Open-source the PhpServicePlatform HTTP layer - #1
Merged
Merged
Conversation
Extract the kernel HTTP layer into a standalone MIT-licensed package: immutable Request/Response value objects, PSR-7 Uri, SiteUri, content negotiation, Method enum, UserAgent, and FPM-/Swoole-safe UploadedFile. Add community health files (README, LICENSE, CODE_OF_CONDUCT, CONTRIBUTING, SECURITY, SUPPORT, issue/PR templates, CODEOWNERS, dependabot), CI matrix (PHP 8.2/8.3/8.4 -> validate + PHPStan + PHPUnit), phpunit + phpstan config, tests, and a kernel-styled .gitignore.
|
Warning Review limit reached
Next review available in: 32 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThe repository is configured as a Composer HTTP package with CI, contribution policies, and documentation. It adds immutable request and response abstractions, URI and site helpers, content negotiation, HTTP method semantics, user-agent parsing, uploaded-file support, and initial PHPUnit coverage. ChangesHTTP package foundation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant Request
participant Negotiate
participant Response
Client->>Request: Send HTTP method, headers, query, and body
Request->>Negotiate: Select supported media type or language
Negotiate-->>Request: Return negotiated value
Request->>Response: Build response from request handling
Response-->>Client: Send headers and body or stream content
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… kernel baseline)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/ISSUE_TEMPLATE/bug_report.yml:
- Around line 8-9: Update the Security Policy link in the issue form’s
introductory text to use the repository-root path ../../SECURITY.md (or an
absolute repository URL), while preserving the existing warning text.
In @.github/workflows/ci.yml:
- Around line 3-7: Harden the pull-request workflow by configuring
actions/checkout with token persistence disabled and declaring least-privilege
workflow permissions, using read-only contents access unless a narrower
permission set is already sufficient. Update the workflow-level settings near
the on trigger; do not grant write permissions or expose the checkout token to
Composer/PHP execution.
In `@composer.json`:
- Around line 32-35: Align the PHP baseline with Symfony 8.1 by updating
composer.json and README.md to require PHP 8.4.1 or newer, and remove PHP
8.2/8.3 from the CI matrix. Alternatively, retain the PHP 8.2 baseline by
pinning symfony/http-foundation and symfony/mime to compatible versions; apply
the same chosen baseline consistently in both affected files.
In `@src/Request.php`:
- Around line 243-247: Update the all() docblock to accurately describe the
values returned by its current implementation, removing the “(+ files)” claim
unless the method is also changed to merge $this->files.
- Line 28: Update the InputBag declarations in Request, including the json
property docblock and the return types around the related accessor methods, to
use InputBag<string|int|float|bool|null>. Apply the same generic annotation
consistently to all three bare InputBag references.
In `@src/Response.php`:
- Around line 150-153: Update Response::back to validate the supplied referer
before passing it to redirect: accept only same-origin or relative paths, and
use the trusted fallback for external, malformed, null, or empty values. Ensure
attacker-controlled Referer content is never reflected into the Location header.
- Around line 315-333: Update Response::streamTo to handle isFile() responses
before the existing body() fallback: open the file at the stored file path, read
it in fixed-size chunks, and pass each non-empty chunk to $writer without
loading the entire file into memory. Preserve the current streamCallback
behavior and existing body() handling for non-file responses, including
appropriate resource cleanup.
- Around line 35-41: Update Response::json to encode data with
JSON_THROW_ON_ERROR instead of falling back to '{}', allowing JsonException to
propagate for malformed UTF-8 or unsupported values; handle that exception at
the application boundary according to the existing error-mapping behavior.
- Around line 161-169: Update Response::jsonp to validate the callback before
embedding it in the JavaScript response, permitting only safe
identifier/member-expression syntax and rejecting invalid or attacker-controlled
values before sprintf is called. Preserve the existing JSON encoding, status,
and response headers for valid callbacks.
In `@src/UserAgent.php`:
- Around line 67-73: Update the match handling in the browser-detection loop to
access the guaranteed first capture group directly, removing the dead
null-coalescing fallback from the $m[1] assignment while preserving the existing
browser and version behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: caa87333-851a-4b7c-ba59-ebd831fed3bf
📒 Files selected for processing (32)
.gitattributes.github/CODEOWNERS.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/dependabot.yml.github/workflows/ci.yml.gitignoreCHANGELOG.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdLICENSEREADME.mdSECURITY.mdSUPPORT.mdcomposer.jsonphpstan.neonphpunit.xmlsrc/Concerns/ManagesResponse.phpsrc/Contracts/RequestAware.phpsrc/Method.phpsrc/Negotiate.phpsrc/Request.phpsrc/Response.phpsrc/SiteUri.phpsrc/UploadedFile.phpsrc/Uri.phpsrc/UserAgent.phptests/MethodTest.phptests/RequestTest.phptests/UriTest.php
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extract the kernel HTTP layer into a standalone MIT-licensed package:
immutable Request/Response value objects, PSR-7 Uri, SiteUri, content
negotiation, Method enum, UserAgent, and FPM-/Swoole-safe UploadedFile.
Add community health files (README, LICENSE, CODE_OF_CONDUCT, CONTRIBUTING,
SECURITY, SUPPORT, issue/PR templates, CODEOWNERS, dependabot), CI matrix
(PHP 8.2/8.3/8.4 -> validate + PHPStan + PHPUnit), phpunit + phpstan config,
tests, and a kernel-styled .gitignore.
Summary by CodeRabbit