PHPackages aimeos/pagible-theme - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Templating & Views](/categories/templating) 4. / 5. aimeos/pagible-theme ActiveLibrary[Templating & Views](/categories/templating) aimeos/pagible-theme ==================== Pagible CMS - Frontend theme and rendering 0.11.5(3w ago)0238↑53.8%6LGPL-3.0-onlyPHPPHP ^8.2 Since Apr 16Pushed 1mo agoCompare [ Source](https://github.com/aimeos/pagible-theme)[ Packagist](https://packagist.org/packages/aimeos/pagible-theme)[ Docs](https://pagible.com)[ RSS](/packages/aimeos-pagible-theme/feed)WikiDiscussions master Synced 1w ago READMEChangelogDependencies (12)Versions (13)Used By (6) Pagible Theme ============= [](#pagible-theme) Frontend rendering for [Pagible CMS](https://pagible.com). Provides page rendering, search, sitemap, and contact form with Blade templates. This package is part of the [Pagible CMS monorepo](https://github.com/aimeos/pagible). For full installation, use: ``` composer require aimeos/pagible ``` Configuration ------------- [](#configuration) After installation, the configuration is available in `config/cms/theme.php`: OptionEnv VariableDefaultDescription`cache``file` (or `array` in debug)Cache store for rendered pages (from `config/cache.php`)`lock``CMS_THEME_LOCK``5`Complete-page render lock lifetime in seconds`stale``CMS_THEME_STALE``10`Seconds an expired complete page remains available during revalidation`ttl``CMS_THEME_TTL``86400` (or `0` in debug)Time-to-live for cached pages in seconds; `0` disables caching`disk``CMS_THEME_DISK`Filesystem disk for tenant-uploaded themes; disabled if unconfigured`sitemap``CMS_SITEMAP``sitemap`URL path prefix for XML sitemap (`/{sitemap}.xml`)`pageroute``CMS_PAGEROUTE``{}`JSON object with catch-all page route options (Laravel route group)### Authenticated page caching [](#authenticated-page-caching) Anonymous public pages use complete-response caching owned entirely by the pre-session middleware. It reads cached responses, coordinates rendering, and stores only a final response marked public. Requests carrying the Laravel session cookie or an `Authorization` header bypass that cache and authenticated responses are rendered privately. Applications with other authentication indicators can extend the cheap pre-session check: The outer `Origin` middleware applies this policy to every theme route and shares its decision with `ServeCachedPage`. Cache admission requires the request scheme and port to match `APP_URL`; in single-domain mode its hostname must match as well. Pagible still passes noncanonical requests to the application, but forces their responses to `private, no-store` and removes `Expires` so neither its complete-page cache, sitemap responses, nor a compliant shared cache stores them. Configure trusted proxies before this middleware so Laravel resolves the public origin correctly. Pagible does not reject unknown hosts; applications should separately enable Laravel's `TrustHosts` middleware or enforce an equivalent host allowlist at the web server, especially when multidomain routing accepts tenant hosts outside `APP_URL`. In multi-tenant applications, tenant initialization must run before `ServeCachedPage`; otherwise the middleware can read a cache key and query pages without the intended tenant context. Apply the tenancy initializer globally before the CMS routes or add it to the outer `pageroute.middleware` group. Do not place it in `web` or after `ServeCachedPage`. The core package's Stancl tenancy section contains a configuration example. ``` \Aimeos\Cms\Http\Middleware\ServeCachedPage::bypassUsing( fn($request) => $request->hasCookie('sso') ); ``` CDNs must apply the same bypass rules for the session cookie, authorization header, and any custom authentication indicator; otherwise the edge may return public HTML before Laravel receives the request. Multi-node installations must configure a shared lock-capable theme cache store such as Redis so all application instances address the same entries. The built-in session-cookie and `Authorization` checks always remain active. The callback only needs to identify additional authentication mechanisms. Missing pages can still return before the session middleware starts; restricted pages continue through the `web` middleware so Laravel can authenticate the request and handle guest redirects. ### Security headers on cached pages [](#security-headers-on-cached-pages) Complete-page cache entries contain the rendered HTML, not arbitrary response headers from inner middleware. Apply security-header middleware globally or to the outer `pageroute.middleware` group so it decorates cache hits as well as freshly rendered responses: ``` // config/cms/theme.php 'pageroute' => [ 'middleware' => [ \App\Http\Middleware\SecurityHeaders::class, ], ], ``` Middleware added inside Laravel's `web` group runs only after `ServeCachedPage` and is therefore skipped on cache hits. Origin-wide static headers such as HSTS can alternatively be added by the web server or CDN. Request-specific values fetched by JavaScript from a separate uncached API do not affect page cacheability because they are not embedded in the cached