fix: address CodeRabbit review feedback

- UserWishlistController: validate soft-deleted books before wishlist ops
- ReservationManager/ReservationsController: return false/0 for missing books
- PrestitiController: move duplicate check inside transaction with FOR UPDATE
- QueryCache: add stampede prevention, safe unserialize, selective APCu flush
- web.php: standardize 404 responses with i18n
- layout.php: remove duplicate version.json, add defer to vendor.bundle.js
- Add idx_libri_deleted_at to migration and schema
- Add translation for "Libro non trovato"

Author: fabiodalez-dev

app/Controllers/PrestitiController.php

@@ -111,20 +111,6 @@ public function store(Request $request, Response $response, mysqli $db): Respons
             return $response->withHeader('Location', '/admin/prestiti/crea?error=missing_fields')->withStatus(302);
         }
 
-        // Case 8: Prevent multiple active reservations/loans for the same book by the same user
-        $dupStmt = $db->prepare("
-            SELECT id FROM prestiti
-            WHERE libro_id = ? AND utente_id = ? AND attivo = 1
-            AND stato IN ('in_corso', 'prenotato', 'pendente', 'in_ritardo')
-        ");
-        $dupStmt->bind_param('ii', $libro_id, $utente_id);
-        $dupStmt->execute();
-        if ($dupStmt->get_result()->num_rows > 0) {
-            $dupStmt->close();
-            return $response->withHeader('Location', '/admin/prestiti/crea?error=duplicate_reservation')->withStatus(302);
-        }
-        $dupStmt->close();
-
         // Verifica che la data di scadenza sia successiva alla data di prestito
         if (strtotime($data_scadenza) <= strtotime($data_prestito)) {
             return $response->withHeader('Location', '/admin/prestiti/crea?error=invalid_dates')->withStatus(302);
@@ -146,6 +132,23 @@ public function store(Request $request, Response $response, mysqli $db): Respons
                 return $response->withHeader('Location', '/admin/prestiti/crea?error=book_not_found')->withStatus(302);
             }
 
+            // Case 8: Prevent multiple active reservations/loans for the same book by the same user
+            // Moved inside transaction with FOR UPDATE to prevent race conditions
+            $dupStmt = $db->prepare("
+                SELECT id FROM prestiti
+                WHERE libro_id = ? AND utente_id = ? AND attivo = 1
+                AND stato IN ('in_corso', 'prenotato', 'pendente', 'in_ritardo')
+                FOR UPDATE
+            ");
+            $dupStmt->bind_param('ii', $libro_id, $utente_id);
+            $dupStmt->execute();
+            if ($dupStmt->get_result()->num_rows > 0) {
+                $dupStmt->close();
+                $db->rollback();
+                return $response->withHeader('Location', '/admin/prestiti/crea?error=duplicate_reservation')->withStatus(302);
+            }
+            $dupStmt->close();
+
             // Check if loan starts today (immediate loan) or in the future (scheduled loan)
             // Normalize to date-only to handle potential datetime inputs safely
             $today = gmdate('Y-m-d');

app/Controllers/ReservationManager.php

@@ -432,7 +432,12 @@ public function isBookAvailableForImmediateLoan($bookId, ?string $startDate = nu
             $fallbackStmt->execute();
             $fallbackRow = $fallbackStmt->get_result()?->fetch_assoc();
             $fallbackStmt->close();
-            $totalCopies = (int) ($fallbackRow['copie_totali'] ?? 1);
+
+            // If book doesn't exist or is soft-deleted, return false immediately
+            if ($fallbackRow === null) {
+                return false;
+            }
+            $totalCopies = (int) $fallbackRow['copie_totali'];
         }
 
         if ($totalCopies === 0) {

app/Controllers/ReservationsController.php

@@ -419,6 +419,11 @@ private function getBookTotalCopies(int $bookId): int
         $row = $result ? $result->fetch_assoc() : null;
         $stmt->close();
 
-        return (int) ($row['copie_totali'] ?? 1);
+        // If book doesn't exist or is soft-deleted, return 0
+        if ($row === null) {
+            return 0;
+        }
+
+        return (int) $row['copie_totali'];
     }
 }

