'  => 'audio/mpeg',
+        'mp3'  => [
+            'audio/mpeg',
+            'audio/mpg',
+            'audio/mpeg3',
+            'audio/mp3',
+        ],
+        'aif' => [
+            'audio/x-aiff',
+            'audio/aiff',
+        ],
+        'aiff' => [
+            'audio/x-aiff',
+            'audio/aiff',
+        ],
+        'aifc' => 'audio/x-aiff',
+        'ram'  => 'audio/x-pn-realaudio',
+        'rm'   => 'audio/x-pn-realaudio',
+        'rpm'  => 'audio/x-pn-realaudio-plugin',
+        'ra'   => 'audio/x-realaudio',
+        'rv'   => 'video/vnd.rn-realvideo',
+        'wav'  => [
+            'audio/x-wav',
+            'audio/wave',
+            'audio/wav',
+        ],
+        'bmp' => [
+            'image/bmp',
+            'image/x-bmp',
+            'image/x-bitmap',
+            'image/x-xbitmap',
+            'image/x-win-bitmap',
+            'image/x-windows-bmp',
+            'image/ms-bmp',
+            'image/x-ms-bmp',
+            'application/bmp',
+            'application/x-bmp',
+            'application/x-win-bitmap',
+        ],
+        'gif' => 'image/gif',
+        'jpg' => [
+            'image/jpeg',
+            'image/pjpeg',
+        ],
+        'jpeg' => [
+            'image/jpeg',
+            'image/pjpeg',
+        ],
+        'jpe' => [
+            'image/jpeg',
+            'image/pjpeg',
+        ],
+        'jp2' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'j2k' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'jpf' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'jpg2' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'jpx' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'jpm' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'mj2' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'mjp2' => [
+            'image/jp2',
+            'video/mj2',
+            'image/jpx',
+            'image/jpm',
+        ],
+        'png' => [
+            'image/png',
+            'image/x-png',
+        ],
+        'webp' => 'image/webp',
+        'tif'  => 'image/tiff',
+        'tiff' => 'image/tiff',
+        'css'  => [
+            'text/css',
+            'text/plain',
+        ],
+        'html' => [
+            'text/html',
+            'text/plain',
+        ],
+        'htm' => [
+            'text/html',
+            'text/plain',
+        ],
+        'shtml' => [
+            'text/html',
+            'text/plain',
+        ],
+        'txt'  => 'text/plain',
+        'text' => 'text/plain',
+        'log'  => [
+            'text/plain',
+            'text/x-log',
+        ],
+        'rtx' => 'text/richtext',
+        'rtf' => 'text/rtf',
+        'xml' => [
+            'application/xml',
+            'text/xml',
+            'text/plain',
+        ],
+        'xsl' => [
+            'application/xml',
+            'text/xsl',
+            'text/xml',
+        ],
+        'mpeg' => 'video/mpeg',
+        'mpg'  => 'video/mpeg',
+        'mpe'  => 'video/mpeg',
+        'qt'   => 'video/quicktime',
+        'mov'  => 'video/quicktime',
+        'avi'  => [
+            'video/x-msvideo',
+            'video/msvideo',
+            'video/avi',
+            'application/x-troff-msvideo',
+        ],
+        'movie' => 'video/x-sgi-movie',
+        'doc'   => [
+            'application/msword',
+            'application/vnd.ms-office',
+        ],
+        'docx' => [
+            'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+            'application/zip',
+            'application/msword',
+            'application/x-zip',
+        ],
+        'dot' => [
+            'application/msword',
+            'application/vnd.ms-office',
+        ],
+        'dotx' => [
+            'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+            'application/zip',
+            'application/msword',
+        ],
+        'xlsx' => [
+            'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+            'application/zip',
+            'application/vnd.ms-excel',
+            'application/msword',
+            'application/x-zip',
+        ],
+        'xlsb' => 'application/vnd.ms-excel.sheet.binary.macroEnabled.12',
+        'xlsm' => 'application/vnd.ms-excel.sheet.macroEnabled.12',
+        'word' => [
+            'application/msword',
+            'application/octet-stream',
+        ],
+        'xl'   => 'application/excel',
+        'eml'  => 'message/rfc822',
+        'json' => [
+            'application/json',
+            'text/json',
+        ],
+        'pem' => [
+            'application/x-x509-user-cert',
+            'application/x-pem-file',
+            'application/octet-stream',
+        ],
+        'p10' => [
+            'application/x-pkcs10',
+            'application/pkcs10',
+        ],
+        'p12' => 'application/x-pkcs12',
+        'p7a' => 'application/x-pkcs7-signature',
+        'p7c' => [
+            'application/pkcs7-mime',
+            'application/x-pkcs7-mime',
+        ],
+        'p7m' => [
+            'application/pkcs7-mime',
+            'application/x-pkcs7-mime',
+        ],
+        'p7r' => 'application/x-pkcs7-certreqresp',
+        'p7s' => 'application/pkcs7-signature',
+        'crt' => [
+            'application/x-x509-ca-cert',
+            'application/x-x509-user-cert',
+            'application/pkix-cert',
+        ],
+        'crl' => [
+            'application/pkix-crl',
+            'application/pkcs-crl',
+        ],
+        'der' => 'application/x-x509-ca-cert',
+        'kdb' => 'application/octet-stream',
+        'pgp' => 'application/pgp',
+        'gpg' => 'application/gpg-keys',
+        'sst' => 'application/octet-stream',
+        'csr' => 'application/octet-stream',
+        'rsa' => 'application/x-pkcs7',
+        'cer' => [
+            'application/pkix-cert',
+            'application/x-x509-ca-cert',
+        ],
+        '3g2' => 'video/3gpp2',
+        '3gp' => [
+            'video/3gp',
+            'video/3gpp',
+        ],
+        'mp4' => 'video/mp4',
+        'm4a' => 'audio/x-m4a',
+        'f4v' => [
+            'video/mp4',
+            'video/x-f4v',
+        ],
+        'flv'  => 'video/x-flv',
+        'webm' => 'video/webm',
+        'aac'  => 'audio/x-acc',
+        'm4u'  => 'application/vnd.mpegurl',
+        'm3u'  => 'text/plain',
+        'xspf' => 'application/xspf+xml',
+        'vlc'  => 'application/videolan',
+        'wmv'  => [
+            'video/x-ms-wmv',
+            'video/x-ms-asf',
+        ],
+        'au'   => 'audio/x-au',
+        'ac3'  => 'audio/ac3',
+        'flac' => 'audio/x-flac',
+        'ogg'  => [
+            'audio/ogg',
+            'video/ogg',
+            'application/ogg',
+        ],
+        'kmz' => [
+            'application/vnd.google-earth.kmz',
+            'application/zip',
+            'application/x-zip',
+        ],
+        'kml' => [
+            'application/vnd.google-earth.kml+xml',
+            'application/xml',
+            'text/xml',
+        ],
+        'ics'  => 'text/calendar',
+        'ical' => 'text/calendar',
+        'zsh'  => 'text/x-scriptzsh',
+        '7zip' => [
+            'application/x-compressed',
+            'application/x-zip-compressed',
+            'application/zip',
+            'multipart/x-zip',
+        ],
+        'cdr' => [
+            'application/cdr',
+            'application/coreldraw',
+            'application/x-cdr',
+            'application/x-coreldraw',
+            'image/cdr',
+            'image/x-cdr',
+            'zz-application/zz-winassoc-cdr',
+        ],
+        'wma' => [
+            'audio/x-ms-wma',
+            'video/x-ms-asf',
+        ],
+        'jar' => [
+            'application/java-archive',
+            'application/x-java-application',
+            'application/x-jar',
+            'application/x-compressed',
+        ],
+        'svg' => [
+            'image/svg+xml',
+            'image/svg',
+            'application/xml',
+            'text/xml',
+        ],
+        'vcf' => 'text/x-vcard',
+        'srt' => [
+            'text/srt',
+            'text/plain',
+        ],
+        'vtt' => [
+            'text/vtt',
+            'text/plain',
+        ],
+        'ico' => [
+            'image/x-icon',
+            'image/x-ico',
+            'image/vnd.microsoft.icon',
+        ],
+        'stl' => [
+            'application/sla',
+            'application/vnd.ms-pki.stl',
+            'application/x-navistyle',
+            'model/stl',
+            'application/octet-stream',
+        ],
+    ];
+
+    /**
+     * Attempts to determine the best mime type for the given file extension.
+     *
+     * @return string|null The mime type found, or none if unable to determine.
+     */
+    public static function guessTypeFromExtension(string $extension)
+    {
+        $extension = trim(strtolower($extension), '. ');
+
+        if (! array_key_exists($extension, static::$mimes)) {
+            return null;
+        }
+
+        return is_array(static::$mimes[$extension]) ? static::$mimes[$extension][0] : static::$mimes[$extension];
+    }
+
+    /**
+     * Attempts to determine the best file extension for a given mime type.
+     *
+     * @param string|null $proposedExtension - default extension (in case there is more than one with the same mime type)
+     *
+     * @return string|null The extension determined, or null if unable to match.
+     */
+    public static function guessExtensionFromType(string $type, ?string $proposedExtension = null)
+    {
+        $type = trim(strtolower($type), '. ');
+
+        $proposedExtension = trim(strtolower($proposedExtension ?? ''));
+
+        if (
+            $proposedExtension !== ''
+            && array_key_exists($proposedExtension, static::$mimes)
+            && in_array($type, (array) static::$mimes[$proposedExtension], true)
+        ) {
+            // The detected mime type matches with the proposed extension.
+            return $proposedExtension;
+        }
+
+        // Reverse check the mime type list if no extension was proposed.
+        // This search is order sensitive!
+        foreach (static::$mimes as $ext => $types) {
+            if (in_array($type, (array) $types, true)) {
+                return $ext;
+            }
+        }
+
+        return null;
+    }
+}

app/Config/Modules.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Modules\Modules as BaseModules;
+
+/**
+ * Modules Configuration.
+ *
+ * NOTE: This class is required prior to Autoloader instantiation,
+ *       and does not extend BaseConfig.
+ */
+class Modules extends BaseModules
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Enable Auto-Discovery?
+     * --------------------------------------------------------------------------
+     *
+     * If true, then auto-discovery will happen across all elements listed in
+     * $aliases below. If false, no auto-discovery will happen at all,
+     * giving a slight performance boost.
+     *
+     * @var bool
+     */
+    public $enabled = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Enable Auto-Discovery Within Composer Packages?
+     * --------------------------------------------------------------------------
+     *
+     * If true, then auto-discovery will happen across all namespaces loaded
+     * by Composer, as well as the namespaces configured locally.
+     *
+     * @var bool
+     */
+    public $discoverInComposer = true;
+
+    /**
+     * The Composer package list for Auto-Discovery
+     * This setting is optional.
+     *
+     * E.g.:
+     *   [
+     *       'only' => [
+     *           // List up all packages to auto-discover
+     *           'codeigniter4/shield',
+     *       ],
+     *   ]
+     *   or
+     *   [
+     *       'exclude' => [
+     *           // List up packages to exclude.
+     *           'pestphp/pest',
+     *       ],
+     *   ]
+     *
+     * @var array{only?: list<string>, exclude?: list<string>}
+     */
+    public $composerPackages = [];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Auto-Discovery Rules
+     * --------------------------------------------------------------------------
+     *
+     * Aliases list of all discovery classes that will be active and used during
+     * the current application request.
+     *
+     * If it is not listed, only the base application elements will be used.
+     *
+     * @var list<string>
+     */
+    public $aliases = [
+        'events',
+        'filters',
+        'registrars',
+        'routes',
+        'services',
+    ];
+}

app/Config/Optimize.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Config;
+
+/**
+ * Optimization Configuration.
+ *
+ * NOTE: This class does not extend BaseConfig for performance reasons.
+ *       So you cannot replace the property values with Environment Variables.
+ *
+ * WARNING: Do not use these options when running the app in the Worker Mode.
+ */
+class Optimize
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Config Caching
+     * --------------------------------------------------------------------------
+     *
+     * @see https://codeigniter.com/user_guide/concepts/factories.html#config-caching
+     */
+    public bool $configCacheEnabled = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Config Caching
+     * --------------------------------------------------------------------------
+     *
+     * @see https://codeigniter.com/user_guide/concepts/autoloader.html#file-locator-caching
+     */
+    public bool $locatorCacheEnabled = false;
+}

app/Config/Pager.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Pager extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Templates
+     * --------------------------------------------------------------------------
+     *
+     * Pagination links are rendered out using views to configure their
+     * appearance. This array contains aliases and the view names to
+     * use when rendering the links.
+     *
+     * Within each view, the Pager object will be available as $pager,
+     * and the desired group as $pagerGroup;
+     *
+     * @var array<string, string>
+     */
+    public array $templates = [
+        'default_full'   => 'CodeIgniter\Pager\Views\default_full',
+        'default_simple' => 'CodeIgniter\Pager\Views\default_simple',
+        'default_head'   => 'CodeIgniter\Pager\Views\default_head',
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Items Per Page
+     * --------------------------------------------------------------------------
+     *
+     * The default number of results shown in a single page.
+     */
+    public int $perPage = 20;
+}

app/Config/Paths.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace Config;
+
+/**
+ * Paths
+ *
+ * Holds the paths that are used by the system to
+ * locate the main directories, app, system, etc.
+ *
+ * Modifying these allows you to restructure your application,
+ * share a system folder between multiple applications, and more.
+ *
+ * All paths are relative to the project's root folder.
+ *
+ * NOTE: This class is required prior to Autoloader instantiation,
+ *       and does not extend BaseConfig.
+ */
+class Paths
+{
+    /**
+     * ---------------------------------------------------------------
+     * SYSTEM FOLDER NAME
+     * ---------------------------------------------------------------
+     *
+     * This must contain the name of your "system" folder. Include
+     * the path if the folder is not in the same directory as this file.
+     */
+    public string $systemDirectory = __DIR__ . '/../../vendor/codeigniter4/framework/system';
+
+    /**
+     * ---------------------------------------------------------------
+     * APPLICATION FOLDER NAME
+     * ---------------------------------------------------------------
+     *
+     * If you want this front controller to use a different "app"
+     * folder than the default one you can set its name here. The folder
+     * can also be renamed or relocated anywhere on your server. If
+     * you do, use a full server path.
+     *
+     * @see http://codeigniter.com/user_guide/general/managing_apps.html
+     */
+    public string $appDirectory = __DIR__ . '/..';
+
+    /**
+     * ---------------------------------------------------------------
+     * WRITABLE DIRECTORY NAME
+     * ---------------------------------------------------------------
+     *
+     * This variable must contain the name of your "writable" directory.
+     * The writable directory allows you to group all directories that
+     * need write permission to a single place that can be tucked away
+     * for maximum security, keeping it out of the app and/or
+     * system directories.
+     */
+    public string $writableDirectory = __DIR__ . '/../../writable';
+
+    /**
+     * ---------------------------------------------------------------
+     * TESTS DIRECTORY NAME
+     * ---------------------------------------------------------------
+     *
+     * This variable must contain the name of your "tests" directory.
+     */
+    public string $testsDirectory = __DIR__ . '/../../tests';
+
+    /**
+     * ---------------------------------------------------------------
+     * VIEW DIRECTORY NAME
+     * ---------------------------------------------------------------
+     *
+     * This variable must contain the name of the directory that
+     * contains the view files used by your application. By
+     * default this is in `app/Views`. This value
+     * is used when no value is provided to `Services::renderer()`.
+     */
+    public string $viewDirectory = __DIR__ . '/../Views';
+
+    /**
+     * ---------------------------------------------------------------
+     * ENVIRONMENT DIRECTORY NAME
+     * ---------------------------------------------------------------
+     *
+     * This variable must contain the name of the directory where
+     * the .env file is located.
+     * Please consider security implications when changing this
+     * value - the directory should not be publicly accessible.
+     */
+    public string $envDirectory = __DIR__ . '/../../';
+}

app/Config/Publisher.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\Publisher as BasePublisher;
+
+/**
+ * Publisher Configuration
+ *
+ * Defines basic security restrictions for the Publisher class
+ * to prevent abuse by injecting malicious files into a project.
+ */
+class Publisher extends BasePublisher
+{
+    /**
+     * A list of allowed destinations with a (pseudo-)regex
+     * of allowed files for each destination.
+     * Attempts to publish to directories not in this list will
+     * result in a PublisherException. Files that do no fit the
+     * pattern will cause copy/merge to fail.
+     *
+     * @var array<string, string>
+     */
+    public $restrictions = [
+        ROOTPATH => '*',
+        FCPATH   => '#\.(s?css|js|map|html?|xml|json|webmanifest|ttf|eot|woff2?|gif|jpe?g|tiff?|png|webp|bmp|ico|svg)$#i',
+    ];
+}

app/Config/Routes.php

@@ -0,0 +1,60 @@
+<?php
+
+use CodeIgniter\Router\RouteCollection;
+
+/** @var RouteCollection $routes */
+
+// Publiczne (logowanie jednego uzytkownika z .env)
+$routes->get('login', 'Auth::login');
+$routes->post('login', 'Auth::login');
+$routes->get('logout', 'Auth::logout');
+
+// Chronione filtrem 'auth'
+$routes->group('', ['filter' => 'auth'], static function (RouteCollection $routes): void {
+    $routes->get('/', 'Dashboard::index');
+    $routes->get('dashboard', 'Dashboard::index');
+    $routes->get('finances', 'Dashboard::finances');
+
+    // Kategorie
+    $routes->get('categories', 'Categories::index');
+    $routes->get('categories/new', 'Categories::new');
+    $routes->post('categories', 'Categories::create');
+    $routes->get('categories/(:num)/edit', 'Categories::edit/$1');
+    $routes->post('categories/(:num)', 'Categories::update/$1');
+    $routes->get('categories/(:num)/delete', 'Categories::delete/$1');
+
+    // Operacje
+    $routes->get('operations', 'Operations::index');
+    $routes->get('operations/new', 'Operations::new');
+    $routes->post('operations', 'Operations::create');
+    $routes->get('operations/(:num)/edit', 'Operations::edit/$1');
+    $routes->post('operations/(:num)', 'Operations::update/$1');
+    $routes->get('operations/(:num)/delete', 'Operations::delete/$1');
+
+    // Inwestycje — pulpit
+    $routes->get('investments', 'Investments::index');
+
+    // Inwestycje — instrumenty
+    $routes->get('instruments', 'Instruments::index');
+    $routes->get('instruments/new', 'Instruments::new');
+    $routes->post('instruments', 'Instruments::create');
+    $routes->get('instruments/(:num)/edit', 'Instruments::edit/$1');
+    $routes->post('instruments/(:num)', 'Instruments::update/$1');
+    $routes->get('instruments/(:num)/delete', 'Instruments::delete/$1');
+
+    // Inwestycje — operacje (wpłaty/wypłaty)
+    $routes->get('investments/operations', 'InvOperations::index');
+    $routes->get('investments/operations/new', 'InvOperations::new');
+    $routes->post('investments/operations', 'InvOperations::create');
+    $routes->get('investments/operations/(:num)/edit', 'InvOperations::edit/$1');
+    $routes->post('investments/operations/(:num)', 'InvOperations::update/$1');
+    $routes->get('investments/operations/(:num)/delete', 'InvOperations::delete/$1');
+
+    // Inwestycje — wyceny
+    $routes->get('investments/valuations', 'Valuations::index');
+    $routes->get('investments/valuations/new', 'Valuations::new');
+    $routes->post('investments/valuations', 'Valuations::create');
+    $routes->get('investments/valuations/(:num)/edit', 'Valuations::edit/$1');
+    $routes->post('investments/valuations/(:num)', 'Valuations::update/$1');
+    $routes->get('investments/valuations/(:num)/delete', 'Valuations::delete/$1');
+});

