Checklists for framework developers
This page is for developers who want to tick boxes rather than read chapters. Each item links to the page that explains it.
Contents
- Evaluating Exponential for a project
- Setting up a development environment
- Reviewing a first module
- Taking an application live
Evaluating Exponential for a project
- To do: The data editors manage is listed, and each kind is either a content class or a table of your own (The content model).
- To do: Sites, languages and audiences are mapped to siteaccesses (Siteaccesses).
- To do: Permissions are described as roles with functions and limitations (Authorization).
- To do: Every feature you count on is checked in the product and distribution you will install, not assumed from another framework (The platform products, Concept dictionary: no direct equivalent).
- To do: The team has read When to choose Exponential.
Setting up a development environment
- To do: A local installation:
./console exp:install --apply(SQLite) (Installing in one command). - To do:
config.env.phpwithEXP_ENV=dev; debug output and thefilemail transport in thedevvariant (Environments and secrets). - To do: Velocity with
Engine=qbix, or Apache or nginx with PHP-FPM (Servers and deployment). - To do: Template path comments and the debug bar on (Debugging).
- To do: An extension of your own, active, in its own Git repository (Packages, Development environment).
Reviewing a first module
- To do: Every view names its policy functions in
module.php(Routing). - To do: Parameters are cast and checked; redirect targets are checked (Validation).
- To do: Every printed value is washed (The view layer).
- To do: Forms post with the form token; no
$_POSTread directly (Forms and CSRF). - To do: No SQL into content tables; persistent objects or escaped SQL for your own tables (Queries).
- To do: No per-request state in static properties (Servers and deployment).
- To do: Settings documented in your extension's INI file, secrets only in
settings/override/(Configuration). - To do: Logic in classes with unit tests that run without a database (Testing).
- To do: No inline
<style>orstyle=""in admin templates (admin4 styling).
Taking an application live
- To do: Your schema and classes install with one command; upgrade steps exist for later releases (Migrations).
- To do: The
frequentandinfrequentcronjob parts, your own parts and queue workers are scheduled (Scheduled tasks, Queues). - To do: Debug output is off for visitors; secrets are set per machine with mode 0640.
- To do:
[HTMLForms] Secretis set for the installation (Forms and CSRF). - To do: Caches and HTTP headers are decided: view cache, cache blocks, HTTP cache, Velocity response cache (Caching, HTTP caching).
- To do: The release sequence is written down and tried on staging (Servers and deployment).
- To do: The security hardening guide has been read (Security hardening).
- To do: The website launch checklist is done for the public site (Launch checklist).
Related pages
- Ten pitfalls for framework developers
- Web framework developer FAQ
- Security for applications
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.