document. Complete-page caching is unsuitable only when a response security header must match a request-specific value embedded in the initial HTML. ### Restricted-page login redirects [](#restricted-page-login-redirects) Restricted pages throw Laravel's `AuthenticationException` for guests and return `403 Forbidden` for authenticated users without a matching frontend access value. To redirect browser guests to a login page, configure Laravel's standard guest redirect in the host application's `bootstrap/app.php`: ``` use Illuminate\Foundation\Application; use Illuminate\Foundation\Configuration\Middleware; use Illuminate\Http\Request; return Application::configure(basePath: dirname(__DIR__)) // ... ->withMiddleware(function (Middleware $middleware) { $middleware->redirectGuestsTo( fn (Request $request) => route('login') ); }) // ... ->create(); ``` The named `login` route must be public and registered before the CMS catch-all route. Requests that expect JSON receive `401 Unauthorized` instead of a redirect. Without a configured guest redirect, Laravel returns `401 Unauthorized` for restricted guest requests. During public-page revalidation, a request that finds another renderer active may receive the previous complete page for `stale` seconds. Without a stale entry, it waits for the render lease, rechecks the cache, and only renders without writing if that bounded wait expires. The cache-store TTL keeps an entry through its stale window, while its fresh expiry remains in the entry. Invalidation deletes entries without waiting for active render leases. After page publication, deletion, or access changes commit, core dispatches a lightweight event and the theme synchronously removes the affected rendered HTML. Cache failures are reported without undoing the committed content change. The origin cache TTL and CDN `s-maxage` remain the consistency boundary, so stale HTML already stored by an external cache may remain visible until expiry. Installations using only the core package remain independent of frontend caching. ### Content Security Policy [](#content-security-policy) CSP directives are configured under the `csp` key, with defaults for hCaptcha: OptionEnv VariableDefault`csp.media-src``CMS_CSP_MEDIA_SRC``csp.style-src``CMS_CSP_STYLE_SRC``https://hcaptcha.com https://*.hcaptcha.com``csp.frame-src``CMS_CSP_FRAME_SRC``https://hcaptcha.com https://*.hcaptcha.com``csp.script-src``CMS_CSP_SCRIPT_SRC``https://hcaptcha.com https://*.hcaptcha.com``csp.connect-src``CMS_CSP_CONNECT_SRC``https://hcaptcha.com https://*.hcaptcha.com`Commands -------- [](#commands) ### cms:install:theme [](#cmsinstalltheme) Installs the Pagible Theme package. ``` php artisan cms:install:theme ``` Publishes theme files and adds hCaptcha configuration to `config/services.php`. Requires `HCAPTCHA_SITEKEY` and `HCAPTCHA_SECRET` environment variables for contact form spam protection. ### cms:benchmark:theme [](#cmsbenchmarktheme) Runs page rendering and controller benchmarks. ``` php artisan cms:benchmark:theme [options] ``` OptionDefaultDescription`--tenant``benchmark`Tenant ID`--domain`Domain name`--seed`Seed benchmark data first`--pages``10000`Number of pages to generate`--tries``100`Iterations per benchmark`--chunk``50`Rows per bulk insert batch`--unseed`Remove benchmark data and exit`--force`Run in productionBlade Directives ---------------- [](#blade-directives) DirectiveDescription`@localDate($date, $format)`Formats a date using Carbon locale-aware `isoFormat``@markdown($text)`Converts Markdown to HTML using GitHub-flavored CommonMarkLicense ------- [](#license) MIT ### Health Score 43 — FairBetter than 89% of packages Maintenance92 Actively maintained with recent releases Popularity15 Limited adoption so far Community14 Small or concentrated contributor base Maturity44 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~8 days Total 12 Last Release 25d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/ccdc84033584516c77fb6aa7f85dc7048f2fbcd08867fc6abf115d094bab5eef?d=identicon)[aimeos](/maintainers/aimeos) --- Top Contributors [![aimeos](https://avatars.githubusercontent.com/u/8647429?v=4)](https://github.com/aimeos "aimeos (148 commits)") --- Tags laravelcmsthemefrontend ### Embed Badge ![Health badge](/badges/aimeos-pagible-theme/health.svg) ``` [![Health](https://phpackages.com/badges/aimeos-pagible-theme/health.svg)](https://phpackages.com/packages/aimeos-pagible-theme) ``` ### Alternatives [laravel/framework The Laravel Framework. 34.9k556.2M21.3k](/packages/laravel-framework)[statamic/cms The Statamic CMS Core Package 4.9k3.8M1.1k](/packages/statamic-cms)[tightenco/jigsaw Simple static sites with Laravel's Blade. 2.3k457.5k30](/packages/tightenco-jigsaw)[tempest/framework The PHP framework that gets out of your way. 2.3k37.6k19](/packages/tempest-framework)[helsingborg-stad/municipio A bootstrap theme for creating municipality sites. 4028.6k10](/packages/helsingborg-stad-municipio)[riclep/laravel-storyblok A Laravel wrapper around the Storyblok API to provide a familiar experience for Laravel devs 6281.2k5](/packages/riclep-laravel-storyblok) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)