Roadmap

[rosstuck]

Road to 1.0

• Integration tests for the security middleware
• Review SecurityMiddlewareTest assertions (and label the data fixtures to see if we're hitting all the main points)
• Port DoctrineMiddlewarePass away from mocks (see https://github.com/thephpleague/tactician-bundle/blob/master/tests/DependencyInjection/Compiler/DoctrineMiddlewarePassTest.php for an example)
• Port CommandHandlerPassTest away from mocks
• Port ContainerBasedHandlerLocator away from mocks
• Fix incorrect docblocks (a number of them are missing type annotations, have old params, etc)
• Review Documentation

1.1

• Reduce complexity of main compiler pass
• Add Autowiring features (see RFC: Autowiring commands to handlers in Symfony 3.3+ #44)
• Add SecurityMiddlewarePassTest
• Add ValidatorMiddlewarePassTest
• Add tactician
• Add tactician:debug command to see command->handler service routing (see [WIP] tactician:debug CLI helper #73 )
• Review docs & changelog

1.2

• Split validator middleware into separate package?

2.0

• Support Tactician2...someday.

Misc

• Start reorganizing README into the wiki or multiple markdown files

[chalasr]

tasks number 4 and 5 of Road to 1.0 addressed in #48

[tyx]

I give a try to the integration test of the SecurityMiddleware but with the following lines

$authenticationManager = static::$kernel->getContainer()->get('security.authentication.manager');
$authenticationManager->authenticate(new UsernamePasswordToken('admin', 'kitten', 'main', ['ROLE_ADMIN']));

I get
Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException: The token storage contains no authentication token. One possible reason may be that there is no firewall configured for this URL.

I don't get how to handle that. I should admit I have a very small experience with this component. If anyone know how to simply authenticate a user with a single password without Request

[rosstuck]

Hmm, I haven't had this problem myself, but this might help?

http://symfony.com/doc/current/testing/http_authentication.html

The WebTestCase base class used above is just a thin addition to the same KernelTestCase base classes we use, some I imagine the same solutions apply.

[RonRademaker]

Addressed number 2 in #49

[chalasr]

Fix incorrect docblocks (a number of them are missing type annotations, have old params, etc)

Fixed in #51

[chalasr]

Add SecurityMiddlewarePassTest
Add ValidatorMiddlewarePassTest

fixed in #52 , good to have

[chalasr]

increasing full test coverage of the security middleware

@RonRademaker Would you mind looking at this? Otherwise I can pick it, but I would first have to look at this middleware.

[RonRademaker]

I'll have some time to look at that in the upcoming days 👍

[chalasr]

Am I mistaken or do we only need to review the docs for a v1 to be out?

[rosstuck]

@chalasr I'm poring over the new security tests as we speak but it's starting to look that way.... 🌞

[rosstuck]

Unfortunately, I found some issues with the security unit tests, documented in #54. I have to go offline for a family event, I'm blocking in some time to go forward with review on Saturday though.

[chalasr]

@rosstuck I'll have a look at these meanwhile, maybe submit a PR targetting your cleanup branch

[rosstuck]

I'm on vacation right now but since we're not making much progress on getting the security issues figured out, I propose we disable/remove them for the time being so we can ship a release that will help the issues 3.3 users are experiencing. I feel bad doing this but I think it's the best option right now. If there's no complaints or alternate suggestions, I'll start on this next week

[chalasr]

I'm fine with postponing security related features.