app/Config/Routing.php

@@ -0,0 +1,149 @@
+<?php
+
+/**
+ * This file is part of CodeIgniter 4 framework.
+ *
+ * (c) CodeIgniter Foundation <admin@codeigniter.com>
+ *
+ * For the full copyright and license information, please view
+ * the LICENSE file that was distributed with this source code.
+ */
+
+namespace Config;
+
+use CodeIgniter\Config\Routing as BaseRouting;
+
+/**
+ * Routing configuration
+ */
+class Routing extends BaseRouting
+{
+    /**
+     * For Defined Routes.
+     * An array of files that contain route definitions.
+     * Route files are read in order, with the first match
+     * found taking precedence.
+     *
+     * Default: APPPATH . 'Config/Routes.php'
+     *
+     * @var list<string>
+     */
+    public array $routeFiles = [
+        APPPATH . 'Config/Routes.php',
+    ];
+
+    /**
+     * For Defined Routes and Auto Routing.
+     * The default namespace to use for Controllers when no other
+     * namespace has been specified.
+     *
+     * Default: 'App\Controllers'
+     */
+    public string $defaultNamespace = 'App\Controllers';
+
+    /**
+     * For Auto Routing.
+     * The default controller to use when no other controller has been
+     * specified.
+     *
+     * Default: 'Home'
+     */
+    public string $defaultController = 'Home';
+
+    /**
+     * For Defined Routes and Auto Routing.
+     * The default method to call on the controller when no other
+     * method has been set in the route.
+     *
+     * Default: 'index'
+     */
+    public string $defaultMethod = 'index';
+
+    /**
+     * For Auto Routing.
+     * Whether to translate dashes in URIs for controller/method to underscores.
+     * Primarily useful when using the auto-routing.
+     *
+     * Default: false
+     */
+    public bool $translateURIDashes = false;
+
+    /**
+     * Sets the class/method that should be called if routing doesn't
+     * find a match. It can be the controller/method name like: Users::index
+     *
+     * This setting is passed to the Router class and handled there.
+     *
+     * If you want to use a closure, you will have to set it in the
+     * routes file by calling:
+     *
+     * $routes->set404Override(function() {
+     *    // Do something here
+     * });
+     *
+     * Example:
+     *  public $override404 = 'App\Errors::show404';
+     */
+    public ?string $override404 = null;
+
+    /**
+     * If TRUE, the system will attempt to match the URI against
+     * Controllers by matching each segment against folders/files
+     * in APPPATH/Controllers, when a match wasn't found against
+     * defined routes.
+     *
+     * If FALSE, will stop searching and do NO automatic routing.
+     */
+    public bool $autoRoute = false;
+
+    /**
+     * If TRUE, the system will look for attributes on controller
+     * class and methods that can run before and after the
+     * controller/method.
+     *
+     * If FALSE, will ignore any attributes.
+     */
+    public bool $useControllerAttributes = true;
+
+    /**
+     * For Defined Routes.
+     * If TRUE, will enable the use of the 'prioritize' option
+     * when defining routes.
+     *
+     * Default: false
+     */
+    public bool $prioritize = false;
+
+    /**
+     * For Defined Routes.
+     * If TRUE, matched multiple URI segments will be passed as one parameter.
+     *
+     * Default: false
+     */
+    public bool $multipleSegmentsOneParam = false;
+
+    /**
+     * For Auto Routing (Improved).
+     * Map of URI segments and namespaces.
+     *
+     * The key is the first URI segment. The value is the controller namespace.
+     * E.g.,
+     *   [
+     *       'blog' => 'Acme\Blog\Controllers',
+     *   ]
+     *
+     * @var array<string, string>
+     */
+    public array $moduleRoutes = [];
+
+    /**
+     * For Auto Routing (Improved).
+     * Whether to translate dashes in URIs for controller/method to CamelCase.
+     * E.g., blog-controller -> BlogController
+     *
+     * If you enable this, $translateURIDashes is ignored.
+     *
+     * Default: false
+     */
+    public bool $translateUriToCamelCase = true;
+}

app/Config/Security.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class Security extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Protection Method
+     * --------------------------------------------------------------------------
+     *
+     * Protection Method for Cross Site Request Forgery protection.
+     *
+     * @var string 'cookie' or 'session'
+     */
+    public string $csrfProtection = 'cookie';
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Token Randomization
+     * --------------------------------------------------------------------------
+     *
+     * Randomize the CSRF Token for added security.
+     */
+    public bool $tokenRandomize = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Token Name
+     * --------------------------------------------------------------------------
+     *
+     * Token name for Cross Site Request Forgery protection.
+     */
+    public string $tokenName = 'csrf_test_name';
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Header Name
+     * --------------------------------------------------------------------------
+     *
+     * Header name for Cross Site Request Forgery protection.
+     */
+    public string $headerName = 'X-CSRF-TOKEN';
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Cookie Name
+     * --------------------------------------------------------------------------
+     *
+     * Cookie name for Cross Site Request Forgery protection.
+     */
+    public string $cookieName = 'csrf_cookie_name';
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Expires
+     * --------------------------------------------------------------------------
+     *
+     * Expiration time for Cross Site Request Forgery protection cookie.
+     *
+     * Defaults to two hours (in seconds).
+     */
+    public int $expires = 7200;
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Regenerate
+     * --------------------------------------------------------------------------
+     *
+     * Regenerate CSRF Token on every submission.
+     */
+    public bool $regenerate = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * CSRF Redirect
+     * --------------------------------------------------------------------------
+     *
+     * Redirect to previous page with error on failure.
+     *
+     * @see https://codeigniter4.github.io/userguide/libraries/security.html#redirection-on-failure
+     */
+    public bool $redirect = (ENVIRONMENT === 'production');
+}

app/Config/Services.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseService;
+
+/**
+ * Services Configuration file.
+ *
+ * Services are simply other classes/libraries that the system uses
+ * to do its job. This is used by CodeIgniter to allow the core of the
+ * framework to be swapped out easily without affecting the usage within
+ * the rest of your application.
+ *
+ * This file holds any application-specific services, or service overrides
+ * that you might need. An example has been included with the general
+ * method format you should use for your service methods. For more examples,
+ * see the core Services file at system/Config/Services.php.
+ */
+class Services extends BaseService
+{
+    /*
+     * public static function example($getShared = true)
+     * {
+     *     if ($getShared) {
+     *         return static::getSharedInstance('example');
+     *     }
+     *
+     *     return new \CodeIgniter\Example();
+     * }
+     */
+}

app/Config/Session.php

@@ -0,0 +1,128 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Session\Handlers\BaseHandler;
+use CodeIgniter\Session\Handlers\FileHandler;
+
+class Session extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Session Driver
+     * --------------------------------------------------------------------------
+     *
+     * The session storage driver to use:
+     * - `CodeIgniter\Session\Handlers\ArrayHandler` (for testing)
+     * - `CodeIgniter\Session\Handlers\FileHandler`
+     * - `CodeIgniter\Session\Handlers\DatabaseHandler`
+     * - `CodeIgniter\Session\Handlers\MemcachedHandler`
+     * - `CodeIgniter\Session\Handlers\RedisHandler`
+     *
+     * @var class-string<BaseHandler>
+     */
+    public string $driver = FileHandler::class;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Cookie Name
+     * --------------------------------------------------------------------------
+     *
+     * The session cookie name, must contain only [0-9a-z_-] characters
+     */
+    public string $cookieName = 'ci_session';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Expiration
+     * --------------------------------------------------------------------------
+     *
+     * The number of SECONDS you want the session to last.
+     * Setting to 0 (zero) means expire when the browser is closed.
+     */
+    public int $expiration = 7200;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Save Path
+     * --------------------------------------------------------------------------
+     *
+     * The location to save sessions to and is driver dependent.
+     *
+     * For the 'files' driver, it's a path to a writable directory.
+     * WARNING: Only absolute paths are supported!
+     *
+     * For the 'database' driver, it's a table name.
+     * Please read up the manual for the format with other session drivers.
+     *
+     * IMPORTANT: You are REQUIRED to set a valid save path!
+     */
+    public string $savePath = WRITEPATH . 'session';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Match IP
+     * --------------------------------------------------------------------------
+     *
+     * Whether to match the user's IP address when reading the session data.
+     *
+     * WARNING: If you're using the database driver, don't forget to update
+     *          your session table's PRIMARY KEY when changing this setting.
+     */
+    public bool $matchIP = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Time to Update
+     * --------------------------------------------------------------------------
+     *
+     * How many seconds between CI regenerating the session ID.
+     */
+    public int $timeToUpdate = 300;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Regenerate Destroy
+     * --------------------------------------------------------------------------
+     *
+     * Whether to destroy session data associated with the old session ID
+     * when auto-regenerating the session ID. When set to FALSE, the data
+     * will be later deleted by the garbage collector.
+     */
+    public bool $regenerateDestroy = false;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Session Database Group
+     * --------------------------------------------------------------------------
+     *
+     * DB Group for the database session.
+     */
+    public ?string $DBGroup = null;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Lock Retry Interval (microseconds)
+     * --------------------------------------------------------------------------
+     *
+     * This is used for RedisHandler.
+     *
+     * Time (microseconds) to wait if lock cannot be acquired.
+     * The default is 100,000 microseconds (= 0.1 seconds).
+     */
+    public int $lockRetryInterval = 100_000;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Lock Max Retries
+     * --------------------------------------------------------------------------
+     *
+     * This is used for RedisHandler.
+     *
+     * Maximum number of lock acquisition attempts.
+     * The default is 300 times. That is lock timeout is about 30 (0.1 * 300)
+     * seconds.
+     */
+    public int $lockMaxRetries = 300;
+}

app/Config/Toolbar.php

@@ -0,0 +1,147 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Debug\Toolbar\Collectors\Database;
+use CodeIgniter\Debug\Toolbar\Collectors\Events;
+use CodeIgniter\Debug\Toolbar\Collectors\Files;
+use CodeIgniter\Debug\Toolbar\Collectors\Logs;
+use CodeIgniter\Debug\Toolbar\Collectors\Routes;
+use CodeIgniter\Debug\Toolbar\Collectors\Timers;
+use CodeIgniter\Debug\Toolbar\Collectors\Views;
+
+/**
+ * --------------------------------------------------------------------------
+ * Debug Toolbar
+ * --------------------------------------------------------------------------
+ *
+ * The Debug Toolbar provides a way to see information about the performance
+ * and state of your application during that page display. By default it will
+ * NOT be displayed under production environments, and will only display if
+ * `CI_DEBUG` is true, since if it's not, there's not much to display anyway.
+ */
+class Toolbar extends BaseConfig
+{
+    /**
+     * --------------------------------------------------------------------------
+     * Toolbar Collectors
+     * --------------------------------------------------------------------------
+     *
+     * List of toolbar collectors that will be called when Debug Toolbar
+     * fires up and collects data from.
+     *
+     * @var list<class-string>
+     */
+    public array $collectors = [
+        Timers::class,
+        Database::class,
+        Logs::class,
+        Views::class,
+        // \CodeIgniter\Debug\Toolbar\Collectors\Cache::class,
+        Files::class,
+        Routes::class,
+        Events::class,
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Collect Var Data
+     * --------------------------------------------------------------------------
+     *
+     * If set to false var data from the views will not be collected. Useful to
+     * avoid high memory usage when there are lots of data passed to the view.
+     */
+    public bool $collectVarData = true;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Max History
+     * --------------------------------------------------------------------------
+     *
+     * `$maxHistory` sets a limit on the number of past requests that are stored,
+     * helping to conserve file space used to store them. You can set it to
+     * 0 (zero) to not have any history stored, or -1 for unlimited history.
+     */
+    public int $maxHistory = 20;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Toolbar Views Path
+     * --------------------------------------------------------------------------
+     *
+     * The full path to the the views that are used by the toolbar.
+     * This MUST have a trailing slash.
+     */
+    public string $viewsPath = SYSTEMPATH . 'Debug/Toolbar/Views/';
+
+    /**
+     * --------------------------------------------------------------------------
+     * Max Queries
+     * --------------------------------------------------------------------------
+     *
+     * If the Database Collector is enabled, it will log every query that the
+     * the system generates so they can be displayed on the toolbar's timeline
+     * and in the query log. This can lead to memory issues in some instances
+     * with hundreds of queries.
+     *
+     * `$maxQueries` defines the maximum amount of queries that will be stored.
+     */
+    public int $maxQueries = 100;
+
+    /**
+     * --------------------------------------------------------------------------
+     * Watched Directories
+     * --------------------------------------------------------------------------
+     *
+     * Contains an array of directories that will be watched for changes and
+     * used to determine if the hot-reload feature should reload the page or not.
+     * We restrict the values to keep performance as high as possible.
+     *
+     * NOTE: The ROOTPATH will be prepended to all values.
+     *
+     * @var list<string>
+     */
+    public array $watchedDirectories = [
+        'app',
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Watched File Extensions
+     * --------------------------------------------------------------------------
+     *
+     * Contains an array of file extensions that will be watched for changes and
+     * used to determine if the hot-reload feature should reload the page or not.
+     *
+     * @var list<string>
+     */
+    public array $watchedExtensions = [
+        'php', 'css', 'js', 'html', 'svg', 'json', 'env',
+    ];
+
+    /**
+     * --------------------------------------------------------------------------
+     * Ignored HTTP Headers
+     * --------------------------------------------------------------------------
+     *
+     * CodeIgniter Debug Toolbar normally injects HTML and JavaScript into every
+     * HTML response. This is correct for full page loads, but it breaks requests
+     * that expect only a clean HTML fragment.
+     *
+     * Libraries like HTMX, Unpoly, and Hotwire (Turbo) update parts of the page or
+     * manage navigation on the client side. Injecting the Debug Toolbar into their
+     * responses can cause invalid HTML, duplicated scripts, or JavaScript errors
+     * (such as infinite loops or "Maximum call stack size exceeded").
+     *
+     * Any request containing one of the following headers is treated as a
+     * client-managed or partial request, and the Debug Toolbar injection is skipped.
+     *
+     * @var array<string, string|null>
+     */
+    public array $disableOnHeaders = [
+        'X-Requested-With' => 'xmlhttprequest', // AJAX requests
+        'HX-Request'       => 'true',           // HTMX requests
+        'X-Up-Version'     => null,             // Unpoly partial requests
+    ];
+}

app/Config/UserAgents.php

@@ -0,0 +1,262 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+/**
+ * -------------------------------------------------------------------
+ * User Agents
+ * -------------------------------------------------------------------
+ *
+ * This file contains four arrays of user agent data. It is used by the
+ * User Agent Class to help identify browser, platform, robot, and
+ * mobile device data. The array keys are used to identify the device
+ * and the array values are used to set the actual name of the item.
+ */
+class UserAgents extends BaseConfig
+{
+    /**
+     * -------------------------------------------------------------------
+     * OS Platforms
+     * -------------------------------------------------------------------
+     *
+     * @var array<string, string>
+     */
+    public array $platforms = [
+        'windows nt 10.0' => 'Windows 10',
+        'windows nt 6.3'  => 'Windows 8.1',
+        'windows nt 6.2'  => 'Windows 8',
+        'windows nt 6.1'  => 'Windows 7',
+        'windows nt 6.0'  => 'Windows Vista',
+        'windows nt 5.2'  => 'Windows 2003',
+        'windows nt 5.1'  => 'Windows XP',
+        'windows nt 5.0'  => 'Windows 2000',
+        'windows nt 4.0'  => 'Windows NT 4.0',
+        'winnt4.0'        => 'Windows NT 4.0',
+        'winnt 4.0'       => 'Windows NT',
+        'winnt'           => 'Windows NT',
+        'windows 98'      => 'Windows 98',
+        'win98'           => 'Windows 98',
+        'windows 95'      => 'Windows 95',
+        'win95'           => 'Windows 95',
+        'windows phone'   => 'Windows Phone',
+        'windows'         => 'Unknown Windows OS',
+        'android'         => 'Android',
+        'blackberry'      => 'BlackBerry',
+        'iphone'          => 'iOS',
+        'ipad'            => 'iOS',
+        'ipod'            => 'iOS',
+        'os x'            => 'Mac OS X',
+        'ppc mac'         => 'Power PC Mac',
+        'freebsd'         => 'FreeBSD',
+        'ppc'             => 'Macintosh',
+        'linux'           => 'Linux',
+        'debian'          => 'Debian',
+        'sunos'           => 'Sun Solaris',
+        'beos'            => 'BeOS',
+        'apachebench'     => 'ApacheBench',
+        'aix'             => 'AIX',
+        'irix'            => 'Irix',
+        'osf'             => 'DEC OSF',
+        'hp-ux'           => 'HP-UX',
+        'netbsd'          => 'NetBSD',
+        'bsdi'            => 'BSDi',
+        'openbsd'         => 'OpenBSD',
+        'gnu'             => 'GNU/Linux',
+        'unix'            => 'Unknown Unix OS',
+        'symbian'         => 'Symbian OS',
+    ];
+
+    /**
+     * -------------------------------------------------------------------
+     * Browsers
+     * -------------------------------------------------------------------
+     *
+     * The order of this array should NOT be changed. Many browsers return
+     * multiple browser types so we want to identify the subtype first.
+     *
+     * @var array<string, string>
+     */
+    public array $browsers = [
+        'OPR'    => 'Opera',
+        'Flock'  => 'Flock',
+        'Edge'   => 'Spartan',
+        'Edg'    => 'Edge',
+        'Chrome' => 'Chrome',
+        // Opera 10+ always reports Opera/9.80 and appends Version/<real version> to the user agent string
+        'Opera.*?Version'   => 'Opera',
+        'Opera'             => 'Opera',
+        'MSIE'              => 'Internet Explorer',
+        'Internet Explorer' => 'Internet Explorer',
+        'Trident.* rv'      => 'Internet Explorer',
+        'Shiira'            => 'Shiira',
+        'Firefox'           => 'Firefox',
+        'Chimera'           => 'Chimera',
+        'Phoenix'           => 'Phoenix',
+        'Firebird'          => 'Firebird',
+        'Camino'            => 'Camino',
+        'Netscape'          => 'Netscape',
+        'OmniWeb'           => 'OmniWeb',
+        'Safari'            => 'Safari',
+        'Mozilla'           => 'Mozilla',
+        'Konqueror'         => 'Konqueror',
+        'icab'              => 'iCab',
+        'Lynx'              => 'Lynx',
+        'Links'             => 'Links',
+        'hotjava'           => 'HotJava',
+        'amaya'             => 'Amaya',
+        'IBrowse'           => 'IBrowse',
+        'Maxthon'           => 'Maxthon',
+        'Ubuntu'            => 'Ubuntu Web Browser',
+        'Vivaldi'           => 'Vivaldi',
+    ];
+
+    /**
+     * -------------------------------------------------------------------
+     * Mobiles
+     * -------------------------------------------------------------------
+     *
+     * @var array<string, string>
+     */
+    public array $mobiles = [
+        // legacy array, old values commented out
+        'mobileexplorer' => 'Mobile Explorer',
+        // 'openwave'             => 'Open Wave',
+        // 'opera mini'           => 'Opera Mini',
+        // 'operamini'            => 'Opera Mini',
+        // 'elaine'               => 'Palm',
+        'palmsource' => 'Palm',
+        // 'digital paths'        => 'Palm',
+        // 'avantgo'              => 'Avantgo',
+        // 'xiino'                => 'Xiino',
+        'palmscape' => 'Palmscape',
+        // 'nokia'                => 'Nokia',
+        // 'ericsson'             => 'Ericsson',
+        // 'blackberry'           => 'BlackBerry',
+        // 'motorola'             => 'Motorola'
+
+        // Phones and Manufacturers
+        'motorola'             => 'Motorola',
+        'nokia'                => 'Nokia',
+        'palm'                 => 'Palm',
+        'iphone'               => 'Apple iPhone',
+        'ipad'                 => 'iPad',
+        'ipod'                 => 'Apple iPod Touch',
+        'sony'                 => 'Sony Ericsson',
+        'ericsson'             => 'Sony Ericsson',
+        'blackberry'           => 'BlackBerry',
+        'cocoon'               => 'O2 Cocoon',
+        'blazer'               => 'Treo',
+        'lg'                   => 'LG',
+        'amoi'                 => 'Amoi',
+        'xda'                  => 'XDA',
+        'mda'                  => 'MDA',
+        'vario'                => 'Vario',
+        'htc'                  => 'HTC',
+        'samsung'              => 'Samsung',
+        'sharp'                => 'Sharp',
+        'sie-'                 => 'Siemens',
+        'alcatel'              => 'Alcatel',
+        'benq'                 => 'BenQ',
+        'ipaq'                 => 'HP iPaq',
+        'mot-'                 => 'Motorola',
+        'playstation portable' => 'PlayStation Portable',
+        'playstation 3'        => 'PlayStation 3',
+        'playstation vita'     => 'PlayStation Vita',
+        'hiptop'               => 'Danger Hiptop',
+        'nec-'                 => 'NEC',
+        'panasonic'            => 'Panasonic',
+        'philips'              => 'Philips',
+        'sagem'                => 'Sagem',
+        'sanyo'                => 'Sanyo',
+        'spv'                  => 'SPV',
+        'zte'                  => 'ZTE',
+        'sendo'                => 'Sendo',
+        'nintendo dsi'         => 'Nintendo DSi',
+        'nintendo ds'          => 'Nintendo DS',
+        'nintendo 3ds'         => 'Nintendo 3DS',
+        'wii'                  => 'Nintendo Wii',
+        'open web'             => 'Open Web',
+        'openweb'              => 'OpenWeb',
+
+        // Operating Systems
+        'android'    => 'Android',
+        'symbian'    => 'Symbian',
+        'SymbianOS'  => 'SymbianOS',
+        'elaine'     => 'Palm',
+        'series60'   => 'Symbian S60',
+        'windows ce' => 'Windows CE',
+
+        // Browsers
+        'obigo'         => 'Obigo',
+        'netfront'      => 'Netfront Browser',
+        'openwave'      => 'Openwave Browser',
+        'mobilexplorer' => 'Mobile Explorer',
+        'operamini'     => 'Opera Mini',
+        'opera mini'    => 'Opera Mini',
+        'opera mobi'    => 'Opera Mobile',
+        'fennec'        => 'Firefox Mobile',
+
+        // Other
+        'digital paths' => 'Digital Paths',
+        'avantgo'       => 'AvantGo',
+        'xiino'         => 'Xiino',
+        'novarra'       => 'Novarra Transcoder',
+        'vodafone'      => 'Vodafone',
+        'docomo'        => 'NTT DoCoMo',
+        'o2'            => 'O2',
+
+        // Fallback
+        'mobile'     => 'Generic Mobile',
+        'wireless'   => 'Generic Mobile',
+        'j2me'       => 'Generic Mobile',
+        'midp'       => 'Generic Mobile',
+        'cldc'       => 'Generic Mobile',
+        'up.link'    => 'Generic Mobile',
+        'up.browser' => 'Generic Mobile',
+        'smartphone' => 'Generic Mobile',
+        'cellphone'  => 'Generic Mobile',
+    ];
+
+    /**
+     * -------------------------------------------------------------------
+     * Robots
+     * -------------------------------------------------------------------
+     *
+     * There are hundred of bots but these are the most common.
+     *
+     * @var array<string, string>
+     */
+    public array $robots = [
+        'googlebot'            => 'Googlebot',
+        'google-pagerenderer'  => 'Google Page Renderer',
+        'google-read-aloud'    => 'Google Read Aloud',
+        'google-safety'        => 'Google Safety Bot',
+        'msnbot'               => 'MSNBot',
+        'baiduspider'          => 'Baiduspider',
+        'bingbot'              => 'Bing',
+        'bingpreview'          => 'BingPreview',
+        'slurp'                => 'Inktomi Slurp',
+        'yahoo'                => 'Yahoo',
+        'ask jeeves'           => 'Ask Jeeves',
+        'fastcrawler'          => 'FastCrawler',
+        'infoseek'             => 'InfoSeek Robot 1.0',
+        'lycos'                => 'Lycos',
+        'yandex'               => 'YandexBot',
+        'mediapartners-google' => 'MediaPartners Google',
+        'CRAZYWEBCRAWLER'      => 'Crazy Webcrawler',
+        'adsbot-google'        => 'AdsBot Google',
+        'feedfetcher-google'   => 'Feedfetcher Google',
+        'curious george'       => 'Curious George',
+        'ia_archiver'          => 'Alexa Crawler',
+        'MJ12bot'              => 'Majestic-12',
+        'Uptimebot'            => 'Uptimebot',
+        'duckduckbot'          => 'DuckDuckBot',
+        'sogou'                => 'Sogou Spider',
+        'exabot'               => 'Exabot',
+        'bot'                  => 'Generic Bot',
+        'crawler'              => 'Generic Crawler',
+        'spider'               => 'Generic Spider',
+    ];
+}

