🚀 TidyFactor Go — Turnkey Agile Business Platform & Lightweight CMS

The AI-Native Website Operating System & Agile CMS with Single-File SQLite 3 (WAL Mode) & JSON-First Storage

TidyFactor Go (tidyfactor-go) is a turnkey website operating system and modern lightweight CMS designed for high-performance business websites, digital agencies, and independent creators. Engineered for 100% data sovereignty, zero ongoing subscription fees, and native human-agent collaboration, it combines a blazing-fast React 19 + Tailwind CSS v4 frontend with an ultra-lightweight PHP Flight + SQLite 3 WAL backend.

---

🏛️ 1. Master Platform Architecture

                     TidyFactor Go Master Platform Architecture
                                         │
        ┌────────────────────────────────┼────────────────────────────────┐
        ↓                                ↓                                ↓
 🎨 Modern Frontend               ⚡ Headless REST API              💾 Embedded Data Layer
  • React 19 + TypeScript          • PHP Flight Micro-Kernel        • SQLite 3 (WAL Mode)
  • Tailwind CSS v4 Engine         • 15 RESTful Endpoints           • JSON-First Document Store
  • Radix UI Accessible Primitives • Bcrypt Auth (Cost 12)          • Self-Healing Migrations
  • Native Arabic RTL / English    • Rate Limiting & Anti-Bot       • Single-File Portability
  • Gemini AI Content Assistant    • SVG XSS DOM Sanitizer          • Point-in-Time Snapshots
        │                                │                                │
        └────────────────────────────────┼────────────────────────────────┘
                                         ↓
                         Zero-Build Production Deployment
                (cPanel / Apache / LiteSpeed / Nginx / Cloud VPS)

---

💎 2. Core Value Propositions & Architectural Principles

1. 100% Data Sovereignty & Single-File Portability

• The entire database lives in a single, portable .sqlite file in storage/database/.
• No external database servers (MySQL/PostgreSQL) consuming 500MB+ RAM on shared hosts.
• Moving or backing up your website is as simple as copying a single file.

2. Automated Zero-Friction Setup Wizard (/install)

• Deploying to production takes under 2 minutes without writing a single line of SQL.
• Automated system check verifies PHP version, SQLite extension, and directory permissions.
• Provisions database tables, creates the master administrator account, and self-locks the installer.

3. Native Bilingual Architecture (Arabic RTL & English LTR)

• Built-in directional styling via CSS Logical Properties (margin-inline, padding-block).
• Independent Arabic and English content fields across all pages, services, and articles.
• Instant client-side language switching without page reloads or broken layouts.

4. Zero Framework Bloat & 0ms Database Daemon Overhead

• PHP Flight router executes in under 5ms per request with less than 2MB RAM footprint.
• Runs effortlessly on the cheapest $2/month cPanel shared hosting or minimal 512MB VPS.

---

🗄️ 3. Embedded Database Schema & SQLite WAL Internals

TidyFactor Go leverages SQLite 3 configured in Write-Ahead Logging (WAL) Mode, allowing concurrent readers while writes occur without table locks.

Engine PRAGMA Settings:

PRAGMA journal_mode = WAL;          -- Enables non-blocking concurrent reads and writes
PRAGMA synchronous = NORMAL;        -- Balances absolute data safety with extreme throughput
PRAGMA foreign_keys = ON;           -- Enforces strict relational integrity
PRAGMA busy_timeout = 5000;         -- 5-second automatic wait before SQLITE_BUSY error
PRAGMA cache_size = -64000;         -- Allocates 64MB dedicated in-memory page cache

Core Relational & JSON Schema:

-- 1. Pages Table (JSON Document Store)
CREATE TABLE IF NOT EXISTS pages (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    slug TEXT NOT NULL UNIQUE,
    title_ar TEXT NOT NULL,
    title_en TEXT NOT NULL,
    content_json TEXT NOT NULL DEFAULT '{}',   -- Dynamic sections, blocks & metadata
    is_published INTEGER NOT NULL DEFAULT 1,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- 2. Publications & Blog Posts
CREATE TABLE IF NOT EXISTS publications (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    slug TEXT NOT NULL UNIQUE,
    category TEXT NOT NULL DEFAULT 'general',
    title_ar TEXT NOT NULL,
    title_en TEXT NOT NULL,
    summary_ar TEXT,
    summary_en TEXT,
    body_markdown_ar TEXT NOT NULL,
    body_markdown_en TEXT NOT NULL,
    featured_image TEXT,
    author_id INTEGER REFERENCES users(id),
    is_published INTEGER NOT NULL DEFAULT 1,
    published_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- 3. Administrative Users
CREATE TABLE IF NOT EXISTS users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT NOT NULL UNIQUE,
    email TEXT NOT NULL UNIQUE,
    password_hash TEXT NOT NULL,               -- Bcrypt (Cost 12)
    role TEXT NOT NULL DEFAULT 'admin',        -- 'superadmin', 'admin', 'editor'
    last_login DATETIME,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- 4. Media & Asset Manifest
CREATE TABLE IF NOT EXISTS media (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    filename TEXT NOT NULL,
    original_name TEXT NOT NULL,
    mime_type TEXT NOT NULL,
    file_size INTEGER NOT NULL,
    width INTEGER,
    height INTEGER,
    uploaded_by INTEGER REFERENCES users(id),
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

-- 5. System Settings & Environment Variables
CREATE TABLE IF NOT EXISTS settings (
    key TEXT PRIMARY KEY,
    value TEXT NOT NULL,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

---

⚡ 4. REST API Reference (15 Endpoints)

All endpoints accept and return application/json; charset=UTF-8. Protected endpoints require standard session cookie or Authorization: Bearer <token>.

