<p>Two days ago I released the first major version in almost 2 years for <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlink-web-client</a>, a web UI for <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">shlink</a>, my self-hosted URL shortener.</p><p>This new version introduces several improvements to the project, and I thought it was worth writing a post to explain all of them in depth.</p><h3>New design</h3><p>The project has been using the same design almost since the beginning. It was clean, but it laked a bit of contrast and consistency in many sections.</p><p>Now the main background is light-gray, with components composed in white cards with a slight box shadow, that makes them easier to spot inside the app.</p><p>Also, the main area has now a max-width that prevents components from stretching too much on wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/design-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/design-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Overview page</h3><p>Up until now, after connecting to a Shlink server, you went directly to the list of short URLs.</p><p>With this new version, you now see an overview page first, which displays some general stats, a quick short URL creation form, and the latest 5 short URLs.</p><p>From there, you can navigate to the full list of short URLs, with filtering capabilities, or go to the advanced short URL creation form.</p><div class="row"><div class="col-md-8 col-md-offset-2 "><img alt="Overview" src="/assets/img/shlink-web-client-3/overview.png" class="gallery-item"/><p class="text-center"><small>Overview</small></p></div></div><h3>Improved short URL creation form</h3><p>One of the sections with more room for improvement was the short URL creation form. It had all the inputs mixed, displaying just the &quot;long url&quot; one, with the option to un-collapsing the rest at will.</p><p>The new design groups the inputs by context, which makes it more clear. It also displays the inputs all the time, since the &quot;quick form&quot; is now located in the overview page.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/creation-form-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/creation-form-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Enhanced visits page</h3><p>The visits page had a problem, it was trying to display too much information in a single place.</p><ul><li>Visits over time</li><li>Visits from every platform</li><li>Visits from every location</li><li>A list of visits as a table</li></ul><p>The new approach splits those in subsections with their own sub-route each (<code>/by-location</code>, <code>/by-context</code>, etc). This helps to render a smaller amount of charts at once, since they are a bit CPU greedy.</p><p>Also, only the visits from the last 30 days are loaded by default, making it load way faster for URLs with a lot of visits.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/visits-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/visits-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Outer sections</h3><p>The app has some sections which are not related to a specific server, like creating/editing servers, or the settings page.</p><p>These sections have also been adapted to the new style, and they also have a max-width for wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/create-server-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/create-server-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Date range selector</h3><p>A new component allows selecting date ranges either by relative time ranges (last 30 days, last 90 days...) or by selecting absolute start and end dates.</p><p>This component is used to filter both short URL lists and visits lists.</p><div class="row"><div class="col-md-6  col-md-offset-3"><img alt="Date range selector" src="/assets/img/shlink-web-client-3/date-range-selector.png" class=""/><p class="text-center"><small>Date range selector</small></p></div></div><h3>Domain selector</h3><p>Shlink has had multi-domain support for some versions, but changing the domain from the web client required to set the value manually, which is a bit error-prone.</p><p>This version introduces a new component which allows selecting from domains already used in the past (which is what you will want in most of the cases), preventing accidental typos.</p><p>It also allows setting new values in case you want to use a new domain that you never used before. This domain will then appear in the list the next time.</p><div class="row"><div class="col-md-6  "><img alt="Existing domains" src="/assets/img/shlink-web-client-3/domains-existing.png" class=""/><p class="text-center"><small>Existing domains</small></p></div><div class="col-md-6  "><img alt="New domain" src="/assets/img/shlink-web-client-3/domains-new.png" class=""/><p class="text-center"><small>New domain</small></p></div></div><h3>Other improvements</h3><p>The changes described so far were the major ones. However, v3.0.0 includes a few other minor improvements.</p><ul><li>Result and loading messages have been standardized: They are now more consistent and use the same set of components, which also ensures consistency in the future.</li><li>Error messages are now more descriptive: Instead of showing generic error messages when API calls fail, the actual error message is now always displayed, so that it&#x27;s easier to know what failed.</li><li>Dropped support for Shlink v1: All major versions come with some breaking changes that improve code maintainability. This one drops Shlink v1 support, which allows removing some conditional paths here and there.</li></ul><p>Other than the last point, Shlink v3.0.0 is mostly backwards compatible, so it&#x27;s safe to upgrade if you are already using Shlink v2.x</p><h3>Next steps</h3><p>Of course this doesn&#x27;t end here, and I have a lot of ideas to improve it even further.</p><ul><li>Dark theme: It&#x27;s what the cool kids do these days, and I have already done some experiments around it.</li><li>Shlink dashboard: Next gen web app for Shlink. You can read the whole reasoning in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client/issues/338">this issue</a>.</li><li>Filtering in lists added to URL: Many sections allow filtering lists, but the state is saved in memory, which means it gets lost if the page is refreshed, and it cannot be bookmarked. The intention is to make all filtering params to become part of the URL.</li><li>Exporting visits in CSV: It&#x27;s cool to see charts full of info, but sometimes admins need to feed other services with the data, and consuming the original API is not always an option. Exporting visits to a CSV file will be supported soon by shlink-web-client.</li></ul>

Released shlink-web-client v3.0.0

<p>Let&#x27;s not deny that <a target="_blank" rel="noopener noreferrer" href="https://github.com/features/actions">GitHub actions</a> are hitting hard in the tech community, and many projects are transitioning from other continuous integration systems like <a target="_blank" rel="noopener noreferrer" href="https://circleci.com/">Circle CI</a> or <a target="_blank" rel="noopener noreferrer" href="https://travis-ci.org/">Travis CI</a>.</p><p>Personally I have been using Travis a lot during the past years, for all my OSS projects, and I have gotten very used to it.</p><p>However, people seem to be &quot;abandoning&quot; travis in favor of GitHub Actions, for different reasons. &quot;It&#x27;s faster&quot;, &quot;I can run smaller tasks in parallel&quot;, etc.</p><p>In my case, I have moved a few very specific tasks there, where travis was becoming a bottleneck, but I still have mixed feelings about the very-verbose yaml-based config needed to configure a few GitHub Actions, compared to the more concise travis one.</p><p>In this article I&#x27;ll explain how I improved a travis build to run several smaller tasks in parallel jobs, without having to completely move away from it.</p><h3>Initial state</h3><p>This project&#x27;s travis config is relatively simple. It is used to build a JS project for the web browser, and it has to run the next tasks:</p><ul><li>Lint the code, to make sure it fulfils the project&#x27;s coding standards.</li><li>Run unit tests.</li><li>Run mutation tests.</li><li>Build the docker image, to make sure none of the new changes broke it.</li><li>Conditionally publish a release on GitHub, with a dist file attached to it, if the build is being run for a git tag.</li></ul><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

services:
  - docker

node_js:
  - &#x27;12.16.3&#x27;

install: npm ci

before_script:
  - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
  - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)

script:
  - npm run lint
  - npm run test:ci
  - npm run mutate:ci
  - docker build -t project:test .