app/Config/Validation.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+use CodeIgniter\Validation\StrictRules\CreditCardRules;
+use CodeIgniter\Validation\StrictRules\FileRules;
+use CodeIgniter\Validation\StrictRules\FormatRules;
+use CodeIgniter\Validation\StrictRules\Rules;
+
+class Validation extends BaseConfig
+{
+    // --------------------------------------------------------------------
+    // Setup
+    // --------------------------------------------------------------------
+
+    /**
+     * Stores the classes that contain the
+     * rules that are available.
+     *
+     * @var list<string>
+     */
+    public array $ruleSets = [
+        Rules::class,
+        FormatRules::class,
+        FileRules::class,
+        CreditCardRules::class,
+    ];
+
+    /**
+     * Specifies the views that are used to display the
+     * errors.
+     *
+     * @var array<string, string>
+     */
+    public array $templates = [
+        'list'   => 'CodeIgniter\Validation\Views\list',
+        'single' => 'CodeIgniter\Validation\Views\single',
+    ];
+
+    // --------------------------------------------------------------------
+    // Rules
+    // --------------------------------------------------------------------
+}

app/Config/View.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\View as BaseView;
+use CodeIgniter\View\ViewDecoratorInterface;
+
+class View extends BaseView
+{
+    /**
+     * When false, the view method will clear the data between each
+     * call. This keeps your data safe and ensures there is no accidental
+     * leaking between calls, so you would need to explicitly pass the data
+     * to each view. You might prefer to have the data stick around between
+     * calls so that it is available to all views. If that is the case,
+     * set $saveData to true.
+     *
+     * @var bool
+     */
+    public $saveData = true;
+
+    /**
+     * Parser Filters map a filter name with any PHP callable. When the
+     * Parser prepares a variable for display, it will chain it
+     * through the filters in the order defined, inserting any parameters.
+     * To prevent potential abuse, all filters MUST be defined here
+     * in order for them to be available for use within the Parser.
+     *
+     * Examples:
+     *  { title|esc(js) }
+     *  { created_on|date(Y-m-d)|esc(attr) }
+     *
+     * @var array<string, (callable(mixed): mixed)&string>
+     */
+    public $filters = [];
+
+    /**
+     * Parser Plugins provide a way to extend the functionality provided
+     * by the core Parser by creating aliases that will be replaced with
+     * any callable. Can be single or tag pair.
+     *
+     * @var array<string, (callable(mixed...): mixed)|((callable(mixed...): mixed)&string)|list<(callable(mixed...): mixed)&string>>
+     */
+    public $plugins = [];
+
+    /**
+     * View Decorators are class methods that will be run in sequence to
+     * have a chance to alter the generated output just prior to caching
+     * the results.
+     *
+     * All classes must implement CodeIgniter\View\ViewDecoratorInterface
+     *
+     * @var list<class-string<ViewDecoratorInterface>>
+     */
+    public array $decorators = [];
+
+    /**
+     * Subdirectory within app/Views for namespaced view overrides.
+     *
+     * Namespaced views will be searched in:
+     *
+     *   app/Views/{$appOverridesFolder}/{Namespace}/{view_path}.{php|html...}
+     *
+     * This allows application-level overrides for package or module views
+     * without modifying vendor source files.
+     *
+     * Examples:
+     *   'overrides' -> app/Views/overrides/Example/Blog/post/card.php
+     *   'vendor'    -> app/Views/vendor/Example/Blog/post/card.php
+     *   ''          -> app/Views/Example/Blog/post/card.php (direct mapping)
+     */
+    public string $appOverridesFolder = 'overrides';
+}

app/Config/WorkerMode.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace Config;
+
+/**
+ * This configuration controls how CodeIgniter behaves when running
+ * in worker mode (with FrankenPHP).
+ */
+class WorkerMode
+{
+    /**
+     * Persistent Services
+     *
+     * List of service names that should persist across requests.
+     * These services will NOT be reset between requests.
+     *
+     * Services not in this list will be reset for each request to prevent
+     * state leakage.
+     *
+     * Recommended persistent services:
+     * - `autoloader`: PSR-4 autoloading configuration
+     * - `locator`: File locator
+     * - `exceptions`: Exception handler
+     * - `commands`: CLI commands registry
+     * - `codeigniter`: Main application instance
+     * - `superglobals`: Superglobals wrapper
+     * - `routes`: Router configuration
+     * - `cache`: Cache instance
+     *
+     * @var list<string>
+     */
+    public array $persistentServices = [
+        'autoloader',
+        'locator',
+        'exceptions',
+        'commands',
+        'codeigniter',
+        'superglobals',
+        'routes',
+        'cache',
+    ];
+
+    /**
+     * Reset Event Listeners
+     *
+     * List of event names whose listeners should be removed between requests.
+     * Use this if you register event listeners inside other event callbacks
+     * (rather than at the top level of Config/Events.php), which would cause
+     * them to accumulate across requests in worker mode.
+     *
+     * @var list<string>
+     */
+    public array $resetEventListeners = [];
+
+    /**
+     * Force Garbage Collection
+     *
+     * Whether to force garbage collection after each request.
+     * Helps prevent memory leaks at a small performance cost.
+     */
+    public bool $forceGarbageCollection = true;
+}

app/Controllers/Auth.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Controllers;
+
+/**
+ * Logowanie jednego uzytkownika wprost z .env (user_email + user_password).
+ * ponytail: jawne haslo z .env, narzedzie jednoosobowe. Podniesc do password_hash,
+ * jesli kiedys pojawi sie wielu uzytkownikow / tabela users.
+ */
+class Auth extends BaseController
+{
+    public function login()
+    {
+        if (session()->get('logged_in')) {
+            return redirect()->to('/dashboard');
+        }
+
+        if (strtolower($this->request->getMethod()) === 'post') {
+            $email = trim((string) $this->request->getPost('email'));
+            $pass  = (string) $this->request->getPost('password');
+
+            $okEmail = (string) env('user_email');
+            $okPass  = (string) env('user_password');
+
+            if ($okEmail !== '' && hash_equals($okEmail, $email) && hash_equals($okPass, $pass)) {
+                session()->set([
+                    'logged_in'  => true,
+                    'user_email' => $email,
+                ]);
+
+                return redirect()->to('/dashboard');
+            }
+
+            return redirect()->back()->with('error', 'Nieprawidłowy email lub hasło.');
+        }
+
+        return view('auth/login');
+    }
+
+    public function logout()
+    {
+        session()->destroy();
+
+        return redirect()->to('/login');
+    }
+}

app/Controllers/BaseController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Controllers;
+
+use CodeIgniter\Controller;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+use Psr\Log\LoggerInterface;
+
+/**
+ * BaseController provides a convenient place for loading components
+ * and performing functions that are needed by all your controllers.
+ *
+ * Extend this class in any new controllers:
+ * ```
+ *     class Home extends BaseController
+ * ```
+ *
+ * For security, be sure to declare any new methods as protected or private.
+ */
+abstract class BaseController extends Controller
+{
+    /**
+     * Be sure to declare properties for any property fetch you initialized.
+     * The creation of dynamic property is deprecated in PHP 8.2.
+     */
+
+    // protected $session;
+
+    /**
+     * @return void
+     */
+    public function initController(RequestInterface $request, ResponseInterface $response, LoggerInterface $logger)
+    {
+        // Load here all helpers you want to be available in your controllers that extend BaseController.
+        // Caution: Do not put the this below the parent::initController() call below.
+        $this->helpers = ['form', 'url'];
+
+        // Caution: Do not edit this line.
+        parent::initController($request, $response, $logger);
+
+        // Preload any models, libraries, etc, here.
+        // $this->session = service('session');
+    }
+}

app/Controllers/Categories.php

@@ -0,0 +1,94 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\CategoryModel;
+
+class Categories extends BaseController
+{
+    private function model(): CategoryModel
+    {
+        return model(CategoryModel::class);
+    }
+
+    public function index()
+    {
+        return view('categories/index', [
+            'title'      => 'Kategorie',
+            'categories' => $this->model()->tree(),
+        ]);
+    }
+
+    public function new()
+    {
+        return view('categories/form', [
+            'title'   => 'Nowa kategoria',
+            'cat'     => null,
+            'parents' => $this->model()->tree(),
+        ]);
+    }
+
+    public function create()
+    {
+        return $this->persist(null);
+    }
+
+    public function edit($id)
+    {
+        $cat = $this->model()->find((int) $id);
+        if (! $cat) {
+            return redirect()->to('/categories')->with('error', 'Nie znaleziono kategorii.');
+        }
+
+        return view('categories/form', [
+            'title'   => 'Edycja kategorii',
+            'cat'     => $cat,
+            'parents' => $this->model()->tree(),
+        ]);
+    }
+
+    public function update($id)
+    {
+        return $this->persist((int) $id);
+    }
+
+    public function delete($id)
+    {
+        $id = (int) $id;
+        if ($this->model()->usedByOperations($id)) {
+            return redirect()->to('/categories')
+                ->with('error', 'Nie można usunąć kategorii używanej przez operacje. Najpierw przenieś lub usuń te operacje.');
+        }
+        $this->model()->delete($id);
+
+        return redirect()->to('/categories')->with('success', 'Kategoria usunięta.');
+    }
+
+    private function persist(?int $id)
+    {
+        $data = [
+            'name'      => trim((string) $this->request->getPost('name')),
+            'type'      => (string) $this->request->getPost('type'),
+            'parent_id' => $this->request->getPost('parent_id') ?: null,
+        ];
+
+        // Kategoria nie moze byc wlasnym rodzicem
+        if ($id !== null && (int) $data['parent_id'] === $id) {
+            $data['parent_id'] = null;
+        }
+
+        $model = $this->model();
+        if ($id !== null) {
+            $ok = $model->update($id, $data);
+        } else {
+            $ok = $model->insert($data);
+        }
+
+        if ($ok === false) {
+            return redirect()->back()->withInput()
+                ->with('error', implode(' ', $model->errors()));
+        }
+
+        return redirect()->to('/categories')->with('success', 'Zapisano kategorię.');
+    }
+}

app/Controllers/Dashboard.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\InstrumentModel;
+use App\Models\OperationModel;
+
+class Dashboard extends BaseController
+{
+    /**
+     * Pulpit globalny — przegląd całości: finanse bieżące (rok) + inwestycje + majątek razem.
+     */
+    public function index()
+    {
+        $from = date('Y-01-01');
+        $to   = date('Y-12-31');
+
+        $fin = model(OperationModel::class)->totals(['from' => $from, 'to' => $to]);
+
+        // Agregat inwestycji spójny ze źródłem prawdy w InstrumentModel::withStats.
+        $net = 0.0;
+        $val = 0.0;
+        foreach (model(InstrumentModel::class)->withStats() as $i) {
+            $net += (float) $i['net_invested'];
+            $val += (float) $i['value'];
+        }
+        $inv = [
+            'net_invested' => round($net, 2),
+            'value'        => round($val, 2),
+            'profit'       => round($val - $net, 2),
+        ];
+
+        return view('dashboard/index', [
+            'title'     => 'Pulpit',
+            'from'      => $from,
+            'to'        => $to,
+            'fin'       => $fin,
+            'inv'       => $inv,
+            'net_worth' => round($fin['balance'] + $val, 2),
+        ]);
+    }
+
+    /**
+     * Pulpit finansów bieżących — wykresy przychody/wydatki/saldo.
+     */
+    public function finances()
+    {
+        $from = $this->request->getGet('from') ?: date('Y-01-01');
+        $to   = $this->request->getGet('to') ?: date('Y-12-31');
+
+        $model = model(OperationModel::class);
+
+        return view('dashboard/finances', [
+            'title'   => 'Pulpit finansów',
+            'from'    => $from,
+            'to'      => $to,
+            'totals'  => $model->totals(['from' => $from, 'to' => $to]),
+            'monthly' => $model->monthlyBalance($from, $to),
+            'byCat'   => $model->byCategory($from, $to, 'expense'),
+            'running' => $model->runningBalance($from, $to),
+        ]);
+    }
+}

app/Controllers/Home.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Controllers;
+
+class Home extends BaseController
+{
+    public function index(): string
+    {
+        return view('welcome_message');
+    }
+}

app/Controllers/Instruments.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\InstrumentModel;
+
+class Instruments extends BaseController
+{
+    private function model(): InstrumentModel
+    {
+        return model(InstrumentModel::class);
+    }
+
+    public function index()
+    {
+        return view('instruments/index', [
+            'title'       => 'Instrumenty',
+            'instruments' => $this->model()->withStats(),
+        ]);
+    }
+
+    public function new()
+    {
+        return view('instruments/form', [
+            'title'      => 'Nowy instrument',
+            'instrument' => null,
+        ]);
+    }
+
+    public function create()
+    {
+        return $this->persist(null);
+    }
+
+    public function edit($id)
+    {
+        $instrument = $this->model()->find((int) $id);
+        if (! $instrument) {
+            return redirect()->to('/instruments')->with('error', 'Nie znaleziono instrumentu.');
+        }
+
+        return view('instruments/form', [
+            'title'      => 'Edycja instrumentu',
+            'instrument' => $instrument,
+        ]);
+    }
+
+    public function update($id)
+    {
+        return $this->persist((int) $id);
+    }
+
+    public function delete($id)
+    {
+        $id = (int) $id;
+        if ($this->model()->hasChildren($id)) {
+            return redirect()->to('/instruments')
+                ->with('error', 'Nie można usunąć instrumentu z operacjami lub wycenami. Najpierw usuń powiązane wpisy.');
+        }
+        $this->model()->delete($id);
+
+        return redirect()->to('/instruments')->with('success', 'Instrument usunięty.');
+    }
+
+    private function persist(?int $id)
+    {
+        $data = ['name' => trim((string) $this->request->getPost('name'))];
+
+        $model = $this->model();
+        $ok    = $id !== null ? $model->update($id, $data) : $model->insert($data);
+
+        if ($ok === false) {
+            return redirect()->back()->withInput()
+                ->with('error', implode(' ', $model->errors()));
+        }
+
+        return redirect()->to('/instruments')->with('success', 'Zapisano instrument.');
+    }
+}