Method	Endpoint	Description	Auth Required
POST	/api/auth/login	Authenticate administrator with rate-limiting protection	❌ Public
POST	/api/auth/logout	Invalidate active session and destroy authentication cookie	✅ Admin
GET	/api/auth/check	Return current authenticated user payload and permissions	✅ Admin
GET	/api/site	Retrieve global site configuration, navigation menus & brand DNA	❌ Public
POST	/api/site	Update global site JSON document and flush runtime cache	✅ Admin
GET	/api/pages	List all dynamic content pages with localized titles & slugs	❌ Public
GET	/api/pages/:slug	Fetch complete page content JSON by URL slug	❌ Public
POST	/api/pages	Create a new content page with initial section blocks	✅ Admin
PUT	/api/pages/:id	Surgically update page title, sections, or publish status	✅ Admin
DELETE	/api/pages/:id	Delete a content page and archive associated assets	✅ Admin
GET	/api/publications	Paginated list of blog articles with tag and category filtering	❌ Public
POST	/api/publications	Publish a new bilingual Markdown blog post	✅ Admin
POST	/api/media/upload	Upload asset (PNG, JPG, SVG, WebP) with SVG XSS sanitizer	✅ Admin
GET	/api/backup/export	Download complete point-in-time .zip snapshot (DB + media)	✅ Admin
POST	/api/backup/import	Atomic restore from a previously exported backup payload	✅ Admin

---

🔒 5. Security Protocols & Hardening Standards

1. Bcrypt Password Security & Brute-Force Lockdown

• Admin passwords hashed using password_hash() with PASSWORD_BCRYPT (cost factor: 12).
• In-memory rate limiting locks out IP addresses after 5 consecutive failed login attempts (15-minute cooldown period).

2. SVG XML DOM Sanitization (XSS Immunity)

• Embedded SVG uploads are parsed through PHP's DOMDocument parser.
• Strips dangerous elements (<script>, <foreignObject>, <iframe data=...>) and all event handler attributes (onload, onerror, onclick, onmouseover).

3. Server-Level Anti-Bot & Scraper Shield

TidyFactor Go includes a locked .htaccess ruleset blocking abusive AI crawlers and scrapers:

# TidyFactor Anti-Bot & Scraper Shield
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (Bytespider|ClaudeBot|ImagesiftBot|GPTBot|DataForSeoBot) [NC]
RewriteRule .* - [F,L]

4. HTTP Security Headers

All responses automatically include protective HTTP headers:

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

---

🚀 6. Installation & Deployment Guide

System Requirements:

• PHP: 8.2 or 8.3+
• PHP Extensions: pdo_sqlite, sqlite3, json, mbstring, fileinfo
• Web Server: Apache (with mod_rewrite), LiteSpeed, or Nginx
• RAM: Minimum 64MB (Recommended: 128MB+)

Step-by-Step Installation:

# 1. Clone or extract TidyFactor Go into your web root (e.g. public_html)
git clone https://github.com/TidyFactor/TidyFactor-Go.git public_html
cd public_html

# 2. Install dependencies
composer install --no-dev --optimize-autoloader

# 3. Ensure permissions on writable directories
chmod -R 755 storage/ uploads/

4. Launch Web Installation Wizard:

Open your browser and navigate to:

https://yourdomain.com/install

1. System Health Check: Verifies PHP modules, directory permissions, and write access. 2. Database Provisioning: Initializes SQLite tables and PRAGMA settings. 3. Admin Account Setup: Enter your username, email, and master password. 4. Finalization: The installer automatically locks itself and redirects you to the /admin dashboard.

---

📦 7. Backup & Point-in-Time Disaster Recovery

One-Click Web Backup:

1. Navigate to /admin/backups in your dashboard.
2. Click Generate Full Backup Snapshot.
3. A timestamped .zip containing storage/database/database.sqlite, storage/site.json, and uploads/ will be generated for download.

CLI Snapshot Command:

# Point-in-time CLI backup snapshot
php tools/backup.php --output=/path/to/backups/tidyfactor-go-$(date +%F).zip

---

🔧 8. Troubleshooting & Diagnostics

Symptom	Probable Cause	Exact Solution
SQLITE_BUSY: database is locked	Concurrent write deadlock without WAL	Verify PRAGMA journal_mode = WAL; is enabled in config/database.php.
404 Not Found on API routes	Apache mod_rewrite is disabled	Enable mod_rewrite in Apache and ensure .htaccess has RewriteEngine On.
File Upload Failed (413 Payload Too Large)	PHP upload_max_filesize limit	Update upload_max_filesize = 32M and post_max_size = 32M in php.ini.
Permissions Denied on storage/	Web server user does not own folder	Run chown -R www-data:www-data storage/ uploads/ (or chmod 755).

---

🔗 Official Links & Resources

• Product Page: https://tidyfactor.com/products/tidyfactor-go
• Live Interactive Demo: https://tidyfactor.com/go/
• Documentation Portal: https://tidyfactor.com/documentation
• GitHub Repository: https://github.com/TidyFactor/TidyFactor-Go