after_success:
  - node_modules/.bin/ocular coverage/clover.xml

before_deploy: npm run build ${TRAVIS_TAG#?}

deploy:
  - provider: releases
    api_key:
      secure: &lt;key&gt;
    file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
    skip_cleanup: true
    on:
      tags: true
</code></pre></pre><h3>Problems with this approach</h3><p>This is more or less ok, but the last two commands in <code>script</code> can be relatively slow and can delay the whole process.</p><p>Also, specially the mutation tests one, which is currently always considered successful regardless the result, can make the build reach the maximum run time allowed by travis, making the whole build falsely fail.</p><blockquote><p>The reason for the <code>before_script</code> step is to determine which source code files changed, and run mutation tests on them only, in order to mitigate this.</p></blockquote><p>Other than this, the build config defines &quot;global&quot; customizations that are actually only used for some tasks:</p><ul><li>Running <code>npm ci</code> is not required for the <code>docker build</code> task.</li><li>Getting the <code>docker</code> service is not required by any of the other tasks.</li><li>Determining changed files is only used by the <code>mutation tests</code> task.</li></ul><h3>Making use of jobs</h3><p>One cool feature travis supports is the use of a job <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/build-matrix/">build matrix</a>, that lets you define multiple jobs that run in parallel as part of the same build, and make each one of them do unrelated tasks.</p><p>Using this feature it is possible to improve the <code>.travis.yml</code> file, making it look like this:</p><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

node_js:
  - &#x27;12.16.3&#x27;

jobs:
  fast_finish: true
  allow_failures:
    - name: &#x27;Mutation tests&#x27;
  include:

    - name: &#x27;Lint&#x27;
      install: npm ci
      script: npm run lint

    - name: &#x27;Unit tests&#x27;
      install: npm ci
      script: npm run test:ci
      after_success:
        - node_modules/.bin/ocular coverage/clover.xml

    - name: &#x27;Mutation tests&#x27;
      install: npm ci
      before_script:
        - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
        - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)
      script: npm run mutate:ci

    - name: &#x27;Build docker image&#x27;
      services:
        - docker
      install: skip
      script: docker build -t project:test .

    - name: &#x27;Publish release&#x27;
      if: tag IS present
      install: skip
      script: skip
      before_deploy: npm run build ${TRAVIS_TAG#?}
      deploy:
        - provider: releases
          api_key:
            secure: &lt;key&gt;
          file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
          skip_cleanup: true
          on:
            tags: true
</code></pre></pre><p>This approach introduces all these benefits:</p><ul><li>Now linting, testing, mutation testing and building the docker image run in parallel, making the build finish earlier.</li><li>The mutation testing step is allowed to fail, and thanks to the <code>fast_finish</code> flag, travis won&#x27;t even wait for it to finish, considering the build successful once the rest have passed.</li><li>Configs that are only meaningful for certain jobs are defined in the job itself, instead of globally.</li><li>The &quot;publish release&quot; job only runs conditionally if the build is for a tag, thanks to the <code>if: tag IS present</code> condition. (More info about <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/conditional-builds-stages-jobs/">conditional jobs</a> in travis).</li><li>As soon as any of the jobs fails, the whole build fails and you don&#x27;t have to continue waiting. Before this, if the third task failed, you still had to wait for the previous two to finish.</li><li>Each job can have a name, making it more clear in travis UI what tasks are being run:</li></ul><p><img src="/assets/img/travis-multiple-jobs/travis-jobs.png" alt="Travis CI jobs"/></p><h3>Conclusion</h3><p>The main purpose of this article was to showcase that travis still has a lot to give. Github Actions are definitely cool, but there&#x27;s usually no silver bullet for everything, and a combination with other tools might be more suitable.</p><p>Also, this allows people using travis to improve their builds without having to change everything. Then, once you have split your tasks, if you still want to move to Github Actions, it should be easier.</p><blockquote><p>If you are curious, this is the project in which I use this travis configuration: <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlinkio/shlink-web-client</a>.</p></blockquote>