app/Controllers/InvOperations.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\InstrumentModel;
+use App\Models\InvOperationModel;
+
+class InvOperations extends BaseController
+{
+    private function model(): InvOperationModel
+    {
+        return model(InvOperationModel::class);
+    }
+
+    private function instruments(): array
+    {
+        return model(InstrumentModel::class)->orderBy('name', 'ASC')->findAll();
+    }
+
+    public function index()
+    {
+        $f = [
+            'from'          => $this->request->getGet('from'),
+            'to'            => $this->request->getGet('to'),
+            'instrument_id' => $this->request->getGet('instrument_id'),
+            'type'          => $this->request->getGet('type'),
+        ];
+
+        return view('inv_operations/index', [
+            'title'       => 'Operacje inwestycyjne',
+            'operations'  => $this->model()->filtered($f),
+            'instruments' => $this->instruments(),
+            'filter'      => $f,
+        ]);
+    }
+
+    public function new()
+    {
+        return view('inv_operations/form', [
+            'title'       => 'Nowa operacja inwestycyjna',
+            'op'          => null,
+            'instruments' => $this->instruments(),
+        ]);
+    }
+
+    public function create()
+    {
+        return $this->persist(null);
+    }
+
+    public function edit($id)
+    {
+        $op = $this->model()->find((int) $id);
+        if (! $op) {
+            return redirect()->to('/investments/operations')->with('error', 'Nie znaleziono operacji.');
+        }
+
+        return view('inv_operations/form', [
+            'title'       => 'Edycja operacji inwestycyjnej',
+            'op'          => $op,
+            'instruments' => $this->instruments(),
+        ]);
+    }
+
+    public function update($id)
+    {
+        return $this->persist((int) $id);
+    }
+
+    public function delete($id)
+    {
+        $this->model()->delete((int) $id);
+
+        return redirect()->to('/investments/operations')->with('success', 'Operacja usunięta.');
+    }
+
+    private function persist(?int $id)
+    {
+        $type = (string) $this->request->getPost('type');
+        $data = [
+            'instrument_id' => (int) $this->request->getPost('instrument_id') ?: null,
+            'date'          => (string) $this->request->getPost('date'),
+            'amount'        => (string) $this->request->getPost('amount'),
+            'type'          => in_array($type, ['deposit', 'withdraw'], true) ? $type : 'deposit',
+            'description'   => trim((string) $this->request->getPost('description')) ?: null,
+        ];
+
+        $model = $this->model();
+        $ok    = $id !== null ? $model->update($id, $data) : $model->insert($data);
+
+        if ($ok === false) {
+            return redirect()->back()->withInput()
+                ->with('error', implode(' ', $model->errors()));
+        }
+
+        return redirect()->to('/investments/operations')->with('success', 'Zapisano operację.');
+    }
+}

app/Controllers/Investments.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\InstrumentModel;
+
+class Investments extends BaseController
+{
+    public function index()
+    {
+        $model       = model(InstrumentModel::class);
+        $instruments = $model->withStats();
+
+        // Kafelki portfela = suma po instrumentach (spojne ze zrodlem prawdy w withStats).
+        $netInvested = 0.0;
+        $value       = 0.0;
+        foreach ($instruments as $i) {
+            $netInvested += (float) $i['net_invested'];
+            $value       += (float) $i['value'];
+        }
+
+        return view('investments/index', [
+            'title'        => 'Pulpit inwestycji',
+            'instruments'  => $instruments,
+            'net_invested' => round($netInvested, 2),
+            'value'        => round($value, 2),
+            'profit'       => round($value - $netInvested, 2),
+            'timeline'     => $model->portfolioTimeline(),
+        ]);
+    }
+}

app/Controllers/Operations.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\CategoryModel;
+use App\Models\OperationModel;
+
+class Operations extends BaseController
+{
+    private function model(): OperationModel
+    {
+        return model(OperationModel::class);
+    }
+
+    public function index()
+    {
+        $f = [
+            'from'        => $this->request->getGet('from'),
+            'to'          => $this->request->getGet('to'),
+            'category_id' => $this->request->getGet('category_id'),
+            'type'        => $this->request->getGet('type'),
+        ];
+
+        return view('operations/index', [
+            'title'      => 'Operacje',
+            'operations' => $this->model()->filtered($f),
+            'totals'     => $this->model()->totals($f),
+            'categories' => model(CategoryModel::class)->tree(),
+            'filter'     => $f,
+        ]);
+    }
+
+    public function new()
+    {
+        return view('operations/form', [
+            'title'      => 'Nowa operacja',
+            'op'         => null,
+            'categories' => model(CategoryModel::class)->tree(),
+        ]);
+    }
+
+    public function create()
+    {
+        return $this->persist(null);
+    }
+
+    public function edit($id)
+    {
+        $op = $this->model()->find((int) $id);
+        if (! $op) {
+            return redirect()->to('/operations')->with('error', 'Nie znaleziono operacji.');
+        }
+
+        return view('operations/form', [
+            'title'      => 'Edycja operacji',
+            'op'         => $op,
+            'categories' => model(CategoryModel::class)->tree(),
+        ]);
+    }
+
+    public function update($id)
+    {
+        return $this->persist((int) $id);
+    }
+
+    public function delete($id)
+    {
+        $this->model()->delete((int) $id);
+
+        return redirect()->to('/operations')->with('success', 'Operacja usunięta.');
+    }
+
+    private function persist(?int $id)
+    {
+        $categoryId = $this->request->getPost('category_id') ?: null;
+        $type       = (string) $this->request->getPost('type');
+
+        // Zrodlo prawdy dla typu: wybrana kategoria narzuca typ operacji.
+        if ($categoryId !== null) {
+            $cat = model(CategoryModel::class)->find((int) $categoryId);
+            if ($cat) {
+                $type = $cat['type'];
+            }
+        }
+
+        $data = [
+            'date'        => (string) $this->request->getPost('date'),
+            'amount'      => (string) $this->request->getPost('amount'),
+            'type'        => $type,
+            'category_id' => $categoryId,
+            'description' => trim((string) $this->request->getPost('description')) ?: null,
+        ];
+
+        $model = $this->model();
+        $ok    = $id !== null ? $model->update($id, $data) : $model->insert($data);
+
+        if ($ok === false) {
+            return redirect()->back()->withInput()
+                ->with('error', implode(' ', $model->errors()));
+        }
+
+        return redirect()->to('/operations')->with('success', 'Zapisano operację.');
+    }
+}

app/Controllers/Valuations.php

@@ -0,0 +1,90 @@
+<?php
+
+namespace App\Controllers;
+
+use App\Models\InstrumentModel;
+use App\Models\ValuationModel;
+
+class Valuations extends BaseController
+{
+    private function model(): ValuationModel
+    {
+        return model(ValuationModel::class);
+    }
+
+    private function instruments(): array
+    {
+        return model(InstrumentModel::class)->orderBy('name', 'ASC')->findAll();
+    }
+
+    public function index()
+    {
+        $f = ['instrument_id' => $this->request->getGet('instrument_id')];
+
+        return view('valuations/index', [
+            'title'       => 'Wyceny',
+            'valuations'  => $this->model()->filtered($f),
+            'instruments' => $this->instruments(),
+            'filter'      => $f,
+        ]);
+    }
+
+    public function new()
+    {
+        return view('valuations/form', [
+            'title'       => 'Nowa wycena',
+            'val'         => null,
+            'instruments' => $this->instruments(),
+        ]);
+    }
+
+    public function create()
+    {
+        return $this->persist(null);
+    }
+
+    public function edit($id)
+    {
+        $val = $this->model()->find((int) $id);
+        if (! $val) {
+            return redirect()->to('/investments/valuations')->with('error', 'Nie znaleziono wyceny.');
+        }
+
+        return view('valuations/form', [
+            'title'       => 'Edycja wyceny',
+            'val'         => $val,
+            'instruments' => $this->instruments(),
+        ]);
+    }
+
+    public function update($id)
+    {
+        return $this->persist((int) $id);
+    }
+
+    public function delete($id)
+    {
+        $this->model()->delete((int) $id);
+
+        return redirect()->to('/investments/valuations')->with('success', 'Wycena usunięta.');
+    }
+
+    private function persist(?int $id)
+    {
+        $data = [
+            'instrument_id' => (int) $this->request->getPost('instrument_id') ?: null,
+            'date'          => (string) $this->request->getPost('date'),
+            'value'         => (string) $this->request->getPost('value'),
+        ];
+
+        $model = $this->model();
+        $ok    = $id !== null ? $model->update($id, $data) : $model->insert($data);
+
+        if ($ok === false) {
+            return redirect()->back()->withInput()
+                ->with('error', implode(' ', $model->errors()));
+        }
+
+        return redirect()->to('/investments/valuations')->with('success', 'Zapisano wycenę.');
+    }
+}

app/Database/Migrations/2026-07-06-100001_CreateCategories.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Database\Migrations;
+
+use CodeIgniter\Database\Migration;
+
+class CreateCategories extends Migration
+{
+    public function up(): void
+    {
+        $this->forge->addField([
+            'id'         => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'auto_increment' => true],
+            'name'       => ['type' => 'VARCHAR', 'constraint' => 100],
+            'type'       => ['type' => 'ENUM', 'constraint' => ['income', 'expense']],
+            'parent_id'  => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'null' => true],
+            'created_at' => ['type' => 'DATETIME', 'null' => true],
+            'updated_at' => ['type' => 'DATETIME', 'null' => true],
+        ]);
+        $this->forge->addKey('id', true);
+        $this->forge->addKey('parent_id');
+        $this->forge->addKey('type');
+        $this->forge->createTable('categories', true, ['ENGINE' => 'InnoDB']);
+
+        // FK self-referencyjny: usuniecie rodzica -> dzieci dostaja parent_id = NULL
+        $this->db->query(
+            'ALTER TABLE `categories` ADD CONSTRAINT `fk_categories_parent` '
+            . 'FOREIGN KEY (`parent_id`) REFERENCES `categories`(`id`) '
+            . 'ON DELETE SET NULL ON UPDATE CASCADE'
+        );
+    }
+
+    public function down(): void
+    {
+        $this->forge->dropTable('categories', true);
+    }
+}

app/Database/Migrations/2026-07-06-100002_CreateOperations.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Database\Migrations;
+
+use CodeIgniter\Database\Migration;
+
+class CreateOperations extends Migration
+{
+    public function up(): void
+    {
+        $this->forge->addField([
+            'id'          => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'auto_increment' => true],
+            'date'        => ['type' => 'DATE'],
+            'amount'      => ['type' => 'DECIMAL', 'constraint' => '12,2'],
+            'type'        => ['type' => 'ENUM', 'constraint' => ['income', 'expense']],
+            'category_id' => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'null' => true],
+            'description' => ['type' => 'VARCHAR', 'constraint' => 255, 'null' => true],
+            'created_at'  => ['type' => 'DATETIME', 'null' => true],
+            'updated_at'  => ['type' => 'DATETIME', 'null' => true],
+        ]);
+        $this->forge->addKey('id', true);
+        $this->forge->addKey('date');
+        $this->forge->addKey('category_id');
+        $this->forge->addKey('type');
+        // Usuniecie kategorii -> operacje dostaja category_id = NULL
+        $this->forge->addForeignKey('category_id', 'categories', 'id', 'CASCADE', 'SET NULL');
+        $this->forge->createTable('operations', true, ['ENGINE' => 'InnoDB']);
+    }
+
+    public function down(): void
+    {
+        $this->forge->dropTable('operations', true);
+    }
+}

app/Database/Migrations/2026-07-06-140001_CreateInvInstruments.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Database\Migrations;
+
+use CodeIgniter\Database\Migration;
+
+class CreateInvInstruments extends Migration
+{
+    public function up(): void
+    {
+        $this->forge->addField([
+            'id'         => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'auto_increment' => true],
+            'name'       => ['type' => 'VARCHAR', 'constraint' => 120],
+            'created_at' => ['type' => 'DATETIME', 'null' => true],
+            'updated_at' => ['type' => 'DATETIME', 'null' => true],
+        ]);
+        $this->forge->addKey('id', true);
+        $this->forge->addUniqueKey('name');
+        $this->forge->createTable('inv_instruments', true, ['ENGINE' => 'InnoDB']);
+    }
+
+    public function down(): void
+    {
+        $this->forge->dropTable('inv_instruments', true);
+    }
+}

app/Database/Migrations/2026-07-06-140002_CreateInvOperations.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Database\Migrations;
+
+use CodeIgniter\Database\Migration;
+
+class CreateInvOperations extends Migration
+{
+    public function up(): void
+    {
+        $this->forge->addField([
+            'id'            => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'auto_increment' => true],
+            'instrument_id' => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true],
+            'date'          => ['type' => 'DATE'],
+            'amount'        => ['type' => 'DECIMAL', 'constraint' => '12,2'],
+            'type'          => ['type' => 'ENUM', 'constraint' => ['deposit', 'withdraw']],
+            'description'   => ['type' => 'VARCHAR', 'constraint' => 255, 'null' => true],
+            'created_at'    => ['type' => 'DATETIME', 'null' => true],
+            'updated_at'    => ['type' => 'DATETIME', 'null' => true],
+        ]);
+        $this->forge->addKey('id', true);
+        $this->forge->addKey('date');
+        $this->forge->addKey('instrument_id');
+        $this->forge->addKey('type');
+        // RESTRICT: nie kasujemy instrumentu, ktory ma operacje (blokada tez w kontrolerze)
+        $this->forge->addForeignKey('instrument_id', 'inv_instruments', 'id', 'RESTRICT', 'RESTRICT');
+        $this->forge->createTable('inv_operations', true, ['ENGINE' => 'InnoDB']);
+    }
+
+    public function down(): void
+    {
+        $this->forge->dropTable('inv_operations', true);
+    }
+}

app/Database/Migrations/2026-07-06-140003_CreateInvValuations.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Database\Migrations;
+
+use CodeIgniter\Database\Migration;
+
+class CreateInvValuations extends Migration
+{
+    public function up(): void
+    {
+        $this->forge->addField([
+            'id'            => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true, 'auto_increment' => true],
+            'instrument_id' => ['type' => 'INT', 'constraint' => 11, 'unsigned' => true],
+            'date'          => ['type' => 'DATE'],
+            'value'         => ['type' => 'DECIMAL', 'constraint' => '12,2'],
+            'created_at'    => ['type' => 'DATETIME', 'null' => true],
+            'updated_at'    => ['type' => 'DATETIME', 'null' => true],
+        ]);
+        $this->forge->addKey('id', true);
+        $this->forge->addKey('date');
+        $this->forge->addKey('instrument_id');
+        // RESTRICT: nie kasujemy instrumentu, ktory ma wyceny (blokada tez w kontrolerze)
+        $this->forge->addForeignKey('instrument_id', 'inv_instruments', 'id', 'RESTRICT', 'RESTRICT');
+        $this->forge->createTable('inv_valuations', true, ['ENGINE' => 'InnoDB']);
+    }
+
+    public function down(): void
+    {
+        $this->forge->dropTable('inv_valuations', true);
+    }
+}

app/Database/Seeds/DefaultCategoriesSeeder.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Database\Seeds;
+
+use CodeIgniter\Database\Seeder;
+
+class DefaultCategoriesSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $now = date('Y-m-d H:i:s');
+
+        $rows = [
+            // Przychody
+            ['name' => 'Wynagrodzenie',   'type' => 'income',  'parent_id' => null],
+            ['name' => 'Premia',          'type' => 'income',  'parent_id' => null],
+            ['name' => 'Inne przychody',  'type' => 'income',  'parent_id' => null],
+            // Wydatki
+            ['name' => 'Mieszkanie',      'type' => 'expense', 'parent_id' => null],
+            ['name' => 'Jedzenie',        'type' => 'expense', 'parent_id' => null],
+            ['name' => 'Transport',       'type' => 'expense', 'parent_id' => null],
+            ['name' => 'Rozrywka',        'type' => 'expense', 'parent_id' => null],
+            ['name' => 'Zdrowie',         'type' => 'expense', 'parent_id' => null],
+            ['name' => 'Inne wydatki',    'type' => 'expense', 'parent_id' => null],
+        ];
+
+        foreach ($rows as &$r) {
+            $r['created_at'] = $now;
+            $r['updated_at'] = $now;
+        }
+
+        // Nie duplikuj, jesli seeder juz raz przeszedl
+        if ((int) $this->db->table('categories')->countAllResults() === 0) {
+            $this->db->table('categories')->insertBatch($rows);
+        }
+    }
+}

app/Database/Seeds/DefaultInstrumentsSeeder.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Database\Seeds;
+
+use CodeIgniter\Database\Seeder;
+
+class DefaultInstrumentsSeeder extends Seeder
+{
+    public function run(): void
+    {
+        $now   = date('Y-m-d H:i:s');
+        $names = ['Obligacje', 'ETF'];
+
+        foreach ($names as $name) {
+            // Idempotentnie: pomin instrument, ktory juz istnieje
+            $exists = (int) $this->db->table('inv_instruments')->where('name', $name)->countAllResults();
+            if ($exists === 0) {
+                $this->db->table('inv_instruments')->insert([
+                    'name'       => $name,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+            }
+        }
+    }
+}

app/Filters/AuthFilter.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Filters;
+
+use CodeIgniter\Filters\FilterInterface;
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+
+/**
+ * Chroni trasy: brak sesji logged_in -> przekierowanie na /login.
+ */
+class AuthFilter implements FilterInterface
+{
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        if (! session()->get('logged_in')) {
+            return redirect()->to('/login');
+        }
+    }
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        // brak
+    }
+}

app/Language/en/Validation.php

@@ -0,0 +1,4 @@
+<?php
+
+// override core en language system validation or define your own en language validation message
+return [];

app/Models/CategoryModel.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Models;
+
+use CodeIgniter\Model;
+
+class CategoryModel extends Model
+{
+    protected $table            = 'categories';
+    protected $primaryKey       = 'id';
+    protected $returnType       = 'array';
+    protected $useTimestamps    = true;
+    protected $allowedFields    = ['name', 'type', 'parent_id'];
+
+    protected $validationRules = [
+        'name'      => 'required|max_length[100]',
+        'type'      => 'required|in_list[income,expense]',
+        'parent_id' => 'permit_empty|is_natural_no_zero',
+    ];
+
+    /**
+     * Plaska lista kategorii, opcjonalnie filtrowana typem.
+     */
+    public function flatList(?string $type = null): array
+    {
+        $builder = $this->orderBy('type', 'ASC')->orderBy('name', 'ASC');
+        if ($type !== null && $type !== '') {
+            $builder = $builder->where('type', $type);
+        }
+
+        return $builder->findAll();
+    }
+
+    /**
+     * Czy kategoria jest uzywana przez jakies operacje.
+     */
+    public function usedByOperations(int $id): bool
+    {
+        return (bool) model(OperationModel::class)->where('category_id', $id)->countAllResults();
+    }
+
+    /**
+     * Kategorie w porzadku drzewa, posortowane po nazwie na kazdym poziomie.
+     * Kazdy element dostaje 'depth' oraz 'indent_label' (nazwa z wcieciem) do list i selectow.
+     */
+    public function tree(?string $type = null): array
+    {
+        $builder = $this->orderBy('name', 'ASC');
+        if ($type !== null && $type !== '') {
+            $builder->where('type', $type);
+        }
+        $all = $builder->findAll();
+
+        // Grupowanie dzieci wg rodzica (0 = korzen)
+        $childrenByParent = [];
+        foreach ($all as $c) {
+            $childrenByParent[(int) ($c['parent_id'] ?: 0)][] = $c;
+        }
+
+        $indent = "\u{00A0}\u{00A0}\u{00A0}\u{00A0}"; // 4x twarda spacja na poziom
+        $out    = [];
+
+        $walk = static function (int $parentId, int $depth) use (&$walk, &$out, $childrenByParent, $indent): void {
+            foreach ($childrenByParent[$parentId] ?? [] as $c) {
+                $c['depth']        = $depth;
+                $c['indent_label'] = str_repeat($indent, $depth) . $c['name'];
+                $out[]             = $c;
+                $walk((int) $c['id'], $depth + 1);
+            }
+        };
+        $walk(0, 0);
+
+        // Sieroty (np. rodzic odfiltrowany typem) — dopnij na koncu bez wciecia
+        $seen = array_column($out, null, 'id');
+        foreach ($all as $c) {
+            if (! isset($seen[$c['id']])) {
+                $c['depth']        = 0;
+                $c['indent_label'] = $c['name'];
+                $out[]             = $c;
+            }
+        }
+
+        return $out;
+    }
+}