app/Controllers/UserWishlistController.php

@@ -64,7 +64,10 @@ public function status(Request $request, Response $response, mysqli $db): Respon
         $libroId = (int) ($q['libro_id'] ?? 0);
         $fav = false;
         if ($libroId > 0) {
-            $stmt = $db->prepare('SELECT 1 FROM wishlist WHERE utente_id=? AND libro_id=? LIMIT 1');
+            // Join with libri to exclude soft-deleted books
+            $stmt = $db->prepare('SELECT 1 FROM wishlist w
+                JOIN libri l ON l.id = w.libro_id AND l.deleted_at IS NULL
+                WHERE w.utente_id = ? AND w.libro_id = ? LIMIT 1');
             $uid = (int) $user['id'];
             $stmt->bind_param('ii', $uid, $libroId);
             $stmt->execute();
@@ -101,6 +104,18 @@ public function toggle(Request $request, Response $response, mysqli $db): Respon
             // Item was removed
             $payload = ['favorite' => false];
         } else {
+            // Validate book exists and is not soft-deleted before inserting
+            $checkStmt = $db->prepare('SELECT id FROM libri WHERE id = ? AND deleted_at IS NULL');
+            $checkStmt->bind_param('i', $libroId);
+            $checkStmt->execute();
+            $bookExists = $checkStmt->get_result()->num_rows > 0;
+            $checkStmt->close();
+
+            if (!$bookExists) {
+                $response->getBody()->write(json_encode(['error' => true, 'message' => __('Libro non trovato')]));
+                return $response->withHeader('Content-Type', 'application/json')->withStatus(404);
+            }
+
             // Item didn't exist, insert it (use IGNORE to handle concurrent inserts)
             $stmt = $db->prepare('INSERT IGNORE INTO wishlist (utente_id, libro_id) VALUES (?, ?)');
             $stmt->bind_param('ii', $uid, $libroId);

app/Routes/web.php

@@ -1512,7 +1512,7 @@
         }
         $stmt->close();
         if (!$bookFound) {
-            $response->getBody()->write(json_encode(['error' => 'Book not found']));
+            $response->getBody()->write(json_encode(['success' => false, 'message' => __('Libro non trovato')]));
             return $response->withStatus(404)->withHeader('Content-Type', 'application/json');
         }
         $data['available'] = ($data['copies_available'] > 0);
@@ -1719,7 +1719,7 @@
         $book = $bookStmt->get_result()->fetch_assoc();
         $bookStmt->close();
         if (!$book) {
-            $response->getBody()->write(json_encode(['error' => 'Book not found']));
+            $response->getBody()->write(json_encode(['success' => false, 'message' => __('Libro non trovato')]));
             return $response->withStatus(404)->withHeader('Content-Type', 'application/json');
         }
 

app/Support/QueryCache.php

@@ -52,6 +52,9 @@ private static function hasApcu(): bool
     /**
      * Get a value from cache or execute callback to generate it
      *
+     * Uses mutex locking to prevent cache stampede (thundering herd problem).
+     * Only one process computes the value while others wait.
+     *
      * @param string $key Unique cache key
      * @param callable $callback Function to generate value if not cached
      * @param int $ttl Time to live in seconds (default: 300 = 5 minutes)
@@ -65,13 +68,46 @@ public static function remember(string $key, callable $callback, int $ttl = 300)
             return $cached;
         }
 
-        // Execute callback to get fresh value
-        $value = $callback();
+        // Acquire mutex lock to prevent stampede
+        $lockKey = self::hashKey($key) . '.lock';
+        $lockFile = self::getCacheDir() . '/' . $lockKey;
+        $lockHandle = @fopen($lockFile, 'c');
+
+        if ($lockHandle === false) {
+            // If we can't get a lock, just execute callback (graceful degradation)
+            return $callback();
+        }
+
+        try {
+            // Try to acquire exclusive lock (non-blocking first)
+            if (!flock($lockHandle, LOCK_EX | LOCK_NB)) {
+                // Another process is computing, wait for it and try cache again
+                flock($lockHandle, LOCK_EX);
+                $cached = self::get($key);
+                if ($cached !== null) {
+                    return $cached;
+                }
+            }
+
+            // Double-check cache after acquiring lock
+            $cached = self::get($key);
+            if ($cached !== null) {
+                return $cached;
+            }
+
+            // Execute callback to get fresh value
+            $value = $callback();
 
-        // Store in cache
-        self::set($key, $value, $ttl);
+            // Store in cache
+            self::set($key, $value, $ttl);
 
-        return $value;
+            return $value;
+        } finally {
+            flock($lockHandle, LOCK_UN);
+            fclose($lockHandle);
+            // Clean up lock file (best effort)
+            @unlink($lockFile);
+        }
     }
 
     /**
@@ -181,15 +217,25 @@ public static function clearByPrefix(string $prefix): int
     }
 
     /**
-     * Clear all cache entries
+     * Clear all Pinakes cache entries
+     *
+     * Only clears entries with the 'pinakes_' prefix to avoid clearing
+     * other applications' cache entries that may share the same APCu instance.
      *
      * @return bool Success status
      */
     public static function flush(): bool
     {
-        // Try APCu first
+        // Try APCu first - only clear pinakes_* keys, not the entire cache
         if (self::hasApcu()) {
-            return apcu_clear_cache();
+            $success = true;
+            $iterator = new \APCUIterator('/^pinakes_/');
+            foreach ($iterator as $item) {
+                if (!apcu_delete($item['key'])) {
+                    $success = false;
+                }
+            }
+            return $success;
         }
 
         // Fallback to file cache - delete all files
@@ -223,6 +269,9 @@ private static function hashKey(string $key): string
 