Running several steps of a Travis CI build in parallel

<p>Asynchronous and non-blocking runtimes are pretty usual in many programming languages, as well as long-lived web apps that stay in memory and are capable of dispatching multiple HTTP requests without having to be fully bootstrapped every time. This has not been traditionally the case with PHP apps. </p><p>However, many projects are starting to get some adoption, that bring this long-lived approach to the PHP world.</p><p>The problem with this is that PHP developers are not used to this, and they tend to continue acting as they have always done. Also, libraries might have made some assumptions, making them not work as expected when used under this context.</p><p>Some of these projects are <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk">swoole</a>, <a target="_blank" rel="noopener noreferrer" href="https://reactphp.org/">ReactPHP</a> or <a target="_blank" rel="noopener noreferrer" href="https://amphp.org/">Amphp</a>, to give some examples.</p><p>In this article, I will be focusing on the first one, and explain how to approach some of the pain points I have found after using it for a year and a half on an <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink">existing PHP project</a>.</p><h3>Introducing Swoole</h3><p>The main difference swoole has compared to other similar projects is that it&#x27;s written as a native PHP extension, and needs to be installed with <code>pecl</code>.</p><p>This is obviously a bit cumbersome, but the benefit is that, since it&#x27;s written in C++, it has a better handling of memory allocation, which is very important to achieve what it tries to do.</p><p>What swoole does is running a main process which bootstraps the PHP application once, and then keeps it in memory so that it can continue dispatching requests without having to load resources every time. This makes it really fast.</p><p>Those HTTP requests are handled by a set of child processes called &quot;web workers&quot;. Swoole forks the contents in memory for the main process to each one of the workers, so each worker has a &quot;copy&quot; of the application in memory.</p><p>Each worker is independent, but each one of them can only handle one request at a time, so you have to increase the number of workers if you expect a lot of concurrent traffic.</p><p>Other than web workers, swoole also has another set of child processes called &quot;task workers&quot;, which can be used to delegate long tasks at runtime to prevent web workers from getting blocked.</p><p>Here you can see a diagram of swoole&#x27;s architecture.</p><p><img src="https://www.swoole.co.uk/images/how-swoole-works.png" alt="How Swoole works"/></p><blockquote><p>More information can be found in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/how-it-works">Swoole&#x27;s website</a>.</p></blockquote><h3>Problems to solve</h3><p>Now that we know how swoole works, let&#x27;s see some of the challanges I have faced in th past, which are usually not that ovbious when you are used to think in terms of &quot;blocking&quot; and &quot;short-lived&quot;.</p><h4>Database connections are kept open</h4><p>One of the first things you find out is that, since the application stays in memory, any database connection that has been opened by a worker (either web or task worker), will be kept open and reused in subsequent executions or HTTP requests served by the app.</p><p>This, which is in theory good, has a side effect, which is not obvious during development: <strong>the opened connection will eventually expire</strong>.</p><p>Since most of the popular database abstraction layers in PHP are coming from the times in which PHP was just a bootstrap-on-every-request technology, they never cared too much about expired database connections, as they would be opened again on next request.</p><p>However, when using swoole and the like, you have to implement some mechanism which takes care of reconnecting or gracefully recovering when this happens.</p><blockquote><p>I wrote an article explaining how I solved this on a middleware-based app served with swoole and using doctrine: <a href="/2019/11/04/how-to-properly-handle-a-doctrine-entity-manager-on-an-expressive-application-served-with-swoole/">How to properly handle a doctrine entity manager on an expressive application served with swoole</a></p></blockquote><p>Obviously, swoole (and also others) provides some tools to work with databases (like this <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-async-mysql-client">MySQL client</a>), which I&#x27;m sure do not have this problem (although, I haven&#x27;t personally tried this), but they are more limited than other well adopted libraries.</p><h4>In-memory caches don&#x27;t behave as expected</h4><p>It is a frequent practice to use local in-memory caches, like APCu, to improve applications performance in production.</p><p>Usually APCu is faster than other options, like redis or memcached, so it&#x27;s the choice when you only have one instance of your app running (meaning, you don&#x27;t have a cluster behind a load balancer).</p><p>However, even if you are running your app on just one server with swoole, because of the web worker system explained earlier, you actually have several copies of your app in memory, and each one of them will have a separated and not shared cache when using APCu.</p><p>This can lead to inconsistencies which are hard to debug, so you need to have it in mind.</p><p>Also, since the information that is being loaded is kept in memory anyway, you will not notice such a big improvement by using APCu or other in-memory caches.</p><blockquote><p>Notice that this problem does not happen when using distributed/centralized caching solutions, such as redis or memcached, as in that case, the caching technology is shared by all workers.</p></blockquote><h4>No need to optimize file including/requiring</h4><p>Many projects have complex configuration systems which are spread into several files. While this make it more maintainable, it also has a performance impact when all those files need to be loaded on every request.</p><p>Because of that, there are libraries like <a target="_blank" rel="noopener noreferrer" href="https://github.com/laminas/laminas-config-aggregator">laminas-config-aggregator</a> that can dynamically load config from many sources and, if some conditions are met, they can merge the result in a single bigger file that can be used in later requests.</p><p>In the case of swoole, as all the files will be kept in memory once loaded for the first time, there&#x27;s no need for this kind of optimization.</p><h4>Class autoloading happens once</h4><p>This point is very related with the previous one.</p><p>Composer offers a lot of optimization options so that class autoloading is faster in production. While you usually will still want to use some of those so that the first time a class is being loaded it is still reasonably fast, any subsequent hits will just use the class which is already in memory.</p><p>One of the composer flags you will probably don&#x27;t want use with swoole is <code>--apcu-autoloader</code>, because of the reasons mentioned two points above this one.</p><h4>Services should be truly stateless</h4><p>This is something that you should always do anyway, but it&#x27;s specially important when a service instance is kept in memory between HTTP requests.</p><p>Sometimes it&#x27;s easy to end up having some small piece of internal state on a service, where we save something as a side effect of a method call, to end up using it when another one of the public methods is invoked.</p><p>While this could seem harmless when the whole app is bootstrapped on every request, it can have very dangerous side effects when the app is served with swoole, because the instance will persist until another request is dispatched by the same web worker.</p><p>Just imagine you saved some user data on a service, and it ends up being served to another user on the next request. That won&#x27;t look good.</p><p>Because of this, make sure your services are truly stateless, and if for any reason that&#x27;s not possible, at least remember to have some mechanism in place that flushes the data just before finishing the request.</p><h4>Hot reloading for dev envs is not that good</h4><p>One thing we usually take for granted is that we can modify a PHP file and just by making a new request, the new code will be executed. However, when the code is kept in memory, it&#x27;s not that straightforward.</p><p>When you are developing a project which is served with swoole, you will have to restart the server every time to get your changes applied.</p><p>Swoole has a mechanism to do a light server reload, which is faster. You can find the docs in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-server-reload">it&#x27;s website</a>.</p><p>The problem with this is that you need to implement the mechanism to invoke that when a file is changed, or use some library that does it for you.</p><p>Also, I have noticed that even calling that and seeing that the server is reloaded, does not always have the expected effect, and you have to still end up doing a hard reload. It&#x27;s something I don&#x27;t fully understand and I still need to investigate a bit further.</p><h3>Conclusion</h3><p>As it always happens when new technologies appear, it takes some time to get used to them, but I strongly suggest you to give a try to swoole or any other non-blocking runtime, because it makes your apps super fast.</p><p>Just remember to have all of the above in mind ;-)</p><p>That said, here you can find some libraries that will make your life easier when trying to serve existing projects with swoole, without having to couple with it and being able to continue using your favourite framework:</p><ul><li>IDE helper: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swoft-cloud/swoole-ide-helper">https://github.com/swoft-cloud/swoole-ide-helper</a></li><li>Mezzio (formerly Zend Expressive): <a target="_blank" rel="noopener noreferrer" href="https://github.com/mezzio/mezzio-swoole">https://github.com/mezzio/mezzio-swoole</a></li><li>Symfony: <a target="_blank" rel="noopener noreferrer" href="https://github.com/k911/swoole-bundle">https://github.com/k911/swoole-bundle</a></li><li>Laravel: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swooletw/laravel-swoole">https://github.com/swooletw/laravel-swoole</a></li></ul><p>Also, here you can find some more articles talking about this topic:</p><ul><li><a target="_blank" rel="noopener noreferrer" href="https://www.zend.com/blog/why-you-should-use-asynchronous-php">https://www.zend.com/blog/why-you-should-use-asynchronous-php</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/">https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/</a></li></ul>