app/Models/InstrumentModel.php

@@ -0,0 +1,158 @@
+<?php
+
+namespace App\Models;
+
+use CodeIgniter\Model;
+
+class InstrumentModel extends Model
+{
+    protected $table         = 'inv_instruments';
+    protected $primaryKey    = 'id';
+    protected $returnType    = 'array';
+    protected $useTimestamps = true;
+    protected $allowedFields = ['name'];
+
+    protected $validationRules = [
+        'name' => 'required|max_length[120]',
+    ];
+
+    /**
+     * Czy instrument ma powiazane operacje lub wyceny (blokada usuniecia).
+     */
+    public function hasChildren(int $id): bool
+    {
+        $ops = (int) $this->db->table('inv_operations')->where('instrument_id', $id)->countAllResults();
+        $val = (int) $this->db->table('inv_valuations')->where('instrument_id', $id)->countAllResults();
+
+        return ($ops + $val) > 0;
+    }
+
+    /**
+     * Ostatnia wycena per instrument: [instrument_id => value].
+     * Ostatnia = najpozniejsza data, przy remisie najwyzsze id.
+     */
+    private function latestValuations(): array
+    {
+        $rows = $this->db->table('inv_valuations')
+            ->select('instrument_id, value')
+            ->orderBy('instrument_id', 'ASC')->orderBy('date', 'ASC')->orderBy('id', 'ASC')
+            ->get()->getResultArray();
+
+        $latest = [];
+        foreach ($rows as $r) {
+            $latest[(int) $r['instrument_id']] = (float) $r['value']; // ostatni wygrywa (posortowane rosnaco)
+        }
+
+        return $latest;
+    }
+
+    /**
+     * Sumy wplat/wyplat per instrument: [instrument_id => ['deposit'=>..,'withdraw'=>..]].
+     */
+    private function operationSums(): array
+    {
+        $rows = $this->db->table('inv_operations')
+            ->select('instrument_id')
+            ->select("SUM(CASE WHEN type='deposit'  THEN amount ELSE 0 END) AS deposit")
+            ->select("SUM(CASE WHEN type='withdraw' THEN amount ELSE 0 END) AS withdraw")
+            ->groupBy('instrument_id')
+            ->get()->getResultArray();
+
+        $sums = [];
+        foreach ($rows as $r) {
+            $sums[(int) $r['instrument_id']] = [
+                'deposit'  => (float) $r['deposit'],
+                'withdraw' => (float) $r['withdraw'],
+            ];
+        }
+
+        return $sums;
+    }
+
+    /**
+     * Instrumenty ze statystykami:
+     * wplacone_netto = Sumwplat - Sumwyplat; wartosc = ostatnia wycena;
+     * zarobek = wartosc - wplacone_netto; procent = zarobek / wplacone_netto * 100 (gdy netto > 0).
+     */
+    public function withStats(): array
+    {
+        $instruments = $this->orderBy('name', 'ASC')->findAll();
+        $latest      = $this->latestValuations();
+        $sums        = $this->operationSums();
+
+        foreach ($instruments as &$ins) {
+            $id       = (int) $ins['id'];
+            $deposit  = $sums[$id]['deposit']  ?? 0.0;
+            $withdraw = $sums[$id]['withdraw'] ?? 0.0;
+            $net      = $deposit - $withdraw;
+            $value    = $latest[$id] ?? 0.0;
+            $profit   = $value - $net;
+
+            $ins['deposit']      = round($deposit, 2);
+            $ins['withdraw']     = round($withdraw, 2);
+            $ins['net_invested'] = round($net, 2);
+            $ins['value']        = round($value, 2);
+            $ins['has_value']    = array_key_exists($id, $latest);
+            $ins['profit']       = round($profit, 2);
+            $ins['percent']      = $net > 0 ? round($profit / $net * 100, 2) : null;
+        }
+
+        return $instruments;
+    }
+
+    /**
+     * Szereg czasowy calego portfela do wykresu.
+     * Dla kazdej daty wyceny: wartosc = suma ostatnich wycen (data <= d) po instrumentach;
+     * wplacone_netto = Sum(deposit - withdraw) o dacie <= d; zarobek = wartosc - wplacone_netto.
+     * Zwraca [ ['date'=>.., 'net'=>.., 'value'=>.., 'profit'=>..], ... ].
+     */
+    public function portfolioTimeline(): array
+    {
+        $dates = $this->db->table('inv_valuations')
+            ->select('date')->distinct()->orderBy('date', 'ASC')
+            ->get()->getResultArray();
+        if (empty($dates)) {
+            return [];
+        }
+
+        $valuations = $this->db->table('inv_valuations')
+            ->select('instrument_id, date, value')
+            ->orderBy('date', 'ASC')->orderBy('id', 'ASC')
+            ->get()->getResultArray();
+
+        $operations = $this->db->table('inv_operations')
+            ->select('date, amount, type')
+            ->get()->getResultArray();
+
+        $out = [];
+        foreach ($dates as $d) {
+            $day = $d['date'];
+
+            // Ostatnia wycena per instrument o dacie <= day
+            $latest = [];
+            foreach ($valuations as $v) {
+                if ($v['date'] <= $day) {
+                    $latest[(int) $v['instrument_id']] = (float) $v['value'];
+                }
+            }
+            $value = array_sum($latest);
+
+            // Wplacone netto o dacie <= day
+            $net = 0.0;
+            foreach ($operations as $o) {
+                if ($o['date'] <= $day) {
+                    $net += $o['type'] === 'deposit' ? (float) $o['amount'] : -(float) $o['amount'];
+                }
+            }
+
+            $out[] = [
+                'date'   => $day,
+                'net'    => round($net, 2),
+                'value'  => round($value, 2),
+                'profit' => round($value - $net, 2),
+            ];
+        }
+
+        return $out;
+    }
+}

app/Models/InvOperationModel.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Models;
+
+use CodeIgniter\Model;
+
+class InvOperationModel extends Model
+{
+    protected $table         = 'inv_operations';
+    protected $primaryKey    = 'id';
+    protected $returnType    = 'array';
+    protected $useTimestamps = true;
+    protected $allowedFields = ['instrument_id', 'date', 'amount', 'type', 'description'];
+
+    protected $validationRules = [
+        'instrument_id' => 'required|is_natural_no_zero',
+        'date'          => 'required|valid_date[Y-m-d]',
+        'amount'        => 'required|decimal|greater_than[0]',
+        'type'          => 'required|in_list[deposit,withdraw]',
+        'description'   => 'permit_empty|max_length[255]',
+    ];
+
+    /**
+     * Lista operacji inwestycyjnych z nazwa instrumentu, z filtrami.
+     * $f: from, to, instrument_id, type (wszystkie opcjonalne).
+     */
+    public function filtered(array $f): array
+    {
+        $b = $this->db->table('inv_operations o')
+            ->select('o.*, i.name AS instrument_name')
+            ->join('inv_instruments i', 'i.id = o.instrument_id', 'left');
+
+        if (! empty($f['from'])) {
+            $b->where('o.date >=', $f['from']);
+        }
+        if (! empty($f['to'])) {
+            $b->where('o.date <=', $f['to']);
+        }
+        if (! empty($f['instrument_id'])) {
+            $b->where('o.instrument_id', (int) $f['instrument_id']);
+        }
+        if (! empty($f['type'])) {
+            $b->where('o.type', $f['type']);
+        }
+
+        return $b->orderBy('o.date', 'DESC')->orderBy('o.id', 'DESC')->get()->getResultArray();
+    }
+}

app/Models/OperationModel.php

@@ -0,0 +1,147 @@
+<?php
+
+namespace App\Models;
+
+use CodeIgniter\Model;
+
+class OperationModel extends Model
+{
+    protected $table         = 'operations';
+    protected $primaryKey    = 'id';
+    protected $returnType    = 'array';
+    protected $useTimestamps = true;
+    protected $allowedFields = ['date', 'amount', 'type', 'category_id', 'description'];
+
+    protected $validationRules = [
+        'date'        => 'required|valid_date[Y-m-d]',
+        'amount'      => 'required|decimal|greater_than[0]',
+        'type'        => 'required|in_list[income,expense]',
+        'category_id' => 'permit_empty|is_natural_no_zero',
+        'description' => 'permit_empty|max_length[255]',
+    ];
+
+    /**
+     * Lista operacji z nazwa kategorii, z filtrami.
+     * $f: from, to, category_id, type (wszystkie opcjonalne).
+     */
+    public function filtered(array $f): array
+    {
+        $b = $this->db->table('operations o')
+            ->select('o.*, c.name AS category_name, p.name AS parent_name')
+            ->join('categories c', 'c.id = o.category_id', 'left')
+            ->join('categories p', 'p.id = c.parent_id', 'left');
+
+        if (! empty($f['from'])) {
+            $b->where('o.date >=', $f['from']);
+        }
+        if (! empty($f['to'])) {
+            $b->where('o.date <=', $f['to']);
+        }
+        if (! empty($f['category_id'])) {
+            $b->where('o.category_id', (int) $f['category_id']);
+        }
+        if (! empty($f['type'])) {
+            $b->where('o.type', $f['type']);
+        }
+
+        return $b->orderBy('o.date', 'DESC')->orderBy('o.id', 'DESC')->get()->getResultArray();
+    }
+
+    /**
+     * Sumy przychodow/wydatkow/salda dla zakresu (i opcjonalnych filtrow).
+     */
+    public function totals(array $f): array
+    {
+        $b = $this->db->table('operations o')
+            ->select("SUM(CASE WHEN o.type='income' THEN o.amount ELSE 0 END) AS income")
+            ->select("SUM(CASE WHEN o.type='expense' THEN o.amount ELSE 0 END) AS expense");
+
+        if (! empty($f['from'])) {
+            $b->where('o.date >=', $f['from']);
+        }
+        if (! empty($f['to'])) {
+            $b->where('o.date <=', $f['to']);
+        }
+        if (! empty($f['category_id'])) {
+            $b->where('o.category_id', (int) $f['category_id']);
+        }
+        if (! empty($f['type'])) {
+            $b->where('o.type', $f['type']);
+        }
+
+        $row     = $b->get()->getRowArray() ?: [];
+        $income  = (float) ($row['income'] ?? 0);
+        $expense = (float) ($row['expense'] ?? 0);
+
+        return [
+            'income'  => $income,
+            'expense' => $expense,
+            'balance' => $income - $expense,
+        ];
+    }
+
+    /**
+     * Bilans miesieczny: [ ['ym'=>'2026-07','income'=>..,'expense'=>..], ... ].
+     */
+    public function monthlyBalance(string $from, string $to): array
+    {
+        return $this->db->table('operations')
+            ->select("DATE_FORMAT(date, '%Y-%m') AS ym")
+            ->select("SUM(CASE WHEN type='income' THEN amount ELSE 0 END) AS income")
+            ->select("SUM(CASE WHEN type='expense' THEN amount ELSE 0 END) AS expense")
+            ->where('date >=', $from)->where('date <=', $to)
+            ->groupBy('ym')->orderBy('ym', 'ASC')
+            ->get()->getResultArray();
+    }
+
+    /**
+     * Suma wg kategorii dla danego typu: [ ['name'=>..,'total'=>..], ... ].
+     */
+    public function byCategory(string $from, string $to, string $type): array
+    {
+        $rows = $this->db->table('operations o')
+            ->select('o.category_id, c.name AS cat_name, p.name AS parent_name, SUM(o.amount) AS total')
+            ->join('categories c', 'c.id = o.category_id', 'left')
+            ->join('categories p', 'p.id = c.parent_id', 'left')
+            ->where('o.type', $type)
+            ->where('o.date >=', $from)->where('o.date <=', $to)
+            ->groupBy('o.category_id')->groupBy('c.name')->groupBy('p.name')
+            ->orderBy('total', 'DESC')
+            ->get()->getResultArray();
+
+        // Etykieta = pelna sciezka kategoria -> podkategoria
+        foreach ($rows as &$r) {
+            if (empty($r['cat_name'])) {
+                $r['name'] = '(bez kategorii)';
+            } elseif (! empty($r['parent_name'])) {
+                $r['name'] = $r['parent_name'] . ' → ' . $r['cat_name'];
+            } else {
+                $r['name'] = $r['cat_name'];
+            }
+        }
+
+        return $rows;
+    }
+
+    /**
+     * Saldo skumulowane w czasie: [ ['date'=>..,'balance'=>..], ... ].
+     */
+    public function runningBalance(string $from, string $to): array
+    {
+        $rows = $this->db->table('operations')
+            ->select('date')
+            ->select("SUM(CASE WHEN type='income' THEN amount ELSE -amount END) AS net")
+            ->where('date >=', $from)->where('date <=', $to)
+            ->groupBy('date')->orderBy('date', 'ASC')
+            ->get()->getResultArray();
+
+        $balance = 0.0;
+        $out     = [];
+        foreach ($rows as $r) {
+            $balance += (float) $r['net'];
+            $out[] = ['date' => $r['date'], 'balance' => round($balance, 2)];
+        }
+
+        return $out;
+    }
+}

app/Models/ValuationModel.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Models;
+
+use CodeIgniter\Model;
+
+class ValuationModel extends Model
+{
+    protected $table         = 'inv_valuations';
+    protected $primaryKey    = 'id';
+    protected $returnType    = 'array';
+    protected $useTimestamps = true;
+    protected $allowedFields = ['instrument_id', 'date', 'value'];
+
+    protected $validationRules = [
+        'instrument_id' => 'required|is_natural_no_zero',
+        'date'          => 'required|valid_date[Y-m-d]',
+        'value'         => 'required|decimal|greater_than_equal_to[0]',
+    ];
+
+    /**
+     * Lista wycen z nazwa instrumentu, z opcjonalnym filtrem instrumentu.
+     * $f: instrument_id, from, to (wszystkie opcjonalne).
+     */
+    public function filtered(array $f): array
+    {
+        $b = $this->db->table('inv_valuations v')
+            ->select('v.*, i.name AS instrument_name')
+            ->join('inv_instruments i', 'i.id = v.instrument_id', 'left');
+
+        if (! empty($f['instrument_id'])) {
+            $b->where('v.instrument_id', (int) $f['instrument_id']);
+        }
+        if (! empty($f['from'])) {
+            $b->where('v.date >=', $f['from']);
+        }
+        if (! empty($f['to'])) {
+            $b->where('v.date <=', $f['to']);
+        }
+
+        return $b->orderBy('v.date', 'DESC')->orderBy('v.id', 'DESC')->get()->getResultArray();
+    }
+}

app/Views/auth/login.php

@@ -0,0 +1,25 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<div class="row justify-content-center mt-5">
+    <div class="col-md-5 col-lg-4">
+        <div class="card shadow-sm">
+            <div class="card-body p-4">
+                <h1 class="h4 mb-4 text-center">finansePRO</h1>
+                <?= form_open('login') ?>
+                    <div class="mb-3">
+                        <label class="form-label">Email</label>
+                        <input type="email" name="email" class="form-control" required autofocus
+                               value="<?= esc(old('email')) ?>">
+                    </div>
+                    <div class="mb-3">
+                        <label class="form-label">Hasło</label>
+                        <input type="password" name="password" class="form-control" required>
+                    </div>
+                    <button type="submit" class="btn btn-primary w-100">Zaloguj</button>
+                <?= form_close() ?>
+            </div>
+        </div>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/categories/form.php

@@ -0,0 +1,41 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<h1 class="h4 mb-3"><?= esc($title) ?></h1>
+
+<div class="card shadow-sm">
+    <div class="card-body">
+        <?php $action = $cat ? site_url('categories/' . $cat['id']) : site_url('categories'); ?>
+        <?= form_open($action) ?>
+            <div class="mb-3">
+                <label class="form-label">Nazwa</label>
+                <input type="text" name="name" class="form-control" required
+                       value="<?= esc(old('name', $cat['name'] ?? '')) ?>">
+            </div>
+            <div class="mb-3">
+                <label class="form-label">Typ</label>
+                <?php $t = old('type', $cat['type'] ?? 'expense'); ?>
+                <select name="type" class="form-select" required>
+                    <option value="income"  <?= $t === 'income'  ? 'selected' : '' ?>>Przychód</option>
+                    <option value="expense" <?= $t === 'expense' ? 'selected' : '' ?>>Wydatek</option>
+                </select>
+            </div>
+            <div class="mb-3">
+                <label class="form-label">Kategoria nadrzędna (opcjonalnie)</label>
+                <?php $p = old('parent_id', $cat['parent_id'] ?? ''); ?>
+                <select name="parent_id" class="form-select">
+                    <option value="">— brak —</option>
+                    <?php foreach ($parents as $pc): ?>
+                        <?php if ($cat && $pc['id'] == $cat['id']) continue; ?>
+                        <option value="<?= $pc['id'] ?>" <?= (string) $p === (string) $pc['id'] ? 'selected' : '' ?>>
+                            <?= esc($pc['indent_label']) ?> (<?= $pc['type'] === 'income' ? 'przychód' : 'wydatek' ?>)
+                        </option>
+                    <?php endforeach; ?>
+                </select>
+            </div>
+            <button type="submit" class="btn btn-primary">Zapisz</button>
+            <a href="<?= site_url('categories') ?>" class="btn btn-link">Anuluj</a>
+        <?= form_close() ?>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/categories/index.php

@@ -0,0 +1,43 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h1 class="h4 mb-0">Kategorie</h1>
+    <a href="<?= site_url('categories/new') ?>" class="btn btn-primary">+ Nowa kategoria</a>
+</div>
+
+<div class="card shadow-sm">
+    <div class="table-responsive">
+        <table class="table table-hover mb-0 align-middle">
+            <thead class="table-light">
+                <tr>
+                    <th>Nazwa</th>
+                    <th>Typ</th>
+                    <th class="text-end">Akcje</th>
+                </tr>
+            </thead>
+            <tbody>
+            <?php if (empty($categories)): ?>
+                <tr><td colspan="3" class="text-center text-muted py-4">Brak kategorii.</td></tr>
+            <?php else: foreach ($categories as $c): ?>
+                <tr>
+                    <td><?= esc($c['indent_label']) ?></td>
+                    <td>
+                        <?php if ($c['type'] === 'income'): ?>
+                            <span class="badge bg-success">Przychód</span>
+                        <?php else: ?>
+                            <span class="badge bg-danger">Wydatek</span>
+                        <?php endif; ?>
+                    </td>
+                    <td class="text-end">
+                        <a href="<?= site_url('categories/' . $c['id'] . '/edit') ?>" class="btn btn-sm btn-outline-secondary">Edytuj</a>
+                        <a href="<?= site_url('categories/' . $c['id'] . '/delete') ?>" class="btn btn-sm btn-outline-danger"
+                           onclick="return confirm('Usunąć kategorię?')">Usuń</a>
+                    </td>
+                </tr>
+            <?php endforeach; endif; ?>
+            </tbody>
+        </table>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/dashboard/finances.php

