INKRAH Web Design Open Source Project for Journal Peer Review Portal

1. Introduction

Aurea is a self-contained journal management and peer-review platform, built from first principles in plain PHP with an SQLite database. There is no Composer, no npm, no CDN dependency, and no third-party framework anywhere in the codebase — everything required to run the site ships inside this folder.

It covers the full editorial lifecycle: authors submit manuscripts, editors assign reviewers and record decisions, reviewers deliver structured recommendations, and accepted work is published with SEO-friendly metadata, a native PDF viewer, and a token-authenticated REST API for external integrations.

2. Technology stack

3. Infrastructure & requirements

• Web server: Apache with mod_rewrite and mod_headers enabled, and AllowOverride All for the site's directory (required for .htaccess to take effect — see §7).
• PHP: version 8.1 or later, with the pdo_sqlite and fileinfo extensions enabled.
• Disk: write access to /data (database and uploaded manuscripts) and /iedad (configuration, written once by the installer).
• Outbound network: only required if SMTP email delivery is enabled (Settings → Email) — the default PHP mail() transport needs a local MTA instead.
• TLS/HTTPS: strongly recommended in production — several security headers (HSTS, secure cookies) activate automatically once the site is served over HTTPS.
• Local development: PHP's built-in server works via php -S localhost:8000 muwajjih.php (the router script argument is required for clean URLs to function without Apache).

4. Installation guide

1. Upload the entire folder to your web server (or point a local PHP server at it, see §3).
2. Visit /taasis/index.php — this is the one page reachable directly, before any configuration exists.
3. The installer checks server requirements, then asks for your Site URL, site name, and your name/email/password — this becomes the first Super Administrator account.
4. On success you are redirected to /login. The installer writes /iedad/iedad.php (a randomly generated 256-bit secret key included) and creates /data/majalla.sqlite with the full schema.

5. User roles & permissions

Four account tiers form an ascending hierarchy — a higher tier automatically has every permission a lower tier has.

Peer reviewer is not a separate tier — it is an eligibility flag any admin can grant to any account, exactly as one person can hold multiple roles in OJS.

6. Using the platform

As an Author

1. Register at /register — a confirmation email is sent; the account activates once the link is clicked.
2. From the dashboard, choose New Submission, select a journal, and complete title, abstract, keywords, and a PDF manuscript.
3. Track status under My Submissions. While a submission is not yet Published, it remains fully editable and deletable.

As an Editor

1. Open a submission from All Submissions, assign a reviewer-eligible user, and set an optional deadline.
2. Once reviews arrive, record an editorial decision — revision requested, accepted, rejected, or published.
3. Before publishing, optionally edit the article's title, byline name/institution, abstract, and keywords, leave notes for the author, and upload a typeset final PDF (this supersedes the author's original file on the public page).

As an Administrator / Super Administrator

• Create journals, manage user accounts and reviewer eligibility, and issue API keys under Users / Journals / API Keys.
• Add standalone content pages (e.g. "Author Guidelines") under Pages — live at /pages/<slug>.
• Super Admin only: configure the homepage's indexing/partner logos, edit system-wide settings and SMTP email delivery, review the activity log, and use the raw database console.

7. URL structure / sitemap

Every page uses a clean, English-only URL — the underlying file layout is never exposed in the address bar (enforced by muwajjih.php and .htaccess).

Article slugs follow a fixed pattern — the author's full name plus the first five words of the title, hyphenated, with a numeric suffix on collision (-2, -3, …).

8. REST API

Any Administrator or Super Administrator can generate an API key from /account/api-keys. The raw key is shown once; only its SHA-256 hash is stored.

GET /api/journals?sort=newest&limit=6
GET /api/articles?majalla=<journal-slug>
GET /api/articles/<article-slug>
Authorization: Bearer <your-api-key>

Responses are JSON. Invalid or revoked keys return 401; unknown resources return 400.

9. Security measures

• SQL injection: every query runs through PDO prepared statements — no raw string interpolation into SQL anywhere in the codebase.
• XSS: all dynamic output is escaped via a htmlspecialchars wrapper; a strict Content-Security-Policy blocks inline scripts site-wide.
• CSRF: every state-changing form carries a per-session token verified with hash_equals().
• Passwords: hashed with Argon2id.
• Sessions: HttpOnly + SameSite cookies, periodic session ID regeneration, secure flag under HTTPS.
• Brute-force protection: failed logins are rate-limited per IP address.
• File uploads: manuscripts are validated by real MIME sniffing (not the file extension), renamed to random filenames, size-capped, and PHP execution is disabled inside the uploads directory.
• Path traversal: download endpoints resolve and verify the real path before serving any file.
• API keys: stored as salted SHA-256 hashes, never in plain text; revocation is immediate.
• Direct file access: the underlying PHP files are blocked from direct HTTP access by .htaccess — every page is only reachable through its clean route.
• Database console: gated behind Super Admin only, with an explicit confirmation checkbox for data-changing statements, and every query logged.

10. Upgrading an existing installation

Replace the application files with a newer release and reload any page — nawat/tarqiya.php runs automatically, adds any missing database columns or tables, and records a version flag so it will not repeat the work. No manual SQL is required, though a backup of data/majalla.sqlite before upgrading is always sensible.

The /taasis installer folder is only needed for the very first setup. It is safe to delete afterwards — nothing in normal operation reads from it again.

11. Folder glossary

File and folder names on disk use Arabic transliteration, per the original project brief — never exposed to visitors, since every route is a clean English URL (§7).

12. Support & credits

This platform was designed and built by INKRAH Web Design as an open-source project for journal peer-review portals.

Phone: +62 811-1345-777
Email: webmaster@inkrah.com