Considerations when working with async PHP runtimes like swoole

<p>Some of you probably know that I have a pet project in which I like to work from time to time. This project is a self-hosted URL shortener called <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">Shlink</a>.</p><p>Shlink is built using expressive as the base framework for the HTTP-dispatching task. A while ago, an expressive module was released to officially support serving expressive apps with <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/">swoole</a>, and I decided to include it on Shlink.</p><h3>How does swoole work?</h3><p>Swoole is an asynchronous non-blocking I/O framework which works in a similar way as node.js, but for PHP apps.</p><p>It has been conceived in a way that the app stays in memory between requests, removing the bootstrapping step and making apps to be served much faster.</p><p>Swoole can serve as many simultaneous requests as you tell it to. For this it makes use of workers. Each worker can serve one request at a time, and every worker has a separate instance of the app loaded in memory (this is something I <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/dominikzogg/status/1189403552399134720">learned recently</a>).</p><p>Because of this, you have to sometimes change a bit the way you design your code. For example, if a service needs to be stateful (it shouldn&#x27;t, but shit happens), you will have to remember that the state will persist between requests, and you will want to somehow reset it to avoid unexpected side effects.</p><h3>How does this affect the EntityManager?</h3><p>One of the main services that keeps this internal state in Shlink is the doctrine <a target="_blank" rel="noopener noreferrer" href="https://www.doctrine-project.org/projects/doctrine-orm/en/current/tutorials/getting-started.html#obtaining-the-entitymanager">EntityManager</a>.</p><p>Due to the fact that it was originally designed to be used on a classical web server + CGI context, assuming it would be recreated on every request, there are a few considerations to take into account:</p><ul><li>It implements the unit of work pattern. It internally keeps track of all the entities that have been created/changed until you decide to flush it.</li><li>If something fails, the <code>EntityManager</code> can get closed, which makes it unusable after that moment.</li><li>If the database connection expires, the <code>EntityManager</code> will not gracefully recover. Instead, it will fail, since it&#x27;s not aware of the connection not being usable, getting yourself in previous point.</li></ul><h3>How to workaround it</h3><p>I learned about these issues by try and error, by using it on the app and getting the failures. Now, I want to share how I workaround those issues.</p><p>The first one I faced was the one making the app unusable after the <code>EntityManager</code> was closed. In order to solve this I created a decorated instance (naming, an object implementing <code>EntityManagerInterface</code> which in turn was wrapping an actual <code>EntityManager</code>), which was making sure the wrapped instance was transparently recreated if at some point it was closed.</p><p>However, this caused some side effects, and I finally realized that it was better to make the <code>EntityManager</code> to have to be reopened from the outside, and only once per request (this is closer to how it would behave on a classical set-up).</p><p>That&#x27;s how I came up with the <code>ReopeningEntityManager</code> Shlink is currently using (as of v1.20.0):</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Doctrine;

use Doctrine\ORM\Decorator\EntityManagerDecorator;

class ReopeningEntityManager extends EntityManagerDecorator
{
    /** @var callable */
    private $createEm;

    public function __construct(callable $createEm)
    {
        parent::__construct($createEm());
        $this-&gt;createEm = $createEm;
    }

    public function open(): void
    {
        if (! $this-&gt;wrapped-&gt;isOpen()) {
            $this-&gt;wrapped = ($this-&gt;createEm)();
        }
    }
}
</code></pre></pre><blockquote><p>You can find the actual code in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Doctrine/ReopeningEntityManager.php">shlink-common</a>.</p></blockquote><p>It just expects a factory that creates the actual <code>EntityManager</code>, and exposes an <code>open</code> public method which re-creates the wrapped instance if closed.</p><p>This method is called from a <a target="_blank" rel="noopener noreferrer" href="https://www.php-fig.org/psr/psr-15/">PSR-15</a> middleware which needs to be registered early in the middleware pipeline. It makes sure the method is called before the next middleware on the stack is invoked:</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Shlinkio\Shlink\Common\Doctrine\ReopeningEntityManager;

class CloseDbConnectionMiddleware implements MiddlewareInterface
{
    /** @var ReopeningEntityManager */
    private $em;

    public function __construct(ReopeningEntityManager $em)
    {
        $this-&gt;em = $em;
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $this-&gt;em-&gt;open();

        try {
            return $handler-&gt;handle($request);
        } finally {
            $this-&gt;em-&gt;getConnection()-&gt;close();
            $this-&gt;em-&gt;clear();
        }
    }
}
</code></pre></pre><blockquote><p>Again, the code can be found in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Middleware/CloseDbConnectionMiddleware.php">shlink-common</a></p></blockquote><p>This middleware also does two more things (this time, after calling the next middleware on the stack, and making sure it does it even if an exception is thrown).</p><ul><li>It first closes the database connection. By doing it so, we make sure the <code>EntityManager</code> will reconnect the next time it needs to interact with the database, and therefore, we avoid the &quot;expired connection&quot; issue.</li><li>Then it clears the <code>EntityManager</code> itself. This avoids memory leaks, and also prevents that any orphan/non-flushed entity &quot;transcends&quot; to the next request, solving the first problem.</li></ul><h3>Further considerations</h3><p>This approach has been working well so far, but it&#x27;s important to assume that the <code>EntityManager</code> was not really designed for this non-blocking kind of context.</p><p>You need to know that the worker making use of it will not be able to serve any request until the <code>EntityManager</code> finishes its job. Because of this you might want to increase the number of swoole workers.</p><p>Also, closing the DB connection on every request is not the most optimal approach. It would be perfect to have a connection pool that was able to recreate connections when expired, and to keep them open as long as possible for faster operations. However, the <code>EntityManager</code> was not designed for that, so it&#x27;s better to close it.</p><p>You also need a <code>callable</code> to pass to the <code>ReopeningEntityManager</code>. The way you solve this depends on your implementation and the dependencies you use.</p><p>In my case, in Shlink I make use of the <code>ServiceManager</code>, so I have a delegator factory which takes the actual factory and passes it to the <code>ReopeningEntityManager</code>:</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Doctrine;

use Psr\Container\ContainerInterface;

class ReopeningEntityManagerDelegator
{
    public function __invoke(ContainerInterface $container, string $name, callable $createEm): ReopeningEntityManager
    {
        return new ReopeningEntityManager($createEm);
    }
}
</code></pre></pre><blockquote><p>You can find the actual code in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Doctrine/ReopeningEntityManagerDelegator.php">shlink-common</a>.</p></blockquote><h3>Conclusion</h3><p>I wanted to write this article as a recap for myself too, since I had to ask and investigate many times, and I couldn&#x27;t find a single source of truth explaining everything.</p><p>I hope that, if you ended up here, this article served you well.</p>

How to properly handle a doctrine entity manager on an expressive application served with swoole