@@ -0,0 +1,94 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<div class="d-flex justify-content-between align-items-center mb-3 flex-wrap gap-2">
+    <h1 class="h4 mb-0">Pulpit finansów</h1>
+    <?= form_open('finances', ['method' => 'get', 'class' => 'row g-2 align-items-end']) ?>
+        <div class="col-auto">
+            <label class="form-label small mb-1">Od</label>
+            <input type="date" name="from" class="form-control form-control-sm" value="<?= esc($from) ?>">
+        </div>
+        <div class="col-auto">
+            <label class="form-label small mb-1">Do</label>
+            <input type="date" name="to" class="form-control form-control-sm" value="<?= esc($to) ?>">
+        </div>
+        <div class="col-auto">
+            <button class="btn btn-sm btn-outline-primary">Pokaż</button>
+        </div>
+    <?= form_close() ?>
+</div>
+
+<div class="row g-3 mb-4">
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Przychody</div>
+        <div class="value amount-income"><?= $fmt($totals['income']) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Wydatki</div>
+        <div class="value amount-expense"><?= $fmt($totals['expense']) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Saldo</div>
+        <div class="value <?= $totals['balance'] >= 0 ? 'amount-income' : 'amount-expense' ?>"><?= $fmt($totals['balance']) ?></div>
+    </div></div></div>
+</div>
+
+<div class="row g-3">
+    <div class="col-12"><div class="card shadow-sm"><div class="card-body">
+        <h2 class="h6">Bilans miesięczny</h2>
+        <div id="chartMonthly"></div>
+    </div></div></div>
+    <div class="col-12"><div class="card shadow-sm"><div class="card-body">
+        <h2 class="h6">Wydatki wg kategorii</h2>
+        <div id="chartByCat"></div>
+    </div></div></div>
+    <div class="col-12"><div class="card shadow-sm"><div class="card-body">
+        <h2 class="h6">Saldo skumulowane</h2>
+        <div id="chartRunning"></div>
+    </div></div></div>
+</div>
+<?= $this->endSection() ?>
+
+<?= $this->section('scripts') ?>
+<script>
+const monthly = <?= json_encode($monthly, JSON_UNESCAPED_UNICODE) ?>;
+const byCat   = <?= json_encode($byCat, JSON_UNESCAPED_UNICODE) ?>;
+const running = <?= json_encode($running, JSON_UNESCAPED_UNICODE) ?>;
+
+new ApexCharts(document.querySelector('#chartMonthly'), {
+    chart: { type: 'bar', height: 320 },
+    series: [
+        { name: 'Przychody', data: monthly.map(r => Number(r.income)) },
+        { name: 'Wydatki',   data: monthly.map(r => Number(r.expense)) }
+    ],
+    xaxis: { categories: monthly.map(r => r.ym) },
+    colors: ['#1a7f37', '#c62828'],
+    dataLabels: { enabled: false },
+    noData: { text: 'Brak danych w wybranym zakresie' }
+}).render();
+
+new ApexCharts(document.querySelector('#chartByCat'), {
+    chart: { type: 'bar', height: Math.max(320, byCat.length * 36) },
+    plotOptions: { bar: { horizontal: true, borderRadius: 3, distributed: true } },
+    series: [{ name: 'Wydatki', data: byCat.map(r => Number(r.total)) }],
+    xaxis: { categories: byCat.map(r => r.name) },
+    colors: ['#c62828', '#1565c0', '#2e7d32', '#f9a825', '#6a1b9a', '#00838f',
+             '#ef6c00', '#c2185b', '#5d4037', '#455a64', '#7cb342', '#0277bd'],
+    legend: { show: false },
+    dataLabels: { enabled: false },
+    noData: { text: 'Brak wydatków w zakresie' }
+}).render();
+
+new ApexCharts(document.querySelector('#chartRunning'), {
+    chart: { type: 'area', height: 300 },
+    series: [{ name: 'Saldo', data: running.map(r => Number(r.balance)) }],
+    xaxis: { categories: running.map(r => r.date), type: 'category' },
+    colors: ['#1565c0'],
+    stroke: { curve: 'smooth', width: 2 },
+    dataLabels: { enabled: false },
+    noData: { text: 'Brak danych w wybranym zakresie' }
+}).render();
+</script>
+<?= $this->endSection() ?>

app/Views/dashboard/index.php

@@ -0,0 +1,52 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<h1 class="h4 mb-3">Pulpit</h1>
+
+<div class="card shadow-sm mb-4 border-primary">
+    <div class="card-body text-center">
+        <div class="text-muted small">Majątek razem (saldo bieżące + wartość inwestycji)</div>
+        <div class="value <?= $net_worth >= 0 ? 'amount-income' : 'amount-expense' ?>" style="font-size:2rem;font-weight:700;">
+            <?= $fmt($net_worth) ?>
+        </div>
+    </div>
+</div>
+
+<div class="row g-4">
+    <div class="col-lg-6">
+        <div class="card shadow-sm h-100"><div class="card-body">
+            <div class="d-flex justify-content-between align-items-center mb-3">
+                <h2 class="h6 mb-0">Finanse bieżące <span class="text-muted small">(rok <?= esc(substr($from, 0, 4)) ?>)</span></h2>
+                <a href="<?= site_url('finances') ?>" class="btn btn-sm btn-outline-primary">Szczegóły →</a>
+            </div>
+            <div class="row g-2">
+                <div class="col-4"><div class="text-muted small">Przychody</div>
+                    <div class="fw-semibold amount-income"><?= $fmt($fin['income']) ?></div></div>
+                <div class="col-4"><div class="text-muted small">Wydatki</div>
+                    <div class="fw-semibold amount-expense"><?= $fmt($fin['expense']) ?></div></div>
+                <div class="col-4"><div class="text-muted small">Saldo</div>
+                    <div class="fw-semibold <?= $fin['balance'] >= 0 ? 'amount-income' : 'amount-expense' ?>"><?= $fmt($fin['balance']) ?></div></div>
+            </div>
+        </div></div>
+    </div>
+
+    <div class="col-lg-6">
+        <div class="card shadow-sm h-100"><div class="card-body">
+            <div class="d-flex justify-content-between align-items-center mb-3">
+                <h2 class="h6 mb-0">Inwestycje</h2>
+                <a href="<?= site_url('investments') ?>" class="btn btn-sm btn-outline-primary">Szczegóły →</a>
+            </div>
+            <div class="row g-2">
+                <div class="col-4"><div class="text-muted small">Wpłacono netto</div>
+                    <div class="fw-semibold"><?= $fmt($inv['net_invested']) ?></div></div>
+                <div class="col-4"><div class="text-muted small">Wartość</div>
+                    <div class="fw-semibold"><?= $fmt($inv['value']) ?></div></div>
+                <div class="col-4"><div class="text-muted small">Zarobek</div>
+                    <div class="fw-semibold <?= $inv['profit'] >= 0 ? 'amount-income' : 'amount-expense' ?>"><?= $fmt($inv['profit']) ?></div></div>
+            </div>
+        </div></div>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/errors/cli/error_404.php

@@ -0,0 +1,7 @@
+<?php
+
+use CodeIgniter\CLI\CLI;
+
+CLI::error('ERROR: ' . $code);
+CLI::write($message);
+CLI::newLine();

app/Views/errors/cli/error_exception.php

@@ -0,0 +1,65 @@
+<?php
+
+use CodeIgniter\CLI\CLI;
+
+// The main Exception
+CLI::write('[' . $exception::class . ']', 'light_gray', 'red');
+CLI::write($message);
+CLI::write('at ' . CLI::color(clean_path($exception->getFile()) . ':' . $exception->getLine(), 'green'));
+CLI::newLine();
+
+$last = $exception;
+
+while ($prevException = $last->getPrevious()) {
+    $last = $prevException;
+
+    CLI::write('  Caused by:');
+    CLI::write('  [' . $prevException::class . ']', 'red');
+    CLI::write('  ' . $prevException->getMessage());
+    CLI::write('  at ' . CLI::color(clean_path($prevException->getFile()) . ':' . $prevException->getLine(), 'green'));
+    CLI::newLine();
+}
+
+// The backtrace
+if (defined('SHOW_DEBUG_BACKTRACE') && SHOW_DEBUG_BACKTRACE) {
+    $backtraces = $last->getTrace();
+
+    if ($backtraces) {
+        CLI::write('Backtrace:', 'green');
+    }
+
+    foreach ($backtraces as $i => $error) {
+        $padFile  = '    '; // 4 spaces
+        $padClass = '       '; // 7 spaces
+        $c        = str_pad($i + 1, 3, ' ', STR_PAD_LEFT);
+
+        if (isset($error['file'])) {
+            $filepath = clean_path($error['file']) . ':' . $error['line'];
+
+            CLI::write($c . $padFile . CLI::color($filepath, 'yellow'));
+        } else {
+            CLI::write($c . $padFile . CLI::color('[internal function]', 'yellow'));
+        }
+
+        $function = '';
+
+        if (isset($error['class'])) {
+            $type = ($error['type'] === '->') ? '()' . $error['type'] : $error['type'];
+            $function .= $padClass . $error['class'] . $type . $error['function'];
+        } elseif (! isset($error['class']) && isset($error['function'])) {
+            $function .= $padClass . $error['function'];
+        }
+
+        $args = implode(', ', array_map(static fn ($value): string => match (true) {
+            is_object($value) => 'Object(' . $value::class . ')',
+            is_array($value)  => $value !== [] ? '[...]' : '[]',
+            $value === null   => 'null', // return the lowercased version
+            default           => var_export($value, true),
+        }, array_values($error['args'] ?? [])));
+
+        $function .= '(' . $args . ')';
+
+        CLI::write($function);
+        CLI::newLine();
+    }
+}

app/Views/errors/cli/production.php

@@ -0,0 +1,5 @@
+<?php
+
+// On the CLI, we still want errors in productions
+// so just use the exception template.
+include __DIR__ . '/error_exception.php';

app/Views/errors/html/debug.css

@@ -0,0 +1,194 @@
+:root {
+    --main-bg-color: #fff;
+    --main-text-color: #555;
+    --dark-text-color: #222;
+    --light-text-color: #c7c7c7;
+    --brand-primary-color: #DC4814;
+    --light-bg-color: #ededee;
+    --dark-bg-color: #404040;
+}
+
+body {
+    height: 100%;
+    background: var(--main-bg-color);
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
+    color: var(--main-text-color);
+    font-weight: 300;
+    margin: 0;
+    padding: 0;
+}
+h1 {
+    font-weight: lighter;
+    font-size: 3rem;
+    color: var(--dark-text-color);
+    margin: 0;
+}
+h1.headline {
+    margin-top: 20%;
+    font-size: 5rem;
+}
+.text-center {
+    text-align: center;
+}
+p.lead {
+    font-size: 1.6rem;
+}
+.container {
+    max-width: 75rem;
+    margin: 0 auto;
+    padding: 1rem;
+}
+.header {
+    background: var(--light-bg-color);
+    color: var(--dark-text-color);
+    margin-top: 2.17rem;
+}
+.header .container {
+    padding: 1rem;
+}
+.header h1 {
+    font-size: 2.5rem;
+    font-weight: 500;
+}
+.header p {
+    font-size: 1.2rem;
+    margin: 0;
+    line-height: 2.5;
+}
+.header a {
+    color: var(--brand-primary-color);
+    margin-left: 2rem;
+    display: none;
+    text-decoration: none;
+}
+.header:hover a {
+    display: inline;
+}
+
+.environment {
+    background: var(--brand-primary-color);
+    color: var(--main-bg-color);
+    text-align: center;
+    padding: calc(4px + 0.2083vw);
+    width: 100%;
+    top: 0;
+    position: fixed;
+}
+
+.source {
+    background: #343434;
+    color: var(--light-text-color);
+    padding: 0.5em 1em;
+    border-radius: 5px;
+    font-family: Menlo, Monaco, Consolas, "Courier New", monospace;
+    font-size: 0.85rem;
+    margin: 0;
+    overflow-x: scroll;
+}
+.source span.line {
+    line-height: 1.4;
+}
+.source span.line .number {
+    color: #666;
+}
+.source .line .highlight {
+    display: block;
+    background: var(--dark-text-color);
+    color: var(--light-text-color);
+}
+.source span.highlight .number {
+    color: #fff;
+}
+
+.tabs {
+    list-style: none;
+    list-style-position: inside;
+    margin: 0;
+    padding: 0;
+    margin-bottom: -1px;
+}
+.tabs li {
+    display: inline;
+}
+.tabs a:link,
+.tabs a:visited {
+    padding: 0 1rem;
+    line-height: 2.7;
+    text-decoration: none;
+    color: var(--dark-text-color);
+    background: var(--light-bg-color);
+    border: 1px solid rgba(0,0,0,0.15);
+    border-bottom: 0;
+    border-top-left-radius: 5px;
+    border-top-right-radius: 5px;
+    display: inline-block;
+}
+.tabs a:hover {
+    background: var(--light-bg-color);
+    border-color: rgba(0,0,0,0.15);
+}
+.tabs a.active {
+    background: var(--main-bg-color);
+    color: var(--main-text-color);
+}
+.tab-content {
+    background: var(--main-bg-color);
+    border: 1px solid rgba(0,0,0,0.15);
+}
+.content {
+    padding: 1rem;
+}
+.hide {
+    display: none;
+}
+
+.alert {
+    margin-top: 2rem;
+    display: block;
+    text-align: center;
+    line-height: 3.0;
+    background: #d9edf7;
+    border: 1px solid #bcdff1;
+    border-radius: 5px;
+    color: #31708f;
+}
+
+table {
+    width: 100%;
+    overflow: hidden;
+}
+th {
+    text-align: left;
+    border-bottom: 1px solid #e7e7e7;
+    padding-bottom: 0.5rem;
+}
+td {
+    padding: 0.2rem 0.5rem 0.2rem 0;
+}
+tr:hover td {
+    background: #f1f1f1;
+}
+td pre {
+    white-space: pre-wrap;
+}
+
+.trace a {
+    color: inherit;
+}
+.trace table {
+    width: auto;
+}
+.trace tr td:first-child {
+    min-width: 5em;
+    font-weight: bold;
+}
+.trace td {
+    background: var(--light-bg-color);
+    padding: 0 1rem;
+}
+.trace td pre {
+    margin: 0;
+}
+.args {
+    display: none;
+}

app/Views/errors/html/debug.js

@@ -0,0 +1,116 @@
+var tabLinks    = new Array();
+var contentDivs = new Array();
+
+function init()
+{
+    // Grab the tab links and content divs from the page
+    var tabListItems = document.getElementById('tabs').childNodes;
+    console.log(tabListItems);
+    for (var i = 0; i < tabListItems.length; i ++)
+    {
+        if (tabListItems[i].nodeName == "LI")
+        {
+            var tabLink     = getFirstChildWithTagName(tabListItems[i], 'A');
+            var id          = getHash(tabLink.getAttribute('href'));
+            tabLinks[id]    = tabLink;
+            contentDivs[id] = document.getElementById(id);
+        }
+    }
+
+    // Assign onclick events to the tab links, and
+    // highlight the first tab
+    var i = 0;
+
+    for (var id in tabLinks)
+    {
+        tabLinks[id].onclick = showTab;
+        tabLinks[id].onfocus = function () {
+            this.blur()
+        };
+        if (i == 0)
+        {
+            tabLinks[id].className = 'active';
+        }
+        i ++;
+    }
+
+    // Hide all content divs except the first
+    var i = 0;
+
+    for (var id in contentDivs)
+    {
+        if (i != 0)
+        {
+            console.log(contentDivs[id]);
+            contentDivs[id].className = 'content hide';
+        }
+        i ++;
+    }
+}
+
+function showTab()
+{
+    var selectedId = getHash(this.getAttribute('href'));
+
+    // Highlight the selected tab, and dim all others.
+    // Also show the selected content div, and hide all others.
+    for (var id in contentDivs)
+    {
+        if (id == selectedId)
+        {
+            tabLinks[id].className    = 'active';
+            contentDivs[id].className = 'content';
+        }
+        else
+        {
+            tabLinks[id].className    = '';
+            contentDivs[id].className = 'content hide';
+        }
+    }
+
+    // Stop the browser following the link
+    return false;
+}
+
+function getFirstChildWithTagName(element, tagName)
+{
+    for (var i = 0; i < element.childNodes.length; i ++)
+    {
+        if (element.childNodes[i].nodeName == tagName)
+        {
+            return element.childNodes[i];
+        }
+    }
+}
+
+function getHash(url)
+{
+    var hashPos = url.lastIndexOf('#');
+    return url.substring(hashPos + 1);
+}
+
+function toggle(elem)
+{
+    elem = document.getElementById(elem);
+
+    if (elem.style && elem.style['display'])
+    {
+        // Only works with the "style" attr
+        var disp = elem.style['display'];
+    }
+    else if (elem.currentStyle)
+    {
+        // For MSIE, naturally
+        var disp = elem.currentStyle['display'];
+    }
+    else if (window.getComputedStyle)
+    {
+        // For most other browsers
+        var disp = document.defaultView.getComputedStyle(elem, null).getPropertyValue('display');
+    }
+
+    // Toggle the state of the "display" style
+    elem.style.display = disp == 'block' ? 'none' : 'block';
+
+    return false;
+}

app/Views/errors/html/error_400.php

@@ -0,0 +1,84 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <title><?= lang('Errors.badRequest') ?></title>
+
+    <style>
+        div.logo {
+            height: 200px;
+            width: 155px;
+            display: inline-block;
+            opacity: 0.08;
+            position: absolute;
+            top: 2rem;
+            left: 50%;
+            margin-left: -73px;
+        }
+        body {
+            height: 100%;
+            background: #fafafa;
+            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+            color: #777;
+            font-weight: 300;
+        }
+        h1 {
+            font-weight: lighter;
+            letter-spacing: normal;
+            font-size: 3rem;
+            margin-top: 0;
+            margin-bottom: 0;
+            color: #222;
+        }
+        .wrap {
+            max-width: 1024px;
+            margin: 5rem auto;
+            padding: 2rem;
+            background: #fff;
+            text-align: center;
+            border: 1px solid #efefef;
+            border-radius: 0.5rem;
+            position: relative;
+        }
+        pre {
+            white-space: normal;
+            margin-top: 1.5rem;
+        }
+        code {
+            background: #fafafa;
+            border: 1px solid #efefef;
+            padding: 0.5rem 1rem;
+            border-radius: 5px;
+            display: block;
+        }
+        p {
+            margin-top: 1.5rem;
+        }
+        .footer {
+            margin-top: 2rem;
+            border-top: 1px solid #efefef;
+            padding: 1em 2em 0 2em;
+            font-size: 85%;
+            color: #999;
+        }
+        a:active,
+        a:link,
+        a:visited {
+            color: #dd4814;
+        }
+    </style>
+</head>
+<body>
+<div class="wrap">
+    <h1>400</h1>
+
+    <p>
+        <?php if (ENVIRONMENT !== 'production') : ?>
+            <?= nl2br(esc($message)) ?>
+        <?php else : ?>
+            <?= lang('Errors.sorryBadRequest') ?>
+        <?php endif; ?>
+    </p>
+</div>
+</body>
+</html>

app/Views/errors/html/error_404.php

@@ -0,0 +1,84 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <title><?= lang('Errors.pageNotFound') ?></title>
+
+    <style>
+        div.logo {
+            height: 200px;
+            width: 155px;
+            display: inline-block;
+            opacity: 0.08;
+            position: absolute;
+            top: 2rem;
+            left: 50%;
+            margin-left: -73px;
+        }
+        body {
+            height: 100%;
+            background: #fafafa;
+            font-family: "Helvetica Neue", Helvetica, Arial, sans-serif;
+            color: #777;
+            font-weight: 300;
+        }
+        h1 {
+            font-weight: lighter;
+            letter-spacing: normal;
+            font-size: 3rem;
+            margin-top: 0;
+            margin-bottom: 0;
+            color: #222;
+        }
+        .wrap {
+            max-width: 1024px;
+            margin: 5rem auto;
+            padding: 2rem;
+            background: #fff;
+            text-align: center;
+            border: 1px solid #efefef;
+            border-radius: 0.5rem;
+            position: relative;
+        }
+        pre {
+            white-space: normal;
+            margin-top: 1.5rem;
+        }
+        code {
+            background: #fafafa;
+            border: 1px solid #efefef;
+            padding: 0.5rem 1rem;
+            border-radius: 5px;
+            display: block;
+        }
+        p {
+            margin-top: 1.5rem;
+        }
+        .footer {
+            margin-top: 2rem;
+            border-top: 1px solid #efefef;
+            padding: 1em 2em 0 2em;
+            font-size: 85%;
+            color: #999;
+        }
+        a:active,
+        a:link,
+        a:visited {
+            color: #dd4814;
+        }
+    </style>
+</head>
+<body>
+    <div class="wrap">
+        <h1>404</h1>
+
+        <p>
+            <?php if (ENVIRONMENT !== 'production') : ?>
+                <?= nl2br(esc($message)) ?>
+            <?php else : ?>
+                <?= lang('Errors.sorryCannotFind') ?>
+            <?php endif; ?>
+        </p>
+    </div>
+</body>
+</html>

