firehed / api
An API framework
Installs: 5 823
Dependents: 0
Suggesters: 0
Security: 0
Stars: 1
Watchers: 3
Forks: 0
Open Issues: 20
Requires
- php: ^7.0
- firehed/common: ^1.0
- firehed/input: ^2.0
- psr/container: ^1.0
- psr/http-message: ^1.0
- psr/http-server-handler: ^1.0
- psr/http-server-middleware: ^1.0
- psr/log: ^1.0
- zendframework/zend-diactoros: ^1.3 || ^2.0
Requires (Dev)
- firehed/arctools: ^1.0
- phpstan/phpstan: ^0.9.2
- phpstan/phpstan-phpunit: ^0.9.4
- phpunit/phpunit: ^6.0 | ^7.0
- squizlabs/php_codesniffer: ^3.1
Suggests
- firehed/inputobjects: Pre-made Input components for validation
- 8.1.x-dev
- dev-master / 4.0.x-dev
- 3.2.2
- 3.2.1
- 3.2.0
- 3.1.0
- 3.0.6
- 3.0.5
- 3.0.4
- 3.0.3
- 3.0.2
- 3.0.1
- 3.0.0
- 2.3.1
- 2.3.0
- 2.2.2
- 2.2.1
- 2.2.0
- 2.1.0
- 2.0.0
- 1.0.0
- 0.2.0
- 0.1.1
- 0.1.0
- 0.0.6
- 0.0.5
- 0.0.4
- 0.0.3
- 0.0.2
- 0.0.1
- dev-dependabot/composer/psr/http-message-tw-2.0
- dev-3_2_0
- dev-newer-php-fixes
- dev-real-enum
- dev-8.1-enums
- dev-upgrade-guide
- dev-inline_search
- dev-phpunit8
- dev-fastroute
This package is auto-updated.
Last update: 2024-10-20 17:17:46 UTC
README
Installation
API is available via composer:
composer require firehed/api
Usage
Set up an .apiconfig
file, which contains JSON-formatted settings for the framework.
You may run vendor/bin/api generate:config
to do this.
See configuration below for additional information.
Generate a default front-controller:
vendor/bin/api generate:frontController
After creating, modifying, or deleting endpoints, run the compiler:
vendor/bin/api compile:all
This step is not optional: the framework depends on the generated files, rather than ever attempting to perform the same step at runtime. It is expected that you will rebuild the files on every build/deployment with the above command. See the section on best practices below.
Testing
For convenience, a trait is included that includes tests for the description methods of your endpoints.
In your test case class (which typically extends PHPUnit\Framework\TestCase
, use the trait:
\Firehed\API\Traits\EndpointTestCases
And add a getEndpoint
method that returns an instance of the endpoint under test.
Example
<?php namespace MyApp\API\Endpoints\User; use Firehed\API\Traits\EndpointTestCases; /** * @covers MyApp\API\Endpoints\User\Create */ class CreateTest extends \PHPUnit\Framework\TestCase { use EndpointTestCases; protected function getEndpoint() { return new Create(); } }
Configuration
Place a file named .apiconfig
in your project root.
It uses JSON for the format.
There is a console command included to walk you through configuration, which can be invoked by running vendor/bin/api generate:config
.
Options
source
: required string
The source code directory to scan for API endpoints.
Most commonly src
.
namespace
: required string
A namespace to filter on when searching for endpoints.
webroot
: required string
The directory to place a generated front controller. The value should be relative to the project root.
container
: optional string
The path to a file which returns a PSR-11
-compliant container for config values.
Container
If you set a container
value in .apiconfig
, the API will be made aware of the container (if you do not use the generated front controller, you may also do this manually).
This is how to configure API endpoints at runtime.
By convention, if the container has()
an endpoint's fully-qualified class name, the dispatcher will get()
and use that value when the route is dispatched.
If no container is configured, or the container does not have a configuration for the routed endpoint, the routed endpoint will simply be instantiated via new $routedEndpointClassName
.
Other auto-detected container entries:
Example
.apiconfig
:
{ "webroot": "public", "namespace": "Your\\Application", "source": "src", "container": "config.php" }
config.php
:
<?php use Firehed\API; use Psr\Log\LoggerInterface; use Your\Application\Endpoints; $container = new Pimple\Container(); // Endpoint config $container[Endpoints\UserPost::class] = function ($c) { return new Endpoints\UserPost($c['some-dependency']); }; // Other services $container[API\Authentication\ProviderInterface::class] = function ($c) { // return your provider }; $container[API\Authorization\ProviderInterface::class] = function ($c) { // return your provider }; $container[LoggerInterface::class] = function ($c) { return new Monolog\Logger('your-application'); }; // ... return new Pimple\Psr11\Container($container);
In this example, when your UserPost
endpoint is routed, it will use the endpoint defined in the container - this allows for endpoints with required constructor arguments or other configuration.
If you have e.g. a UserGet
endpoint which is not in the container, the dispatcher will automatically attempt to instantiate it with new
.
If that endpoint has no constructor arguments, this will be fine.
However, this means your application will crash at runtime if it does - so any endpoints with required constructors must be configured in the container.
Authentication and Authorization
There are two interfaces defined for the processes of authentication (who is performing the request) and authorization (whether they are allowed to perform the request), respectively named Authentication\ProviderInterface
and Authorization\ProviderInterface
.
Both interfaces will be autodetected in a container, and both must be provided.
If both of these are not provided, no authentication or authorization will ever be performed using the application-wide handlers.
