dunglas / mercure / 34128388455
89%
master: 93%

LAST BUILD BRANCH: worktree-helm-schema-regen
DEFAULT BRANCH: master
Ran
Jobs 1
Files 34
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 88.889% (-0.03%) from 88.923%
34128388455

Pull #1376

github

BySplashGm 
docs: add a Symfony and API Platform page for the 1.0 protocol

The 1.0 tree has no framework documentation. `ecosystem/awesome`,
`reference/protocol` and the Symfony snippet in `concepts/publishing`
all link to Symfony and API Platform without a version requirement or
any mention of what 1.0 needs, so a reader following them lands on 0.x
material.

Nothing documented anywhere covers what `symfony/mercure-bundle` 0.5
actually requires:

- `protocol_version` is per hub and defaults to `0.x`, so upgrading the
  bundle changes nothing: the app keeps minting legacy `mercure`-claim
  tokens and the 1.0 hub answers `401 invalid_token`. This is the single
  most likely way to get stuck.
- Under `protocol_version: '1.0'` with `jwt.secret` or `jwt.jwks_uri`,
  the bundle fails at container compile time unless `jwt.claims` defines
  `iss`, `sub` and `client_id` (RFC 9068).
- `aud` defaults to the hub's `public_url` then `url`, which is wrong in
  the usual Docker split where the app publishes through an internal URL
  and the browser uses a public one, because the hub derives its
  expected audience from the request.
- `jwt.jwks_uri` requires `protocol_version: '1.0'` and
  `web-token/jwt-library`, and is mutually exclusive with `jwt.secret`.
- `jwt.algorithm` has no single default: `hmac.sha256` with `jwt.secret`
  (LcobucciFactory) versus the JWA name `HS256` with `jwt.jwks_uri`
  (WebTokenFactory).
- `cookie_name` flips with `protocol_version`, and `__Secure-` needs
  HTTPS on both sides.
- The Symfony constraint is `^6.4 | ^7.3 | ^8.0`, so an app on Symfony
  7.0 to 7.2 cannot install the bundle at all.

Also covers the subscriber side (API Platform publishes on the
resource's absolute IRI, which is its JSON-LD `@id`; `symfony/mercure`'s
Discovery advertises `rel="mercure"` only) and the FrankenPHP caveat,
with the build recipe that produces a 1.0-capable binary.

Filed under `ecosystem/` next to `awesome`, since that is where the
existing integration material lives.
Pull Request #1376: docs: a Symfony and API Platform page for 1.0

2576 of 2898 relevant lines covered (88.89%)

219.99 hits per line

Coverage Regressions

Lines Coverage ∆ File
1
81.23
 -0.38% bolt.go
Jobs
ID Job ID Ran Files Coverage
1 0 - 34128388455.1 34
88.89
 GitHub Action Run
Source Files on build 34128388455