natora.net
user avatar

Natora-Core: A modern PHP Framework

Natora Core: A Modern PHP Framework

A modular, secure, and scalable application foundation designed for building durable web applications.

This site is based on Natora Core, a custom PHP framework designed and developed from scratch around a simple idea: maintaining control over the architecture while benefiting from the principles that make modern frameworks robust.

Rather than building each project independently, the framework provides a common foundation for routing, controllers, services, security, authentication, permissions, views, internationalization, and application modules.

This allows you to develop complex applications without relying on a monolithic framework, while maintaining a consistent and reusable architecture from one project to another.

A Framework Developed from Scratch

This site is based on Natora Core, a personal PHP framework designed and developed from scratch around a simple idea: to maintain control over the architecture while benefiting from the principles that make modern frameworks robust.

Rather than building each project independently, the framework provides a common foundation for routing, controllers, services, security, authentication, permissions, views, internationalization, and application modules.

This allows you to develop complex applications without depending on a monolithic framework, while maintaining a consistent and reusable architecture from one project to another.

A Structured Architecture

The core of the framework organizes the complete cycle of an HTTP request, from its arrival in the application to the generation of the response sent to the browser.

  • Front Controller

    A single entry point initializes the application and forwards requests to the Kernel.

  • Application Kernel

    The Kernel orchestrates the main components of the framework and the processing of each request.

  • Service Container

    Technical and application components are stored in a container to centralize their creation and dependencies.

  • Router

    The routing system associates URLs with controllers and applies the necessary middleware.

  • Request/Response

    HTTP exchanges are represented by dedicated objects, allowing controllers to remain independent of the details implementation.

  • Middlewares

    Authentication, roles, permissions, CSRF, internationalization, logging, and other cross-cutting processes can occur within the HTTP pipeline.

A true modular system

One of the core features of Natora Core is its modular architecture.

An important feature is not directly integrated into the core of the framework: it can be encapsulated in a separate module. The framework has a module registry and a discovery mechanism that allows you to load features available in the core or in the application. A project can therefore activate only the components it actually needs.

Some Modules Already Developed

  • Users and Authentication
  • Member Profiles
  • Roles and Permissions
  • CMS and Page Management
  • Dynamic Menus
  • Media Management
  • Blog
  • Shop
  • Forum
  • Messaging Private
  • Notifications
  • Analytics
  • SEO
  • Mailing List
  • Administration

This approach allows an application to evolve gradually without transforming the core of the framework into a monolithic entity that is difficult to maintain.

Separate Core and Application Logic

The framework intentionally separates generic mechanisms from the logic specific to each project.

Core Contains the reusable components of the framework: Kernel, routing, database, security, events, internationalization, views, and infrastructure. Core Modules Provide generic functionalities that can be used by multiple applications. Application Modules Allow each project to add or replace behaviors without unnecessarily modifying the core.

This separation facilitates framework updates and significantly limits the coupling between infrastructure and business logic.

A Middleware-Based HTTP Pipeline

Controllers are not responsible for all checks.

Cross-cutting concerns are handled upstream by a chain of middleware.Request ReceptionRequest Identification and LoggingLanguage ResolutionCSRF Protection When NecessaryAuthenticationRole ControlPermission ControlController ExecutionResponse Construction

This organization allows for simpler controllers and consistent application of the same rules throughout the application.

Security as a component of the architecture

Security is not added after development. It is part of the framework design and intervenes at various levels of the application.

  • CSRF protection for forms
  • Content Security Policy with request-generated nonce
  • Authentication and session management
  • Persistent authentication with remember-me
  • Secure password reset
  • Role-based access control
  • Application permissions
  • User interaction policies
  • Centralized input validation
  • Data access via PDO
  • Centralized logging
  • Structured error handling
  • Configurable maintenance mode

The goal is not only to prevent errors, but to make sensitive behaviors explicit and predictable in the code.

Roles, Permissions, and Access Control

Access control is not solely based on the distinction between logged-in users and administrators.