<p>For a long time, I have been trying to include tests in every project in which I&#x27;ve worked on.</p><p>There are several types of automated tests (or what should actually be called <a target="_blank" rel="noopener noreferrer" href="https://abstracta.us/insights/guide-continuous-testing/automated-checks">automated checks</a>). From unit tests, integration and functional tests, to end-to-end tests.</p><p>Each one of them differs from the rest by the scope they try to cover. From small units of code which are tested completely detached from external dependencies, to a whole app which is tested as a black box like if an end consumer was using it.</p><p>I&#x27;m not going to deeply discuss the semantics behind this, or where an integration test ends and an end-to-end test starts, because it&#x27;s quite frequently a blurry line.</p><p>I want to focus on unit tests, and a frequently used practice (even in my own tests), which I have read (and felt) several times, it might not be the best approach.</p><blockquote><p>This article is not focused on any particular technology, since I have found this in a lot of different projects.</p></blockquote><h3>What&#x27;s a unit test</h3><p>According to <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Unit_testing">Wikipedia</a>, unit testing is a &quot;method by which individual units of source code [...] are tested to determine whether they are fit for use&quot;.</p><p>While this might look like a clear definition, it&#x27;s actually quite open because, what&#x27;s a &quot;unit&quot; in the context of unit testing?</p><p>Very often, in object oriented programming projects, people take a class as a unit to test, and create a unit test for every class. In other paradigms, like functional programming, you might consider a function as the unit to be tested, or a set of functions which you have decided to put together in a module.</p><p>This is not really important for the purpose of this article. What&#x27;s really important is to take into account that, in order to properly &quot;unit test&quot; a &quot;unit of source code&quot;, you have to do it by isolating it from any dependency of that unit.</p><p>One of the better ways to achieve this is by following the <strong><a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Dependency_inversion_principle">Dependency Injection Principle</a></strong>. Without it you will probably end up trying to hack yourself in order to detach a &quot;unit&quot; from its dependencies.</p><blockquote><p>You can find other articles about <a href="/tag/dependency-injection/">Dependency Injection</a> in my blog.</p></blockquote><h3>Replacing dependencies</h3><p>A very frequent practice when unit testing a unit of source code is to replace its dependencies with <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Test_double">test doubles</a>, in order to properly isolate every unit when testing it.</p><p>Test doubles are basically objects compatible with the dependencies of the subject under test, that are created just for the purpose of the test and have some useful capabilities, like capturing how they have been called, or what should they return when called.</p><p>When you use one of those test doubles to assert how they were called as part of the test itself, you are using them as &quot;spies&quot;.</p><h3>Over-trusting spies</h3><p>All this introduction and contextualization had a single purpose.</p><p>I find myself (and others) in the situation in which you prepare a test double to behave in a certain way, then you call your subject under test, and then assert that your expectations on how the test double was called are correct, by spying on it.</p><p>This sometimes feels wrong, since it seems you are testing the test double/s instead of the subject under test.</p><p>I have read many times that, in a unit test, we should not actually know the internal implementation of the subject under test, but only test that, based on certain input, the expected output is returned (so, trust its public API).</p><p>However, there are cases in which some function/method does not really have any output, and we can only verify everything is going right by spying on the test doubles.</p><p>So, at the end of the day, I have mixed feelings about this practice.</p><h3>Conclusion</h3><p>Sadly, I cannot state a clear conclusion. This is actually an open article, and I would love to get your point of view in the form of a <a href="#comments-box">comment</a>.</p><p>It would be great to see how others face this, if you use other kinds of test doubles instead of spies, or if you are just ok with the implications.</p>

Is spying on mocks a bad practice for unit tests?

<p>Some of you know that I work now as a full stack javascript developer, and I have interacted with a few different projects, both in front-end javascript and in nodejs.</p><p>My main concern about javascript has been that, apparently, the community has not adopted one of the practices that, for me, has been the most game changing of all: <strong>Dependency Injection</strong>.</p><blockquote><p>Take into account that this is my relative point of view, from a community which is still quite new to me, so if you find that something I say makes no sense at all, you are more than welcome to <a href="#comments-box">leave a comment</a>.</p></blockquote><h3>Current state of DI in JS</h3><p>At the moment of writing this article, I have made some research, and my feeling is that only very strict object-oriented projects based on <code>Typescript</code> introduce the concept of Dependency Injection.</p><p>Frameworks like <a target="_blank" rel="noopener noreferrer" href="https://angular.io/"><code>Angular</code></a> and <a target="_blank" rel="noopener noreferrer" href="https://nestjs.com/"><code>NestJS</code></a> include dependency injection containers which allow us solving the dependency injection problem in a more than decent way.</p><p>However, these solutions force us to write a code which feels too coupled with the framework.</p><p>I have also found what seems to be a pretty popular framework-agnostic dependency injection container, <a target="_blank" rel="noopener noreferrer" href="http://inversify.io/"><code>InversifyJS</code></a>, which again, seems to be more <code>Typescript</code> oriented (despite the fact that it says it&#x27;s for plain javascript as well).</p><p>From my point of view, the main problem with this one is that its too complex to get it up and running, which makes people get tired of even trying dependency injection.</p><p>Other than this, I have not seen much adoption in plain javascript projects (maybe more functional than object-oriented), where developers just import or require the dependencies to be used from other modules and use them, which couples the code and makes it really hard to test (at least unit test).</p><h3>Good dependency injection</h3><p>I want to start by trying to define how I feel dependency injection should be done, so that it&#x27;s flexible and useful, and not scary to use:</p><ul><li><p>We should be able to write code in javascript modules in a way we don&#x27;t care where our dependencies come from, or how are they going to be created.</p><p>  I have seen some attempts in which dependencies are imported or required in the code, but then the module exports some way to override the dependency at runtime (with the intention to do it in tests).</p><p>  This is a sort of working approach, but it feels a little bit hacky. It&#x27;s also always importing external code which could have other side effects.</p></li><li><p>We should never be forced to couple our own code with the dependency injection framework. At some point we could want to change the implementation, and that shouldn&#x27;t make us change our code.</p></li><li><p>The dependency injection container (which is the object which encapsulates how dependencies are created and injected into objects, <strong>DIC</strong> from now on), should never leak into our code.</p><p>  It belongs to bootstrapping scripts only. It is also acceptable to get it in code which only purpose is creating objects in the context of dependency injection itself.</p><p>  By importing or requiring the DIC inside modules, we are hiding the module&#x27;s dependencies, and ending up with the ugly service locator anti pattern.</p></li><li><p>Configuring the DIC should always be an easy task. We should be able to just provide simple configuration or simple factories for corner cases in which a basic config is not enough.</p><p>  When the DIC is hard to configure or too feature-bloated, people end up with the feeling that dependency injection is not worth it.</p></li><li><p>The DIC should be able to recursively resolve dependencies. We shouldn&#x27;t need to know what are the dependencies of our dependencies. When creating an object, it should be enough to just pull its direct dependencies from the container, and it should know how to recursively resolve the rest.</p></li></ul><p>With all this in mind, I have created a proof of concept <a target="_blank" rel="noopener noreferrer" href="https://expressjs.com/"><code>express.js</code></a>-based project which makes use of a very simple custom DIC to solve dependency injection.</p><p>You can find the project <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/dependency-injection-container-js">here</a>.</p><h3>Explaining the proof of concept</h3><p>The project is pretty simple. You can just clone it and then run <code>npm install &amp;&amp; node server.js</code>. It will serve the app in <a target="_blank" rel="noopener noreferrer" href="http://localhost:3000">localhost:3000</a>.</p><p>The default path just displays a &quot;Hello World&quot; message, and it has a second <a target="_blank" rel="noopener noreferrer" href="http://localhost:3000/users">/users</a> path which returns a JSON response where some data is dynamically generated. You can refresh the page in order to see it.</p><p>The main characteristic of this project is that, if you open any of the files in <code>controllers</code> or <code>services</code>, you&#x27;ll see they don&#x27;t import or require anything.</p><p>Instead they just expose a builder function (or factory function, or construction function, or whatever you want to name it), which in turn returns the actual object which is going to be used at runtime (remember that, in javascript, functions are first-class objects).</p><p>Let&#x27;s take the <code>listUsersController</code> as an example:</p><pre><pre><code class="language-js">const listUsersController = getUsers =&gt; (req, res, next) =&gt; {
    const users = getUsers();
    res.send(JSON.stringify(users));
};