app/Views/errors/html/error_exception.php

@@ -0,0 +1,429 @@
+<?php
+use CodeIgniter\HTTP\Header;
+use CodeIgniter\CodeIgniter;
+
+$errorId = uniqid('error', true);
+?>
+<!doctype html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="robots" content="noindex">
+
+    <title><?= esc($title) ?></title>
+    <style>
+        <?= preg_replace('#[\r\n\t ]+#', ' ', file_get_contents(__DIR__ . DIRECTORY_SEPARATOR . 'debug.css')) ?>
+    </style>
+
+    <script>
+        <?= file_get_contents(__DIR__ . DIRECTORY_SEPARATOR . 'debug.js') ?>
+    </script>
+</head>
+<body onload="init()">
+
+    <!-- Header -->
+    <div class="header">
+        <div class="environment">
+            Displayed at <?= esc(date('H:i:s')) ?> &mdash;
+            PHP: <?= esc(PHP_VERSION) ?>  &mdash;
+            CodeIgniter: <?= esc(CodeIgniter::CI_VERSION) ?> --
+            Environment: <?= ENVIRONMENT ?>
+        </div>
+        <div class="container">
+            <h1><?= esc($title), esc($exception->getCode() ? ' #' . $exception->getCode() : '') ?></h1>
+            <p>
+                <?= nl2br(esc($exception->getMessage())) ?>
+                <a href="https://www.duckduckgo.com/?q=<?= urlencode($title . ' ' . preg_replace('#\'.*\'|".*"#Us', '', $exception->getMessage())) ?>"
+                   rel="noreferrer" target="_blank">search &rarr;</a>
+            </p>
+        </div>
+    </div>
+
+    <!-- Source -->
+    <div class="container">
+        <p><b><?= esc(clean_path($file)) ?></b> at line <b><?= esc($line) ?></b></p>
+
+        <?php if (is_file($file)) : ?>
+            <div class="source">
+                <?= static::highlightFile($file, $line, 15); ?>
+            </div>
+        <?php endif; ?>
+    </div>
+
+    <div class="container">
+        <?php
+        $last = $exception;
+
+        while ($prevException = $last->getPrevious()) {
+            $last = $prevException;
+            ?>
+
+    <pre>
+    Caused by:
+    <?= esc($prevException::class), esc($prevException->getCode() ? ' #' . $prevException->getCode() : '') ?>
+
+    <?= nl2br(esc($prevException->getMessage())) ?>
+    <a href="https://www.duckduckgo.com/?q=<?= urlencode($prevException::class . ' ' . preg_replace('#\'.*\'|".*"#Us', '', $prevException->getMessage())) ?>"
+       rel="noreferrer" target="_blank">search &rarr;</a>
+    <?= esc(clean_path($prevException->getFile()) . ':' . $prevException->getLine()) ?>
+    </pre>
+
+        <?php
+        }
+        ?>
+    </div>
+
+    <?php if (defined('SHOW_DEBUG_BACKTRACE') && SHOW_DEBUG_BACKTRACE) : ?>
+    <div class="container">
+
+        <ul class="tabs" id="tabs">
+            <li><a href="#backtrace">Backtrace</a></li>
+            <li><a href="#server">Server</a></li>
+            <li><a href="#request">Request</a></li>
+            <li><a href="#response">Response</a></li>
+            <li><a href="#files">Files</a></li>
+            <li><a href="#memory">Memory</a></li>
+        </ul>
+
+        <div class="tab-content">
+
+            <!-- Backtrace -->
+            <div class="content" id="backtrace">
+
+                <ol class="trace">
+                <?php foreach ($trace as $index => $row) : ?>
+
+                    <li>
+                        <p>
+                            <!-- Trace info -->
+                            <?php if (isset($row['file']) && is_file($row['file'])) : ?>
+                                <?php
+                                if (isset($row['function']) && in_array($row['function'], ['include', 'include_once', 'require', 'require_once'], true)) {
+                                    echo esc($row['function'] . ' ' . clean_path($row['file']));
+                                } else {
+                                    echo esc(clean_path($row['file']) . ' : ' . $row['line']);
+                                }
+                                ?>
+                            <?php else: ?>
+                                {PHP internal code}
+                            <?php endif; ?>
+
+                            <!-- Class/Method -->
+                            <?php if (isset($row['class'])) : ?>
+                                &nbsp;&nbsp;&mdash;&nbsp;&nbsp;<?= esc($row['class'] . $row['type'] . $row['function']) ?>
+                                <?php if (! empty($row['args'])) : ?>
+                                    <?php $argsId = $errorId . 'args' . $index ?>
+                                    ( <a href="#" onclick="return toggle('<?= esc($argsId, 'attr') ?>');">arguments</a> )
+                                    <div class="args" id="<?= esc($argsId, 'attr') ?>">
+                                        <table cellspacing="0">
+
+                                        <?php
+                                        $params = null;
+                                        // Reflection by name is not available for closure function
+                                        if (! str_ends_with($row['function'], '}')) {
+                                            $mirror = isset($row['class']) ? new ReflectionMethod($row['class'], $row['function']) : new ReflectionFunction($row['function']);
+                                            $params = $mirror->getParameters();
+                                        }
+
+                                        foreach ($row['args'] as $key => $value) : ?>
+                                            <tr>
+                                                <td><code><?= esc(isset($params[$key]) ? '$' . $params[$key]->name : "#{$key}") ?></code></td>
+                                                <td><pre><?= esc(print_r($value, true)) ?></pre></td>
+                                            </tr>
+                                        <?php endforeach ?>
+
+                                        </table>
+                                    </div>
+                                <?php else : ?>
+                                    ()
+                                <?php endif; ?>
+                            <?php endif; ?>
+
+                            <?php if (! isset($row['class']) && isset($row['function'])) : ?>
+                                &nbsp;&nbsp;&mdash;&nbsp;&nbsp;    <?= esc($row['function']) ?>()
+                            <?php endif; ?>
+                        </p>
+
+                        <!-- Source? -->
+                        <?php if (isset($row['file']) && is_file($row['file']) && isset($row['class'])) : ?>
+                            <div class="source">
+                                <?= static::highlightFile($row['file'], $row['line']) ?>
+                            </div>
+                        <?php endif; ?>
+                    </li>
+
+                <?php endforeach; ?>
+                </ol>
+
+            </div>
+
+            <!-- Server -->
+            <div class="content" id="server">
+                <?php foreach (['_SERVER', '_SESSION'] as $var) : ?>
+                    <?php
+                    if (empty($GLOBALS[$var]) || ! is_array($GLOBALS[$var])) {
+                        continue;
+                    } ?>
+
+                    <h3>$<?= esc($var) ?></h3>
+
+                    <table>
+                        <thead>
+                            <tr>
+                                <th>Key</th>
+                                <th>Value</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                        <?php foreach ($GLOBALS[$var] as $key => $value) : ?>
+                            <tr>
+                                <td><?= esc($key) ?></td>
+                                <td>
+                                    <?php if (is_string($value)) : ?>
+                                        <?= esc($value) ?>
+                                    <?php else: ?>
+                                        <pre><?= esc(print_r($value, true)) ?></pre>
+                                    <?php endif; ?>
+                                </td>
+                            </tr>
+                        <?php endforeach; ?>
+                        </tbody>
+                    </table>
+
+                <?php endforeach ?>
+
+                <!-- Constants -->
+                <?php $constants = get_defined_constants(true); ?>
+                <?php if (! empty($constants['user'])) : ?>
+                    <h3>Constants</h3>
+
+                    <table>
+                        <thead>
+                            <tr>
+                                <th>Key</th>
+                                <th>Value</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                        <?php foreach ($constants['user'] as $key => $value) : ?>
+                            <tr>
+                                <td><?= esc($key) ?></td>
+                                <td>
+                                    <?php if (is_string($value)) : ?>
+                                        <?= esc($value) ?>
+                                    <?php else: ?>
+                                        <pre><?= esc(print_r($value, true)) ?></pre>
+                                    <?php endif; ?>
+                                </td>
+                            </tr>
+                        <?php endforeach; ?>
+                        </tbody>
+                    </table>
+                <?php endif; ?>
+            </div>
+
+            <!-- Request -->
+            <div class="content" id="request">
+                <?php $request = service('request'); ?>
+
+                <table>
+                    <tbody>
+                        <tr>
+                            <td style="width: 10em">Path</td>
+                            <td><?= esc($request->getUri()) ?></td>
+                        </tr>
+                        <tr>
+                            <td>HTTP Method</td>
+                            <td><?= esc($request->getMethod()) ?></td>
+                        </tr>
+                        <tr>
+                            <td>IP Address</td>
+                            <td><?= esc($request->getIPAddress()) ?></td>
+                        </tr>
+                        <tr>
+                            <td style="width: 10em">Is AJAX Request?</td>
+                            <td><?= $request->isAJAX() ? 'yes' : 'no' ?></td>
+                        </tr>
+                        <tr>
+                            <td>Is CLI Request?</td>
+                            <td><?= $request->isCLI() ? 'yes' : 'no' ?></td>
+                        </tr>
+                        <tr>
+                            <td>Is Secure Request?</td>
+                            <td><?= $request->isSecure() ? 'yes' : 'no' ?></td>
+                        </tr>
+                        <tr>
+                            <td>User Agent</td>
+                            <td><?= esc($request->getUserAgent()->getAgentString()) ?></td>
+                        </tr>
+
+                    </tbody>
+                </table>
+
+
+                <?php $empty = true; ?>
+                <?php foreach (['_GET', '_POST', '_COOKIE'] as $var) : ?>
+                    <?php
+                    if (empty($GLOBALS[$var]) || ! is_array($GLOBALS[$var])) {
+                        continue;
+                    } ?>
+
+                    <?php $empty = false; ?>
+
+                    <h3>$<?= esc($var) ?></h3>
+
+                    <table style="width: 100%">
+                        <thead>
+                            <tr>
+                                <th>Key</th>
+                                <th>Value</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                        <?php foreach ($GLOBALS[$var] as $key => $value) : ?>
+                            <tr>
+                                <td><?= esc($key) ?></td>
+                                <td>
+                                    <?php if (is_string($value)) : ?>
+                                        <?= esc($value) ?>
+                                    <?php else: ?>
+                                        <pre><?= esc(print_r($value, true)) ?></pre>
+                                    <?php endif; ?>
+                                </td>
+                            </tr>
+                        <?php endforeach; ?>
+                        </tbody>
+                    </table>
+
+                <?php endforeach ?>
+
+                <?php if ($empty) : ?>
+
+                    <div class="alert">
+                        No $_GET, $_POST, or $_COOKIE Information to show.
+                    </div>
+
+                <?php endif; ?>
+
+                <?php $headers = $request->headers(); ?>
+                <?php if (! empty($headers)) : ?>
+
+                    <h3>Headers</h3>
+
+                    <table>
+                        <thead>
+                            <tr>
+                                <th>Header</th>
+                                <th>Value</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                        <?php foreach ($headers as $name => $value) : ?>
+                            <tr>
+                                <td><?= esc($name, 'html') ?></td>
+                                <td>
+                                <?php
+                                if ($value instanceof Header) {
+                                    echo esc($value->getValueLine(), 'html');
+                                } else {
+                                    foreach ($value as $i => $header) {
+                                        echo ' ('. $i+1 . ') ' . esc($header->getValueLine(), 'html');
+                                    }
+                                }
+                                ?>
+                                </td>
+                            </tr>
+                        <?php endforeach; ?>
+                        </tbody>
+                    </table>
+
+                <?php endif; ?>
+            </div>
+
+            <!-- Response -->
+            <?php
+                $response = service('response');
+                $response->setStatusCode(http_response_code());
+            ?>
+            <div class="content" id="response">
+                <table>
+                    <tr>
+                        <td style="width: 15em">Response Status</td>
+                        <td><?= esc($response->getStatusCode() . ' - ' . $response->getReasonPhrase()) ?></td>
+                    </tr>
+                </table>
+
+                <?php $headers = $response->headers(); ?>
+                <?php if (! empty($headers)) : ?>
+                    <h3>Headers</h3>
+
+                    <table>
+                        <thead>
+                            <tr>
+                                <th>Header</th>
+                                <th>Value</th>
+                            </tr>
+                        </thead>
+                        <tbody>
+                        <?php foreach ($headers as $name => $value) : ?>
+                            <tr>
+                                <td><?= esc($name, 'html') ?></td>
+                                <td>
+                                <?php
+                                if ($value instanceof Header) {
+                                    echo esc($response->getHeaderLine($name), 'html');
+                                } else {
+                                    foreach ($value as $i => $header) {
+                                        echo ' ('. $i+1 . ') ' . esc($header->getValueLine(), 'html');
+                                    }
+                                }
+                                ?>
+                                </td>
+                            </tr>
+                        <?php endforeach; ?>
+                        </tbody>
+                    </table>
+
+                <?php endif; ?>
+            </div>
+
+            <!-- Files -->
+            <div class="content" id="files">
+                <?php $files = get_included_files(); ?>
+
+                <ol>
+                <?php foreach ($files as $file) :?>
+                    <li><?= esc(clean_path($file)) ?></li>
+                <?php endforeach ?>
+                </ol>
+            </div>
+
+            <!-- Memory -->
+            <div class="content" id="memory">
+
+                <table>
+                    <tbody>
+                        <tr>
+                            <td>Memory Usage</td>
+                            <td><?= esc(static::describeMemory(memory_get_usage(true))) ?></td>
+                        </tr>
+                        <tr>
+                            <td style="width: 12em">Peak Memory Usage:</td>
+                            <td><?= esc(static::describeMemory(memory_get_peak_usage(true))) ?></td>
+                        </tr>
+                        <tr>
+                            <td>Memory Limit:</td>
+                            <td><?= esc(ini_get('memory_limit')) ?></td>
+                        </tr>
+                    </tbody>
+                </table>
+
+            </div>
+
+        </div>  <!-- /tab-content -->
+
+    </div> <!-- /container -->
+    <?php endif; ?>
+
+</body>
+</html>

app/Views/errors/html/production.php

@@ -0,0 +1,25 @@
+<!doctype html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="robots" content="noindex">
+
+    <title><?= lang('Errors.whoops') ?></title>
+
+    <style>
+        <?= preg_replace('#[\r\n\t ]+#', ' ', file_get_contents(__DIR__ . DIRECTORY_SEPARATOR . 'debug.css')) ?>
+    </style>
+</head>
+<body>
+
+    <div class="container text-center">
+
+        <h1 class="headline"><?= lang('Errors.whoops') ?></h1>
+
+        <p class="lead"><?= lang('Errors.weHitASnag') ?></p>
+
+    </div>
+
+</body>
+
+</html>

app/Views/instruments/form.php

@@ -0,0 +1,23 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<h1 class="h4 mb-3"><?= esc($title) ?></h1>
+
+<div class="card shadow-sm">
+    <div class="card-body">
+        <?php $action = $instrument ? site_url('instruments/' . $instrument['id']) : site_url('instruments'); ?>
+        <?= form_open($action, ['class' => 'row g-3']) ?>
+            <div class="col-md-6">
+                <label class="form-label">Nazwa instrumentu</label>
+                <input type="text" name="name" class="form-control" required maxlength="120"
+                       value="<?= esc(old('name', $instrument['name'] ?? '')) ?>"
+                       placeholder="np. Obligacje, ETF">
+            </div>
+            <div class="col-12">
+                <button type="submit" class="btn btn-primary">Zapisz</button>
+                <a href="<?= site_url('instruments') ?>" class="btn btn-link">Anuluj</a>
+            </div>
+        <?= form_close() ?>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/instruments/index.php

@@ -0,0 +1,49 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h1 class="h4 mb-0">Instrumenty</h1>
+    <a href="<?= site_url('instruments/new') ?>" class="btn btn-primary">+ Nowy instrument</a>
+</div>
+
+<div class="card shadow-sm">
+    <div class="table-responsive">
+        <table class="table table-hover mb-0 align-middle">
+            <thead class="table-light">
+                <tr>
+                    <th>Instrument</th>
+                    <th class="text-end">Wpłacono netto</th>
+                    <th class="text-end">Wartość</th>
+                    <th class="text-end">Zarobek</th>
+                    <th class="text-end">%</th>
+                    <th class="text-end">Akcje</th>
+                </tr>
+            </thead>
+            <tbody>
+            <?php if (empty($instruments)): ?>
+                <tr><td colspan="6" class="text-center text-muted py-4">Brak instrumentów.</td></tr>
+            <?php else: foreach ($instruments as $i): ?>
+                <tr>
+                    <td><?= esc($i['name']) ?></td>
+                    <td class="text-end"><?= $fmt($i['net_invested']) ?></td>
+                    <td class="text-end"><?= $i['has_value'] ? $fmt($i['value']) : '<span class="text-muted">brak wyceny</span>' ?></td>
+                    <td class="text-end <?= $i['profit'] >= 0 ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $i['has_value'] ? $fmt($i['profit']) : '—' ?>
+                    </td>
+                    <td class="text-end <?= $i['profit'] >= 0 ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $i['percent'] !== null && $i['has_value'] ? number_format($i['percent'], 2, ',', ' ') . '%' : '—' ?>
+                    </td>
+                    <td class="text-end">
+                        <a href="<?= site_url('instruments/' . $i['id'] . '/edit') ?>" class="btn btn-sm btn-outline-secondary">Edytuj</a>
+                        <a href="<?= site_url('instruments/' . $i['id'] . '/delete') ?>" class="btn btn-sm btn-outline-danger"
+                           onclick="return confirm('Usunąć instrument?')">Usuń</a>
+                    </td>
+                </tr>
+            <?php endforeach; endif; ?>
+            </tbody>
+        </table>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/inv_operations/form.php

@@ -0,0 +1,52 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<h1 class="h4 mb-3"><?= esc($title) ?></h1>
+
+<div class="card shadow-sm">
+    <div class="card-body">
+        <?php $action = $op ? site_url('investments/operations/' . $op['id']) : site_url('investments/operations'); ?>
+        <?= form_open($action, ['class' => 'row g-3']) ?>
+            <div class="col-md-4">
+                <label class="form-label">Instrument</label>
+                <?php $selIns = old('instrument_id', $op['instrument_id'] ?? ''); ?>
+                <select name="instrument_id" class="form-select" required>
+                    <option value="">— wybierz —</option>
+                    <?php foreach ($instruments as $i): ?>
+                        <option value="<?= $i['id'] ?>" <?= (string) $selIns === (string) $i['id'] ? 'selected' : '' ?>>
+                            <?= esc($i['name']) ?>
+                        </option>
+                    <?php endforeach; ?>
+                </select>
+            </div>
+            <div class="col-md-4">
+                <label class="form-label">Data</label>
+                <input type="date" name="date" class="form-control" required
+                       value="<?= esc(old('date', $op['date'] ?? date('Y-m-d'))) ?>">
+            </div>
+            <div class="col-md-4">
+                <label class="form-label">Typ</label>
+                <?php $t = old('type', $op['type'] ?? 'deposit'); ?>
+                <select name="type" class="form-select" required>
+                    <option value="deposit"  <?= $t === 'deposit'  ? 'selected' : '' ?>>Wpłata</option>
+                    <option value="withdraw" <?= $t === 'withdraw' ? 'selected' : '' ?>>Wypłata</option>
+                </select>
+            </div>
+            <div class="col-md-4">
+                <label class="form-label">Kwota (zł)</label>
+                <input type="number" step="0.01" min="0.01" name="amount" class="form-control" required
+                       value="<?= esc(old('amount', $op['amount'] ?? '')) ?>">
+            </div>
+            <div class="col-md-8">
+                <label class="form-label">Opis (opcjonalnie)</label>
+                <input type="text" name="description" class="form-control" maxlength="255"
+                       value="<?= esc(old('description', $op['description'] ?? '')) ?>">
+            </div>
+            <div class="col-12">
+                <button type="submit" class="btn btn-primary">Zapisz</button>
+                <a href="<?= site_url('investments/operations') ?>" class="btn btn-link">Anuluj</a>
+            </div>
+        <?= form_close() ?>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/inv_operations/index.php