The framework has several role levels as well as a permissions system that allows for precise control of access to features.

  • Visitor
  • User
  • Staff
  • Administrator
  • Super Administrator

Application policies can also supplement these permissions to manage more nuanced business situations, particularly interactions between members.

An Event-Driven Architecture

Natora Core also integrates an event system that allows modules to communicate without creating unnecessary direct dependencies between them.

A An action can publish an event to which other modules choose to react. For example, creating a user can independently trigger sending a message, creating a notification, or other processes without the registration module needing to know their implementation. This mechanism helps maintain loose coupling between different functionalities. Native Internationalization Multilingual support is integrated directly into the architecture and is not treated as a secondary feature. Localized URLs Automatic Language Resolution Translation Catalogs per Page Reusable Common Translations Dynamic Variables and Placeholders Direct Integration into Templates A single application can thus offer multiple languages ​​while retaining common controllers and templates.

A View Engine Independent of Business Logic

The display relies on Smarty, used as the template engine to maintain a clear separation between PHP logic and presentation.

A context builder centralizes the global data required by the pages before it is passed to the templates. Controllers can thus focus on their primary responsibility rather than rebuilding the application's overall context each time. Common helpers also standardize HTML responses, redirects, validation errors, and JSON responses.

Consistent Validation and Forms

Forms follow a common architecture to prevent each module from developing its own validation system.

  • Centralized Input Validation
  • Uniform Error Handling
  • CSRF Protection
  • Internationalized Messages
  • Standardized Validation Responses
  • Consistent Behavior Between HTML and AJAX

This standardization simplifies the development of new modules while reducing unexpected behavior.

A Layer Controlled Data Access

Data access relies on PDO and repositories dedicated to different business responsibilities.

SQL queries thus remain explicit and controlled, while controllers and services manipulate interfaces adapted to their domain.

This approach retains the power of SQL when needed without dispersing database access throughout the application.

Une administration construite sur le même socle

Le back-office n'est pas une application séparée. Il repose sur les mêmes mécanismes de routage, sécurité, permissions, vues et modules que la partie publique.

L'administration permet notamment de gérer :

  • les utilisateurs,
  • les rôles et permissions,
  • les modules,
  • les pages du CMS,
  • les menus,
  • les médias,
  • le référencement,
  • les statistiques,
  • les contenus communautaires,
  • et les fonctionnalités propres à chaque application.

Conçu pour évoluer

L'un des objectifs fondamentaux du projet est de pouvoir ajouter de nouvelles fonctionnalités sans remettre en cause l'architecture existante.

Le framework privilégie pour cela des composants spécialisés, des interfaces, des services, des repositories, des événements et des modules indépendants plutôt qu'une accumulation de logique dans quelques classes centrales.

Une nouvelle application peut réutiliser le Core existant puis développer uniquement les modules correspondant à son propre domaine métier.

Quelques principes directeurs

Garder le cœur générique, les modules indépendants et la logique métier à sa place.

  • Responsabilités clairement séparées
  • Faible couplage entre les modules
  • Comportements explicites plutôt qu'implicites
  • Configuration centralisée
  • Sécurité intégrée dès la conception
  • Code réutilisable entre plusieurs projets
  • Compatibilité entre environnements de développement et production
  • Évolution progressive sans réécriture complète

Un laboratoire technique en évolution permanente

Natora Core est avant tout un projet personnel. Il s'est construit progressivement au fil des besoins réels rencontrés lors du développement de différentes applications.

Chaque nouveau projet permet d'éprouver l'architecture, d'identifier ses limites et de faire évoluer le Core lorsque cette évolution peut bénéficier à l'ensemble des applications.

Ce travail constitue ainsi à la fois un framework utilisable, un environnement d'expérimentation et un projet d'apprentissage continu autour de PHP, de l'architecture logicielle, de la sécurité et du développement web.

Natora Core

Un framework personnel construit pour comprendre, maîtriser et faire évoluer l'ensemble de la chaîne applicative.

Conception et développement : Jimmy