From 606cbdcb2e8dba2ee9232a295b79b30da5d14b33 Mon Sep 17 00:00:00 2001
From: team2 <team2@mitho-media.de>
Date: Sun, 22 Feb 2026 18:41:08 +0100
Subject: [PATCH] phase a audit

---
 config/services.yaml                         |  2 +-
 src/Controller/Admin/DocumentController.php  | 28 ++++++++++++++++----
 src/Controller/Admin/IngestJobController.php | 19 +++++++------
 src/Ingest/GuardrailValidator.php            |  1 +
 src/Ingest/VectorRebuildService.php          |  3 +++
 5 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/config/services.yaml b/config/services.yaml
index 211b646..d1179e9 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -34,7 +34,7 @@ parameters:
   mto.index.embedding_dimension: 768
   mto.index.scoring_version: 1
 
-  mto.vector.python_bin: '/var/www/html/.venv/bin/python3'
+  mto.vector.python_bin: '%kernel.project_dir%/.venv/bin/python3'
   mto.vector.ingest_script: '%mto.vector.script_dir%/vector_ingest.py'
   mto.vector.search_script: '%mto.vector.script_dir%/vector_search.py'
   mto.vector.timeout: 600
diff --git a/src/Controller/Admin/DocumentController.php b/src/Controller/Admin/DocumentController.php
index b428e25..fe5e3c2 100644
--- a/src/Controller/Admin/DocumentController.php
+++ b/src/Controller/Admin/DocumentController.php
@@ -410,7 +410,17 @@ class DocumentController extends AbstractController
 
     private function canExec(): bool
     {
-        return function_exists('exec');
+        if (!function_exists('exec')) {
+            return false;
+        }
+
+        $disabled = (string) ini_get('disable_functions');
+        if ($disabled === '') {
+            return true;
+        }
+
+        $list = array_map('trim', explode(',', $disabled));
+        return !in_array('exec', $list, true);
     }
 
     private function ensureDir(string $dir): void
@@ -429,14 +439,22 @@ class DocumentController extends AbstractController
         $projectDir = (string)$this->getParameter('kernel.project_dir');
         $console = $projectDir . '/bin/console';
 
-        // WICHTIG: --no-interaction ist ein GLOBAL-Flag und muss VOR dem Command stehen!
+        $logDir = $projectDir . '/var/log/ingest';
+        if (!is_dir($logDir)) {
+            @mkdir($logDir, 0777, true);
+        }
+        $logFile = $logDir . '/job_' . $jobId . '.log';
+
+        // Wichtig: CLI-PHP verwenden, nicht PHP_BINARY aus FPM
+        $php = 'php';
+
         $cmd = sprintf(
-            '%s %s %s %s %s > /dev/null 2>&1 &',
-            escapeshellarg(PHP_BINARY),
+            '%s %s --no-interaction %s %s >> %s 2>&1 &',
+            escapeshellcmd($php),
             escapeshellarg($console),
-            '--no-interaction',
             escapeshellarg('mto:agent:ingest:run'),
             escapeshellarg($jobId),
+            escapeshellarg($logFile),
         );
 
         exec($cmd);
diff --git a/src/Controller/Admin/IngestJobController.php b/src/Controller/Admin/IngestJobController.php
index 16f0f5d..f17b477 100644
--- a/src/Controller/Admin/IngestJobController.php
+++ b/src/Controller/Admin/IngestJobController.php
@@ -96,20 +96,23 @@ class IngestJobController extends AbstractController
         $projectDir = (string)$this->getParameter('kernel.project_dir');
         $console = $projectDir . '/bin/console';
 
+        $logDir = $projectDir . '/var/log/ingest';
+        if (!is_dir($logDir)) {
+            @mkdir($logDir, 0777, true);
+        }
+        $logFile = $logDir . '/job_' . (string)$job->getId() . '.log';
+
+        $php = 'php';
+
         $cmd = sprintf(
-            '%s %s %s %s > /dev/null 2>&1 &',
+            '%s %s --no-interaction %s %s >> %s 2>&1 &',
+            escapeshellcmd($php),
             escapeshellarg($console),
             escapeshellarg('mto:agent:ingest:run'),
             escapeshellarg((string)$job->getId()),
-            escapeshellarg('--no-interaction'),
+            escapeshellarg($logFile),
         );
 
-        if (!function_exists('exec')) {
-            $jobService->markFailed($job, 'Server configuration does not allow background execution (exec disabled).');
-            $this->addFlash('danger', 'Global Reindex konnte nicht gestartet werden.');
-            return $this->redirectToRoute('admin_jobs');
-        }
-
         exec($cmd);
 
         // ---------------------------------------------------------
diff --git a/src/Ingest/GuardrailValidator.php b/src/Ingest/GuardrailValidator.php
index 50282d6..7b8a9fd 100644
--- a/src/Ingest/GuardrailValidator.php
+++ b/src/Ingest/GuardrailValidator.php
@@ -18,6 +18,7 @@ final readonly class GuardrailValidator
      */
     public function validateOrThrow(): void
     {
+        $this->metaManager->ensureExists();
         $this->metaManager->validateAgainstCurrent();
     }
 }
\ No newline at end of file
diff --git a/src/Ingest/VectorRebuildService.php b/src/Ingest/VectorRebuildService.php
index c264125..a79498f 100644
--- a/src/Ingest/VectorRebuildService.php
+++ b/src/Ingest/VectorRebuildService.php
@@ -26,6 +26,9 @@ final readonly class VectorRebuildService
      */
     public function rebuild(?string $logPath = null): void
     {
+        // ✅ Stelle sicher, dass index_meta.json existiert
+        $this->metaManager->ensureExists();
+
         // 1️⃣ Vector Index neu bauen
         $this->vectorBuilder->rebuildFromNdjson($logPath);