@@ -0,0 +1,89 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h1 class="h4 mb-0">Operacje inwestycyjne</h1>
+    <a href="<?= site_url('investments/operations/new') ?>" class="btn btn-primary">+ Nowa operacja</a>
+</div>
+
+<div class="card shadow-sm mb-3">
+    <div class="card-body">
+        <?= form_open('investments/operations', ['method' => 'get', 'class' => 'row g-2 align-items-end']) ?>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Od</label>
+                <input type="date" name="from" class="form-control" value="<?= esc($filter['from'] ?? '') ?>">
+            </div>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Do</label>
+                <input type="date" name="to" class="form-control" value="<?= esc($filter['to'] ?? '') ?>">
+            </div>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Instrument</label>
+                <select name="instrument_id" class="form-select">
+                    <option value="">— wszystkie —</option>
+                    <?php foreach ($instruments as $i): ?>
+                        <option value="<?= $i['id'] ?>" <?= (string) ($filter['instrument_id'] ?? '') === (string) $i['id'] ? 'selected' : '' ?>>
+                            <?= esc($i['name']) ?>
+                        </option>
+                    <?php endforeach; ?>
+                </select>
+            </div>
+            <div class="col-6 col-md-2">
+                <label class="form-label small mb-1">Typ</label>
+                <select name="type" class="form-select">
+                    <option value="">— oba —</option>
+                    <option value="deposit"  <?= ($filter['type'] ?? '') === 'deposit'  ? 'selected' : '' ?>>Wpłata</option>
+                    <option value="withdraw" <?= ($filter['type'] ?? '') === 'withdraw' ? 'selected' : '' ?>>Wypłata</option>
+                </select>
+            </div>
+            <div class="col-md-1">
+                <button class="btn btn-outline-primary w-100">Filtruj</button>
+            </div>
+        <?= form_close() ?>
+    </div>
+</div>
+
+<div class="card shadow-sm">
+    <div class="table-responsive">
+        <table class="table table-hover mb-0 align-middle">
+            <thead class="table-light">
+                <tr>
+                    <th>Data</th>
+                    <th>Instrument</th>
+                    <th>Typ</th>
+                    <th>Opis</th>
+                    <th class="text-end">Kwota</th>
+                    <th class="text-end">Akcje</th>
+                </tr>
+            </thead>
+            <tbody>
+            <?php if (empty($operations)): ?>
+                <tr><td colspan="6" class="text-center text-muted py-4">Brak operacji dla wybranych filtrów.</td></tr>
+            <?php else: foreach ($operations as $o): ?>
+                <?php $isDep = $o['type'] === 'deposit'; ?>
+                <tr>
+                    <td><?= esc($o['date']) ?></td>
+                    <td><?= esc($o['instrument_name'] ?? '—') ?></td>
+                    <td>
+                        <span class="badge <?= $isDep ? 'bg-success' : 'bg-secondary' ?>">
+                            <?= $isDep ? 'Wpłata' : 'Wypłata' ?>
+                        </span>
+                    </td>
+                    <td class="text-muted"><?= esc($o['description'] ?? '') ?></td>
+                    <td class="text-end <?= $isDep ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $isDep ? '+' : '−' ?><?= $fmt($o['amount']) ?>
+                    </td>
+                    <td class="text-end">
+                        <a href="<?= site_url('investments/operations/' . $o['id'] . '/edit') ?>" class="btn btn-sm btn-outline-secondary">Edytuj</a>
+                        <a href="<?= site_url('investments/operations/' . $o['id'] . '/delete') ?>" class="btn btn-sm btn-outline-danger"
+                           onclick="return confirm('Usunąć operację?')">Usuń</a>
+                    </td>
+                </tr>
+            <?php endforeach; endif; ?>
+            </tbody>
+        </table>
+    </div>
+</div>
+<?= $this->endSection() ?>

app/Views/investments/index.php

@@ -0,0 +1,88 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<div class="d-flex justify-content-between align-items-center mb-3 flex-wrap gap-2">
+    <h1 class="h4 mb-0">Pulpit inwestycji</h1>
+    <div class="btn-group">
+        <a href="<?= site_url('investments/operations/new') ?>" class="btn btn-sm btn-outline-primary">+ Wpłata / wypłata</a>
+        <a href="<?= site_url('investments/valuations/new') ?>" class="btn btn-sm btn-outline-primary">+ Wycena</a>
+    </div>
+</div>
+
+<div class="row g-3 mb-4">
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Wpłacono netto</div>
+        <div class="value"><?= $fmt($net_invested) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Bieżąca wartość</div>
+        <div class="value"><?= $fmt($value) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Zarobek</div>
+        <div class="value <?= $profit >= 0 ? 'amount-income' : 'amount-expense' ?>"><?= $fmt($profit) ?></div>
+    </div></div></div>
+</div>
+
+<div class="card shadow-sm mb-4"><div class="card-body">
+    <h2 class="h6">Portfel w czasie</h2>
+    <div id="chartPortfolio"></div>
+</div></div>
+
+<div class="card shadow-sm"><div class="card-body">
+    <h2 class="h6">Rozbicie na instrumenty</h2>
+    <div class="table-responsive">
+        <table class="table table-hover mb-0 align-middle">
+            <thead class="table-light">
+                <tr>
+                    <th>Instrument</th>
+                    <th class="text-end">Wpłacono netto</th>
+                    <th class="text-end">Wartość</th>
+                    <th class="text-end">Zarobek</th>
+                    <th class="text-end">% zwrotu</th>
+                </tr>
+            </thead>
+            <tbody>
+            <?php if (empty($instruments)): ?>
+                <tr><td colspan="5" class="text-center text-muted py-4">Brak instrumentów.</td></tr>
+            <?php else: foreach ($instruments as $i): ?>
+                <tr>
+                    <td><?= esc($i['name']) ?></td>
+                    <td class="text-end"><?= $fmt($i['net_invested']) ?></td>
+                    <td class="text-end"><?= $i['has_value'] ? $fmt($i['value']) : '<span class="text-muted">brak wyceny</span>' ?></td>
+                    <td class="text-end <?= $i['profit'] >= 0 ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $i['has_value'] ? $fmt($i['profit']) : '—' ?>
+                    </td>
+                    <td class="text-end <?= $i['profit'] >= 0 ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $i['percent'] !== null && $i['has_value'] ? number_format($i['percent'], 2, ',', ' ') . '%' : '—' ?>
+                    </td>
+                </tr>
+            <?php endforeach; endif; ?>
+            </tbody>
+        </table>
+    </div>
+</div></div>
+<?= $this->endSection() ?>
+
+<?= $this->section('scripts') ?>
+<script>
+const timeline = <?= json_encode($timeline, JSON_UNESCAPED_UNICODE) ?>;
+
+new ApexCharts(document.querySelector('#chartPortfolio'), {
+    chart: { type: 'line', height: 340 },
+    series: [
+        { name: 'Wpłacono netto', data: timeline.map(r => Number(r.net)) },
+        { name: 'Wartość',        data: timeline.map(r => Number(r.value)) },
+        { name: 'Zarobek',        data: timeline.map(r => Number(r.profit)) }
+    ],
+    xaxis: { categories: timeline.map(r => r.date), type: 'category' },
+    colors: ['#455a64', '#1565c0', '#1a7f37'],
+    stroke: { curve: 'smooth', width: 2 },
+    markers: { size: 4 },
+    dataLabels: { enabled: false },
+    noData: { text: 'Brak wycen — dodaj wpłaty i wycenę, aby zobaczyć wykres' }
+}).render();
+</script>
+<?= $this->endSection() ?>

app/Views/layout/main.php

@@ -0,0 +1,66 @@
+<!doctype html>
+<html lang="pl">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title><?= esc($title ?? 'finansePRO') ?></title>
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
+    <style>
+        body { background:#f5f6f8; }
+        .stat-card .value { font-size:1.6rem; font-weight:600; }
+        .amount-income { color:#1a7f37; }
+        .amount-expense { color:#c62828; }
+    </style>
+</head>
+<body>
+<?php if (session()->get('logged_in')): ?>
+    <nav class="navbar navbar-expand-lg navbar-dark bg-dark mb-4">
+        <div class="container">
+            <a class="navbar-brand fw-bold" href="<?= site_url('dashboard') ?>">finansePRO</a>
+            <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#nav">
+                <span class="navbar-toggler-icon"></span>
+            </button>
+            <div class="collapse navbar-collapse" id="nav">
+                <ul class="navbar-nav me-auto">
+                    <li class="nav-item"><a class="nav-link" href="<?= site_url('dashboard') ?>">Pulpit</a></li>
+                    <li class="nav-item dropdown">
+                        <a class="nav-link dropdown-toggle" href="#" id="navFinance" role="button" data-bs-toggle="dropdown">Finanse bieżące</a>
+                        <ul class="dropdown-menu" aria-labelledby="navFinance">
+                            <li><a class="dropdown-item" href="<?= site_url('finances') ?>">Pulpit finansów</a></li>
+                            <li><a class="dropdown-item" href="<?= site_url('operations') ?>">Operacje</a></li>
+                            <li><a class="dropdown-item" href="<?= site_url('categories') ?>">Kategorie</a></li>
+                        </ul>
+                    </li>
+                    <li class="nav-item dropdown">
+                        <a class="nav-link dropdown-toggle" href="#" id="navInvest" role="button" data-bs-toggle="dropdown">Inwestycje</a>
+                        <ul class="dropdown-menu" aria-labelledby="navInvest">
+                            <li><a class="dropdown-item" href="<?= site_url('investments') ?>">Pulpit inwestycji</a></li>
+                            <li><a class="dropdown-item" href="<?= site_url('investments/operations') ?>">Wpłaty / wypłaty</a></li>
+                            <li><a class="dropdown-item" href="<?= site_url('investments/valuations') ?>">Wyceny</a></li>
+                            <li><a class="dropdown-item" href="<?= site_url('instruments') ?>">Instrumenty</a></li>
+                        </ul>
+                    </li>
+                </ul>
+                <span class="navbar-text text-light me-3 small"><?= esc(session()->get('user_email')) ?></span>
+                <a class="btn btn-outline-light btn-sm" href="<?= site_url('logout') ?>">Wyloguj</a>
+            </div>
+        </div>
+    </nav>
+<?php endif; ?>
+
+<main class="container pb-5">
+    <?php if (session()->getFlashdata('error')): ?>
+        <div class="alert alert-danger"><?= esc(session()->getFlashdata('error')) ?></div>
+    <?php endif; ?>
+    <?php if (session()->getFlashdata('success')): ?>
+        <div class="alert alert-success"><?= esc(session()->getFlashdata('success')) ?></div>
+    <?php endif; ?>
+
+    <?= $this->renderSection('content') ?>
+</main>
+
+<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/apexcharts@3.54.1/dist/apexcharts.min.js"></script>
+<?= $this->renderSection('scripts') ?>
+</body>
+</html>

app/Views/operations/form.php

@@ -0,0 +1,72 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<h1 class="h4 mb-3"><?= esc($title) ?></h1>
+
+<div class="card shadow-sm">
+    <div class="card-body">
+        <?php $action = $op ? site_url('operations/' . $op['id']) : site_url('operations'); ?>
+        <?= form_open($action, ['class' => 'row g-3']) ?>
+            <div class="col-md-4">
+                <label class="form-label">Data</label>
+                <input type="date" name="date" class="form-control" required
+                       value="<?= esc(old('date', $op['date'] ?? date('Y-m-d'))) ?>">
+            </div>
+            <div class="col-md-4">
+                <label class="form-label">Kwota (zł)</label>
+                <input type="number" step="0.01" min="0.01" name="amount" class="form-control" required
+                       value="<?= esc(old('amount', $op['amount'] ?? '')) ?>">
+            </div>
+            <div class="col-md-4">
+                <label class="form-label">Typ</label>
+                <?php $t = old('type', $op['type'] ?? 'expense'); ?>
+                <select name="type" id="type" class="form-select" required>
+                    <option value="income"  <?= $t === 'income'  ? 'selected' : '' ?>>Przychód</option>
+                    <option value="expense" <?= $t === 'expense' ? 'selected' : '' ?>>Wydatek</option>
+                </select>
+                <div class="form-text">Wybór kategorii ustawia typ automatycznie.</div>
+            </div>
+            <div class="col-md-6">
+                <label class="form-label">Kategoria</label>
+                <?php $selCat = old('category_id', $op['category_id'] ?? ''); ?>
+                <select name="category_id" id="category_id" class="form-select">
+                    <option value="" data-type="">— bez kategorii —</option>
+                    <?php foreach ($categories as $c): ?>
+                        <option value="<?= $c['id'] ?>" data-type="<?= $c['type'] ?>"
+                            <?= (string) $selCat === (string) $c['id'] ? 'selected' : '' ?>>
+                            <?= esc($c['indent_label']) ?> (<?= $c['type'] === 'income' ? 'przychód' : 'wydatek' ?>)
+                        </option>
+                    <?php endforeach; ?>
+                </select>
+            </div>
+            <div class="col-md-6">
+                <label class="form-label">Opis (opcjonalnie)</label>
+                <input type="text" name="description" class="form-control" maxlength="255"
+                       value="<?= esc(old('description', $op['description'] ?? '')) ?>">
+            </div>
+            <div class="col-12">
+                <button type="submit" class="btn btn-primary">Zapisz</button>
+                <a href="<?= site_url('operations') ?>" class="btn btn-link">Anuluj</a>
+            </div>
+        <?= form_close() ?>
+    </div>
+</div>
+<?= $this->endSection() ?>
+
+<?= $this->section('scripts') ?>
+<script>
+    // Kategoria narzuca typ operacji (spojnosc ze zrodlem prawdy po stronie serwera).
+    const cat = document.getElementById('category_id');
+    const type = document.getElementById('type');
+    function syncType() {
+        const opt = cat.options[cat.selectedIndex];
+        const t = opt.getAttribute('data-type');
+        if (t) { type.value = t; type.setAttribute('disabled', 'disabled'); }
+        else { type.removeAttribute('disabled'); }
+    }
+    cat.addEventListener('change', syncType);
+    syncType();
+    // disabled select nie wysyla wartosci -> odblokuj przy submit (serwer i tak wymusi typ z kategorii)
+    type.form.addEventListener('submit', () => type.removeAttribute('disabled'));
+</script>
+<?= $this->endSection() ?>

app/Views/operations/index.php

@@ -0,0 +1,107 @@
+<?= $this->extend('layout/main') ?>
+
+<?= $this->section('content') ?>
+<?php $fmt = static fn ($v) => number_format((float) $v, 2, ',', ' ') . ' zł'; ?>
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h1 class="h4 mb-0">Operacje</h1>
+    <a href="<?= site_url('operations/new') ?>" class="btn btn-primary">+ Nowa operacja</a>
+</div>
+
+<div class="card shadow-sm mb-3">
+    <div class="card-body">
+        <?= form_open('operations', ['method' => 'get', 'class' => 'row g-2 align-items-end']) ?>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Od</label>
+                <input type="date" name="from" class="form-control" value="<?= esc($filter['from'] ?? '') ?>">
+            </div>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Do</label>
+                <input type="date" name="to" class="form-control" value="<?= esc($filter['to'] ?? '') ?>">
+            </div>
+            <div class="col-6 col-md-3">
+                <label class="form-label small mb-1">Kategoria</label>
+                <select name="category_id" class="form-select">
+                    <option value="">— wszystkie —</option>
+                    <?php foreach ($categories as $c): ?>
+                        <option value="<?= $c['id'] ?>" <?= (string) ($filter['category_id'] ?? '') === (string) $c['id'] ? 'selected' : '' ?>>
+                            <?= esc($c['indent_label']) ?>
+                        </option>
+                    <?php endforeach; ?>
+                </select>
+            </div>
+            <div class="col-6 col-md-2">
+                <label class="form-label small mb-1">Typ</label>
+                <select name="type" class="form-select">
+                    <option value="">— oba —</option>
+                    <option value="income"  <?= ($filter['type'] ?? '') === 'income'  ? 'selected' : '' ?>>Przychód</option>
+                    <option value="expense" <?= ($filter['type'] ?? '') === 'expense' ? 'selected' : '' ?>>Wydatek</option>
+                </select>
+            </div>
+            <div class="col-md-1">
+                <button class="btn btn-outline-primary w-100">Filtruj</button>
+            </div>
+        <?= form_close() ?>
+    </div>
+</div>
+
+<div class="row g-3 mb-3">
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Przychody</div>
+        <div class="value amount-income"><?= $fmt($totals['income']) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Wydatki</div>
+        <div class="value amount-expense"><?= $fmt($totals['expense']) ?></div>
+    </div></div></div>
+    <div class="col-md-4"><div class="card stat-card shadow-sm"><div class="card-body">
+        <div class="text-muted small">Saldo</div>
+        <div class="value <?= $totals['balance'] >= 0 ? 'amount-income' : 'amount-expense' ?>"><?= $fmt($totals['balance']) ?></div>
+    </div></div></div>
+</div>
+
+<div class="card shadow-sm">
+    <div class="table-responsive">
+        <table class="table table-hover mb-0 align-middle">
+            <thead class="table-light">
+                <tr>
+                    <th>Data</th>
+                    <th>Kategoria</th>
+                    <th>Opis</th>
+                    <th class="text-end">Kwota</th>
+                    <th class="text-end">Akcje</th>
+                </tr>
+            </thead>
+            <tbody>
+            <?php if (empty($operations)): ?>
+                <tr><td colspan="5" class="text-center text-muted py-4">Brak operacji dla wybranych filtrów.</td></tr>
+            <?php else: foreach ($operations as $o): ?>
+                <tr>
+                    <td><?= esc($o['date']) ?></td>
+                    <td>
+                        <?php
+                            if (! empty($o['category_name'])) {
+                                echo esc(! empty($o['parent_name'])
+                                    ? $o['parent_name'] . ' → ' . $o['category_name']
+                                    : $o['category_name']);
+                            } else {
+                                echo '(bez kategorii)';
+                            }
+                        ?>
+                    </td>
+                    <td class="text-muted"><?= esc($o['description'] ?? '') ?></td>
+                    <td class="text-end <?= $o['type'] === 'income' ? 'amount-income' : 'amount-expense' ?>">
+                        <?= $o['type'] === 'income' ? '+' : '−' ?><?= $fmt($o['amount']) ?>
+                    </td>
+                    <td class="text-end">
+                        <a href="<?= site_url('operations/' . $o['id'] . '/edit') ?>" class="btn btn-sm btn-outline-secondary">Edytuj</a>
+                        <a href="<?= site_url('operations/' . $o['id'] . '/delete') ?>" class="btn btn-sm btn-outline-danger"
+                           onclick="return confirm('Usunąć operację?')">Usuń</a>
+                    </td>
+                </tr>
+            <?php endforeach; endif; ?>
+            </tbody>
+        </table>
+    </div>
+</div>
+<?= $this->endSection() ?>