module.exports = listUsersController;
</code></pre></pre><p>What this module exports is a function where a dependency has to be injected. However, when implementing the controller, we don&#x27;t care where it is going to come from. We just expose the fact that the controller needs that <code>getUsers</code> dependency in order to properly work.</p><p>When that function is called with the dependency, it will return the actual controller (a simple express middleware).</p><p>The only place where actual modules are imported is the <code>config/services.js</code> file, which is a simple map where we basically define which are the dependencies for every object.</p><pre><pre><code class="language-js">const homeControllerFactory = require(&#x27;../controllers/homeController&#x27;);
const listUsersControllerFactory = require(&#x27;../controllers/listUsersController&#x27;);

const utils = require(&#x27;../services/utils&#x27;);
const getUsersFactory = require(&#x27;../services/getUsers&#x27;);

const services = {
    mainController: container =&gt; homeControllerFactory(),
    listUsersController: container =&gt; {
        const getUsers = container.get(&#x27;getUsers&#x27;);
        return listUsersControllerFactory(getUsers);
    },

    utilsService: container =&gt; utils,
    getUsers: container =&gt; {
        const utils = container.get(&#x27;utilsService&#x27;);
        return getUsersFactory(utils);
    }
};

module.exports = services;
</code></pre></pre><p>This file only defines how the builder/creator/factory functions for every object have to be invoked, by first pulling their direct dependencies from the container, if any.</p><p>This file is then imported in the <code>server.js</code> file, which is our entry point. Together with the <code>container/container.js</code> file, they make a super basic dependency injection container.</p><p>Since this DIC is capable of recursively resolving dependencies, our <code>server.js</code> file is the only place where we manually pull objects from the container (the controllers in this case).</p><pre><pre><code class="language-js">const express = require(&#x27;express&#x27;);
const services = require(&#x27;./config/services&#x27;);
const container = require(&#x27;./container/cotainer&#x27;)(services);

const app = express();
const port = 3000;

// We pull the controllers from the container here
app.get(&#x27;/&#x27;, container.get(&#x27;mainController&#x27;));
app.get(&#x27;/users&#x27;, container.get(&#x27;listUsersController&#x27;));

app.listen(port, () =&gt; console.log(`Example app listening on port ${port}!`));
</code></pre></pre><h3>Evolving the proof of concept</h3><p>We have defined a pretty simple approach where we have been able to fulfil all the requirements for a good dependency injection.</p><p>The code is easy to maintain, completely decoupled from the container and from other modules, and registering objects just takes two or three lines of code.</p><p>The main problem is that we are now forced to maintain a too basic DIC which also lacks some basic features, like lazy loading or avoiding the same service to be created more than once.</p><p>In order to solve that, we are going to introduce a project dependency on the <a target="_blank" rel="noopener noreferrer" href="https://github.com/young-steveo/bottlejs"><code>BottleJS</code></a> package, which is a dependency injection <em>micro</em> container.</p><p>Thanks to that package, we can evolve and merge our <code>config/services.js</code> and <code>container/container.js</code> files into a single one which looks like this:</p><pre><pre><code class="language-js">const Bottle = require(&#x27;bottlejs&#x27;);
 
const homeControllerFactory = require(&#x27;../controllers/homeController&#x27;);
const listUsersControllerFactory = require(&#x27;../controllers/listUsersController&#x27;);

const utils = require(&#x27;../services/utils&#x27;);
const getUsersFactory = require(&#x27;../services/getUsers&#x27;);

const bottle = new Bottle();

bottle.constant(&#x27;utilsService&#x27;, utils);
bottle.serviceFactory(&#x27;getUsers&#x27;, getUsersFactory, &#x27;utilsService&#x27;);

bottle.serviceFactory(&#x27;mainController&#x27;, homeControllerFactory);
bottle.serviceFactory(&#x27;listUsersController&#x27;, listUsersControllerFactory, &#x27;getUsers&#x27;);

module.exports = bottle.container;
</code></pre></pre><p>It&#x27;s basically the same, but this time, we just need to pass the list of dependencies for every object by its name to a <code>Bottle</code> instance, and then export the bottle container.</p><p>This container has also a few interesting extra features which might be handy in larger projects.</p><blockquote><p>The amount of stars in this package makes me think that maybe my previous conclusion was wrong, and dependency injection is more extended in javascript projects than I thought.</p></blockquote><p>You can find the whole proof of concept project using <code>BottleJS</code> in the same repository, under the <code>with-bottle</code> branch, <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/dependency-injection-container-js/tree/with-bottle">here</a>.</p><h3>Conclusion</h3><p>My conclusion is that dependency injection in plain javascript and even non object-oriented projects is, not only possible, but desirable.</p><p>Having a really decoupled codebase, where true <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Dependency_inversion_principle">dependency inversion</a> is achieved thanks to dependency injection, will make our projects much easier to maintain in the long term, and easier to unit test.</p><blockquote><p>I have not covered other scenarios in this article, like front-end application with <a target="_blank" rel="noopener noreferrer" href="https://reactjs.org/">ReactJS</a> or <a target="_blank" rel="noopener noreferrer" href="https://vuejs.org/">VueJS</a>. I will try to do it in the future, when I have become wiser :P</p></blockquote><blockquote><p><strong>Update 2018-12-16:</strong> I have found an article where <a target="_blank" rel="noopener noreferrer" href="https://medium.com/@magnusjt">Magnus Tovslid</a> proposes a very similar approach but for ReactJS and Redux front-end applications. Take a look at it, it&#x27;s very interesting. <a target="_blank" rel="noopener noreferrer" href="https://medium.com/@magnusjt/inversion-of-control-and-di-in-reactjs-and-redux-35161fcef847">Inversion of Control and DI in Reactjs and Redux</a></p></blockquote>