Any endpoint that implements Interfaces\AuthenticatedEndpointInterface
will have these processes performed prior to execution, and the container returned by the Authentication provider will be made available to it.
If an endpoint does not implement Interfaces\AuthenticatedEndpointInterface
(i.e. it only implements Interfaces\EndpointInterface
), application-wide auth will be skipped.
Endpoints may, of course, choose to implement their own auth protocols in their execute()
method, but this is discouraged, with the exception of login-type pages (see below).
Generally speaking, implementations for the above interfaces should be looking for authentication data present in (almost) every request: cookies, OAuth Bearer tokens, HTTP basic auth, etc., and validating their authenticity. Endpoints that are used to obtain auth data (e.g. OAuth grant) typically will NOT be authenticated themselves, but will set or return the data to be used to authenticate other requests.
Example provider, which implements both interfaces:
<?php declare(strict_types=1); namespace Your\Project; use Firehed\API\Authentication\ProviderInterface as AuthnProvider; use Firehed\API\Authorization\Exception as AuthException; use Firehed\API\Authorization\ProviderInterface as AuthzProvider; use Firehed\API\Authorization\Ok; use Firehed\API\Container; use Firehed\API\Interfaces\AuthenticatedEndpointInterface; use Psr\Container\ContainerInterface; use Psr\Http\Message\ServerRequestInterface; // This elides a lot of details and error handling for simplicity class AuthProvider implements AuthnProvider, AuthzProvider { public function authenticate(ServerRequestInterface $request): ContainerInterface { list($_, $token) = explode(' ', $request->getHeaderLine('Authorization'), 2); // Find a user, app, etc. from the token string return new Container([ App::class => $app, User::class => $user, // ... 'oauth_scopes' => $scopes, ]); } public function authorize(AuthenticatedEndpointInterface $endpoint, ContainerInterface $container): Ok { $scopes = $container->get('oauth_scopes'); if (!$endpoint instanceof YourInternalScopeInterface) { throw new \LogicException('Endpoint is invalid'); } // This is a method in YourInternalScopeInterface $neededScopes = $endpoint->getRequiredScopes(); foreach ($neededScopes as $scope) { if (!in_array($scope, $scopes)) { throw new AuthException(sprintf('Missing scope %s', $scope)); } } return new Ok(); } }
Error Handling
It is strongly discouraged to handle most exceptions that are thrown in an Endpoint's execute()
method.
Instead, prefer to write services that fail loudly by throwing exceptions and endpoints that expect the success case.
This is not an absolute rule, but helps avoid deeply-nested try
/catch
blocks and other complexity around error handling.
The API framework is responsible for catching all exceptions thrown during an Endpoint's execute()
method, and will provide them to dedicated exception handlers.
It is highly recommended to create and provide a default error handler, Firehed\API\Errors\HandlerInterface
, via the container (see table above).
All unhandled exceptions will be sent to that handler, along with the request (so that responses can be formatted according to Accept
headers, etc).
All endpoints that implement Firehed\API\Interfaces\HandlesOwnErrorsInterface
(which is a part of EndpointInterface
prior to v4.0.0) will have their handleException()
method called with the thrown exception.
This handler will be called before the default error handler.
This method may choose to ignore certain exception classes (by rethrowing them), but must return a PSR ResponseInterface
when opting to handle an exception.
Finally, a global fallback handler is configured by default, which will log the exception and return a generic 500 error.
Best Practices
Source Control
Use source control, of course.
The following patterns should be added to your source control's ignored files, to exclude generated files:
__*__.*
Build Automation
It is highly recommended (for any modern PHP application) to use automated builds.
This framework relies on compilation in order to improve performance. You must run the compilation process prior to deployment, and should do so during your automated build:
vendor/bin/api compile:all
.
Docker
There are no special requirements to run in Docker, beyond what is noted in the above build automation section.
This means you should have the following line in your Dockerfile at any point after installing dependencies with Composer:
RUN vendor/bin/api compile:all
You should also add all of the source control ignore files to your .dockerignore
.
Compatibility
This framework tries to strictly follow the rules of Semantic Versioning.
In summary, this means that given a release named X.Y.Z
:
- Breaking changes will only be introduced when
X
is incremented - New features will only be introduced either when
Y
is incremented or whenX
is incremented andY
is reset to0
- Bugfixes may be introduced in any version increment
The term "breaking changes" should be interpreted to mean:
- Additional required parameters being added to methods
- Additional methods being added to interfaces
- Tightening the typehints of a method or function parameter
- Loosening the return type of a method or function
- Deletion of any public method (except on classes marked as internal)
- Additional system requirements (PHP version, extensions, etc.)
- Substantial, non-optional behavior changes
- Required modifications to documented build steps (e.g.
vendor/bin/api compile:all
)
Breaking changes DO NOT include:
- Removal of a dependency (if you are implicitly relying on a dependency of this framework, you should explicitly add it into your own
composer.json
) - Removal of a class or method that is clearly marked internal
- Format or content changes to any files that are intended to be generated during the compilation process, including adding or removing files entirely
Whenever possible, deprecated functionality will be marked as such by trigger_error(string, E_USER_DEPRECATED)
(in addition to release notes).
Note that depending on your PHP settings, this may result in an ErrorException
being thrown.
Since that is a configurable behavior, it is NOT considered to be a BC break.
Additionally, the entire Firehed\API
namespace should be considered reserved for the purposes of PSR-11 Container auto-detection.
That is to say, if you use a key starting with Firehed\API
in your container, you should expect that key may be retrieved and used without explicitly opting-in to the behavior it provides.