     /**
      * Get value from file cache
+     *
+     * Uses file locking (flock) to prevent reading incomplete/corrupted data
+     * and safe unserialize to prevent object injection attacks.
      */
     private static function getFromFile(string $hashedKey): mixed
     {
@@ -232,24 +281,45 @@ private static function getFromFile(string $hashedKey): mixed
             return null;
         }
 
-        $content = @file_get_contents($path);
-        if ($content === false) {
+        // Open file with shared lock for reading
+        $handle = @fopen($path, 'r');
+        if ($handle === false) {
             return null;
         }
 
-        $data = @unserialize($content);
-        if ($data === false || !is_array($data)) {
-            @unlink($path);
-            return null;
-        }
+        try {
+            // Acquire shared lock for reading
+            if (!flock($handle, LOCK_SH)) {
+                return null;
+            }
 
-        // Check expiration
-        if (isset($data['expires']) && $data['expires'] < time()) {
-            @unlink($path);
-            return null;
-        }
+            $content = stream_get_contents($handle);
+            if ($content === false || $content === '') {
+                return null;
+            }
+
+            // Use safe unserialize to prevent object injection attacks
+            $data = @unserialize($content, ['allowed_classes' => false]);
+            if ($data === false || !\is_array($data)) {
+                flock($handle, LOCK_UN);
+                fclose($handle);
+                @unlink($path);
+                return null;
+            }
 
-        return $data['value'] ?? null;
+            // Check expiration
+            if (isset($data['expires']) && $data['expires'] < time()) {
+                flock($handle, LOCK_UN);
+                fclose($handle);
+                @unlink($path);
+                return null;
+            }
+
+            return $data['value'] ?? null;
+        } finally {
+            flock($handle, LOCK_UN);
+            fclose($handle);
+        }
     }
 
     /**

app/Views/frontend/layout.php

@@ -1568,13 +1568,8 @@ class="fa-brands fa-bluesky"></i></a>
             </div>
             <hr class="my-4">
             <div class="text-center">
-                <?php
-                $versionFile = dirname(dirname(dirname(__DIR__))) . '/version.json';
-                $versionData = file_exists($versionFile) ? json_decode(file_get_contents($versionFile), true) : null;
-                $version = $versionData['version'] ?? '0.1.1';
-                ?>
                 <p><?= date('Y') ?> • <?= HtmlHelper::e($appName) ?> • Powered by Pinakes
-                    v<?= HtmlHelper::e($version) ?></p>
+                    v<?= HtmlHelper::e($appVersion) ?></p>
             </div>
         </div>
     </footer>

app/Views/layout.php

@@ -695,7 +695,7 @@ class="absolute z-50 w-full mt-2 bg-white border border-gray-200 rounded-2xl sha
       return translated;
     };
   </script>
-  <script src="/assets/vendor.bundle.js?v=<?= $appVersion ?>"></script>
+  <script src="/assets/vendor.bundle.js?v=<?= $appVersion ?>" defer></script>
   <script src="/assets/tinymce/tinymce.min.js" defer></script>
   <script src="/assets/flatpickr-init.js?v=<?= $appVersion ?>" defer></script>
   <script src="/assets/main.bundle.js?v=<?= $appVersion ?>" defer></script>

installer/database/indexes_optimization.sql

@@ -30,6 +30,9 @@ ALTER TABLE libri ADD INDEX IF NOT EXISTS idx_isbn10 (isbn10);
 ALTER TABLE libri ADD INDEX IF NOT EXISTS idx_genere_scaffale (genere_id, scaffale_id);
 ALTER TABLE libri ADD INDEX IF NOT EXISTS idx_sottogenere_scaffale (sottogenere_id, scaffale_id);
 
+-- Indice per soft-delete (SitemapGenerator, filtri deleted_at IS NULL)
+ALTER TABLE libri ADD INDEX IF NOT EXISTS idx_libri_deleted_at (deleted_at);
+
 -- =====================================================
 -- TABELLA: libri_autori (CRITICA - mancano indici composti)
 -- Già presenti: libro_id, autore_id (singoli)

installer/database/migrations/migrate_0.4.3.sql

@@ -1,5 +1,8 @@
 -- Migration script for Pinakes 0.4.3
--- Description: Add 'annullato' and 'scaduto' to prestiti status enum
+-- Description: Add 'annullato' and 'scaduto' to prestiti status enum, add index for soft-delete queries
 -- Date: 2025-12-10
 
 ALTER TABLE `prestiti` MODIFY COLUMN `stato` ENUM('pendente','prenotato','in_corso','restituito','in_ritardo','perso','danneggiato','annullato','scaduto') COLLATE utf8mb4_unicode_ci DEFAULT 'pendente';
+
+-- Add index for deleted_at to optimize soft-delete queries (SitemapGenerator, etc.)
+ALTER TABLE `libri` ADD INDEX IF NOT EXISTS `idx_libri_deleted_at` (`deleted_at`);