Dependency injection in nodejs projects

<p>I&#x27;m sure you are familiar with those &quot;remember me&quot; checkboxes in login forms. They are a common way to allow a user to keep his/her session in a web application for an extended period of time when he is in a trusted computer.</p><p>One could think that it is a small and easy-to-implement feature, but it has indeed a lot of considerations.</p><p>I wasn&#x27;t able to properly implement it in the first projects I worked in, and I&#x27;m trying to explain everything I&#x27;ve learned about it in the last years.</p><blockquote><p>In this article I&#x27;m not going to show you how to implement a persistent login in one or another programming language, but what are the good practices that should be followed when you implement it in the way you want.</p></blockquote><h3>First thoughts.</h3><p>The first thing that one could try is to extend the lifetime of the system that persists the session and identifies the user between requests (usually a cookie). </p><p>The problem is that many systems doesn&#x27;t allow to do that in an isolated way, you are forced to extend the lifetime of all sessions. Also, it is not always easy to change the session lifetime dynamically.</p><p>So it&#x27;s not a good idea, because the user could be accessing your app from a public computer, and his session could be stolen if he forgets to logout. </p><p>Because of this, the best way to do it is to have another element (another cookie) that keeps the persistent session and is used to transparently regenerate the regular session when it expires.</p><h3>How to implement it.</h3><p>When a user logs in and he has checked the &quot;remember me&quot; field, you will create a cookie with an extended lifetime (for example, 2 weeks).</p><p>That cookie will contain a unique token that will identify a user. It should be backed in the database by creating a table that relates the token with a user. It could contain other metadata too, like the client&#x27;s IP address or a flag that says if the session is still valid.</p><p>In consecutive requests, your system will keep checking if an authenticated user exists, but if not, instead of redirecting to a login or returning a 403 status, it should check for the persistent login cookie first.</p><p>When that cookie exists, you will find the user it belongs to, and authenticate him. Then, you will invalidate the cookie and the session in the database, and generate a new one that will expire in the same date as the previous one. Finally, the new token should be returned in a new persistent login cookie that will replace the previous one by having the same name.</p><p>When the user manually logs out, the persistent login cookie should be dropped too.</p><h3>Security considerations</h3><p>Now you have a basic idea on how to implement it, but there are some security considerations to take into account in order to avoid problems in the future.</p><p>The first thing that we have to assume is that persistent sessions have their risks. There is no way to implement a completely secure persistent login, but following this instructions the system will be reasonably secure.</p><ul><li>Persistent login will be handled by a cookie in the client and a database in the server (or a similar persistence system).</li><li>Persistent sessions will have an expiration time, for example 2 weeks. During that time, any regular session will be regenerated by the persistent session. Once it has passed, the user will be prompted to provide his credentials when the regular session expires. The expiration time will be set both in the cookie and in the database.</li><li>Persistent login cookies will contain one-time tokens. Once a token has been used it will be invalidated and a new one will be generated.</li><li>In order to protect these tokens from <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Cross-site_scripting">XSS</a> attacks in the site, persistent login cookies should be <code>HttpOnly</code>, so that they cannot be read from the browser.</li><li>Multiple valid persistent sessions will be allowed.</li><li>When a user logs out, its current persistent session in the database and the persistent login cookie will be invalidated.</li><li>The user should be able to invalidate all the persistent sessions that are still valid.</li><li>Invalid persistent sessions won&#x27;t be deleted. This way, if the user tries to access with an invalid cookie, he will be notified of a possible stolen cookie, and immediately all the other persistent sessions will be invalidated.</li><li>When the user changes his/her password, all the persistent sessions should be invalidated.</li><li>The token needs to be unique. Just generate some hash including the date and some other field. It doesn&#x27;t need to be super secure, but make sure to not send critical information to the client (like usernames or passwords).</li><li>And finally, there should be some operations restricted to users whose regular session has been regenerated by a persistent session, like changing a password or performing some kind of payment. In those cases, the user should be prompted for his current password anyway.</li></ul><p>Of course, if your system manages critical data, you shouldn&#x27;t implement persistent login at all. I don&#x27;t think you have seen it at any bank application.</p><p>In any other case, this should be a good way to go.</p>

How to properly implement persistent login

<p>We are all very used to file uploads in plenty of web applications. From simple image uploads to a social network to multiple file uploads to file management applications like Dropbox.</p><p>On this article I&#x27;m going to explain how to handle asynchronous multifile uploads from a jQuery powered front-end to a Zend Framework 2 back-end, including HTML5 upload progress and file validation (type, size, and such).</p><p>You will need a modern browser to do this, since asynchronous file uploads are not supported by old browsers. </p><h3>Installing example project</h3><p>I have created a project which is fully functional. I&#x27;m going to use it across this article so feel free to clone it from here <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/file-uploads">https://github.com/acelaya-blog/file-uploads</a>.</p><blockquote><p>Notice that I&#x27;ve simplified the usual Zend Framework 2 project structure. It&#x27;s enough for this example, but maybe difficult to maintain if your project grows, so better use the <a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/ZendSkeletonApplication">Skeleton Application</a> structure in real applications.</p></blockquote><p>Once you have it, open a terminal, go to the directory and run <code>php composer.phar selfupdate &amp;&amp; php composer.phar install</code>.</p><p>Finally start the PHP built-in web server by running <code>cd public &amp;&amp; php -S localhost:8000</code>. Access to <a target="_blank" rel="noopener noreferrer" href="http://localhost:8000">localhost:8000</a> in order to see the application.</p><h3>The front-end</h3><p>I assume you are familiar with file uploads in web environments. All we need is a file input with the attribute multiple, wrapped inside a form with enctype multipart/form-data. This will make the browser to send files to the server.</p><pre><pre><code class="language-html">&lt;form name=&quot;uploadFiles&quot; id=&quot;uploadFiles&quot; method=&quot;post&quot;
      action=&quot;/upload-files&quot; enctype=&quot;multipart/form-data&quot;&gt;
    &lt;input type=&quot;file&quot; name=&quot;files[]&quot; multiple&gt;
    &lt;button type=&quot;submit&quot; className=&quot;btn btn-primary&quot;&gt;Upload files&lt;/button&gt;
&lt;/form&gt;
</code></pre></pre><p>It&#x27;s important to add brackets to the name attribute in the file input, so that the content is treated like an array and the server can properly manage all the files.</p><p>In this example I captured the form submit with javascript event handlers so that we can track the progress of the upload. It&#x27;s been set in <code>public/js/main.js</code>. In the <code>acelaya.uploadFiles</code> function I have defined what has to be done when the form is sent.</p><pre><pre><code class="language-javascript">// [..]

uploadFiles: function ($form) {
    var action = $form.attr(&#x27;action&#x27;),
        method = $form.attr(&#x27;method&#x27;);

    $.ajax({
        url: action,
        type: method,
        data: new FormData($form[0]),
        cache: false,
        contentType: false,
        processData: false,
        xhr: function () {
            // This will make the ajax request to use a custom XHR object which will handle the progress
            var myXhr = $.ajaxSettings.xhr();
            if (myXhr.upload) {
                var progressBar = acelaya.createProgressBar($form);

                // Add progress event handler
                myXhr.upload.addEventListener(&#x27;progress&#x27;, function(e) {
                    acelaya.handleUploadProgress(e, progressBar);
                }, false);
                myXhr.upload.addEventListener(&#x27;load&#x27;, function() {
                    // Firefox does not trigger the &#x27;progress&#x27; event when upload is 100%.
                    // This forces progress to end when upload is successful
                    progressBar.find(&#x27;.progress-bar&#x27;).css({width : &#x27;100%&#x27;});
                }, false);
            }

            return myXhr;
        }
    }).done(function (resp) {
        if (resp.code === &#x27;success&#x27;) {
            acelaya.refreshFilesList();
        } else {
            $form.after(
                &#x27;&lt;div className=&quot;alert alert-danger alert-dismissable&quot; style=&quot;margin-top: 20px&quot;&gt;&#x27; +
                    &#x27;&lt;button type=&quot;button&quot; className=&quot;close&quot; data-dismiss=&quot;alert&quot;&gt;&lt;span&gt;&amp;times;&lt;/span&gt;&lt;/button&gt;&#x27; +
                    &#x27;&lt;div&gt;An error occurred with uploaded files&lt;/div&gt;&#x27; +
                &#x27;&lt;/div&gt;&#x27;
            )
        }
    });
},

// [..]
</code></pre></pre><p>If you are familiar with <code>jQuery</code> you have probably used the <code>ajax</code> method.</p><p>In this case I&#x27;ve used the HTML5 <code>FormData</code> object to encapsulate the form element. This way any information on it will be serialized and sent to the server asynchronously, including files.</p><p>By default the <code>ajax</code> method creates a <code>jqXHR</code> object (a wrapper of the native <code>XMLHttpRequest</code> object) with default behavior, but we need to extend that behavior, so we have to create a new one which will handle the upload progress too.</p><p>What we do is to add a <code>progress</code> event listener which will increase a <a target="_blank" rel="noopener noreferrer" href="https://getbootstrap.com/components/#progress">bootstrap styled</a> progress bar as long as the content is sent to the server. The method <code>acelaya.createProgressBar</code> will create that progress bar and add it to the DOM.</p><pre><pre><code class="language-javascript">handleUploadProgress: function (e, progressBar) {
    if (! e.lengthComputable) {
        return;
    }

    var percent = e.total &gt; 0 ? e.loaded * 100 / e.total : 100;
    progressBar.find(&#x27;.progress-bar&#x27;).css({width : percent + &#x27;%&#x27;});
    progressBar.find(&#x27;.progress-bar&#x27;).text(parseInt(percent) + &#x27;%&#x27;);
},
</code></pre></pre><p>The method attached to the <code>progress</code> listener will be called by the browser for every chunk of data sent to the server. The number of times it is called dependes on the browser. For example, Firefox will call it more frequently than Chrome.</p><p>The event object contains the total size of the data and the size that has been already sent, but also it has a boolean property lengthComputable that tells if size could be calculated.</p><p>In the method <code>acelaya.handleUploadProgress</code> we calculate the percentage of the data that has been sent to display it in the progress bar.</p><blockquote><p>When you test this application, make sure to use big files, at least 1 GB in total, since you are going to &quot;upload&quot; them to your local machine, which is pretty fast. I already managed the server side to allow up to 1.5GB of POST data.</p></blockquote><p>Once files are uploaded, if the server returns a success response, we refresh the list of files, otherwise an error message is displayed.</p><p>And this is everything for the front-end, but this is not enough to make a usable application since files uplaoded will be discarded at the end of the request if the server does nothing with them.</p><h3>The back-end</h3><p>Zend Framework 2 has some mechanisms to deal with uploaded files. Once we have defined our routes and controllers, we have to get those files and move them to its final location, which is pretty simple with the <code>Params</code> controller plugin.</p><pre><pre><code class="language-php">public function uploadAction()
{
    $files = $this-&gt;params()-&gt;fromFiles(&#x27;files&#x27;);
    $code = $this-&gt;filesService-&gt;persistFiles($files);
    return new JsonModel([
        &#x27;code&#x27; =&gt; $code
    ]);
}
</code></pre></pre><p>I have created a FilesService (<code>src/Service/FilesService.php</code> in the project) which gets injected in the controller to handle operations with files. In this case I call the method <code>persistFiles</code>, which should store the files in a folder and return a status code which is in turn returned to the client in a JSON response. This is what the method <code>persistFiles</code> does.</p><pre><pre><code class="language-php">public function persistFiles(array $files)
{
    foreach ($files as $file) {
        move_uploaded_file($file[&#x27;tmp_name&#x27;], $this-&gt;options-&gt;getBasePath() . &#x27;/&#x27; . $file[&#x27;name&#x27;]);
    }
    return self::CODE_SUCCESS;
}
</code></pre></pre><p>As you can see, it is pretty simple. It just iterates the list of files and performs a <code>move_uploaded_file</code> over each one of them. The options object wrapps the base path, which can be set at <code>config/config.php</code> by changing the <code>files.base_path</code> directive, and it is the <code>files</code> directory by default.</p><p>This is functional, but we could need to validate something, like filesizes, mimetypes and such. We could even want to apply a hash to ensure an uploaded file&#x27;s integrity or check an uploaded image resolution.</p><p>Zend Framework 2 comes with a full set of file validators that we can use on this example. </p><h3>Filtering and validation</h3><p>Let&#x27;s imagine we don&#x27;t want to allow files greater than 1.5GB (which is actually the maximum I&#x27;ve set by php configuration, but they don&#x27;t need to coincide) and that a file with the same name doesn&#x27;t exist yet. We are also going to ensure the file has been uploaded.</p><p>We need now to define an <code>InputFilter</code> object that the <code>FileService</code> will apply to all the files. If any one of them fails validation, an error will be returned.</p><pre><pre><code class="language-php">&lt;?php
namespace Acelaya\Files;

use Zend\Filter\File\RenameUpload;
use Zend\InputFilter\FileInput;
use Zend\InputFilter\InputFilter;
use Zend\Validator\File\Size;

class FilesInputFilter extends InputFilter
{
    const FILE = &#x27;file&#x27;;

    public function __construct(FilesOptions $options)
    {
        $input = new FileInput(self::FILE);
        $input-&gt;getValidatorChain()-&gt;attach(new Size([&#x27;max&#x27; =&gt; $options-&gt;getMaxSize()]));
        $input-&gt;getFilterChain()-&gt;attach(new RenameUpload([
            &#x27;overwrite&#x27;         =&gt; false,
            &#x27;use_upload_name&#x27;   =&gt; true,
            &#x27;target&#x27;            =&gt; $options-&gt;getBasePath()
        ]));

        $this-&gt;add($input);
    }
}
</code></pre></pre><p>This filter will check each file has a file size no greater than what we defined in our configuration by using the <code>Size</code> validator.</p><p>Also, the <code>RenameUpload</code> filter will try to move the file to our previously defined base path by calling the <code>move_uploaded_file</code> function, which will only work with uploaded files, and throw an exception if we try to override an existing file.</p><p>We just need to adapt our <code>FilesService::persistFiles</code> method to use this <code>InputFilter</code>.</p><pre><pre><code class="language-php">public function persistFiles(array $files)
{
    foreach ($files as $file) {
        $filter = clone $this-&gt;getInputFilter();
        $filter-&gt;setData([FilesInputFilter::FILE =&gt; $file]);
        try {
            if (! $filter-&gt;isValid()) {
                return self::CODE_ERROR;
            }
            $data = $filter-&gt;getValues();
        } catch (InvalidArgumentException $e) {
            return self::CODE_ERROR;
        }
    }
    return self::CODE_SUCCESS;
}
</code></pre></pre><p>The <code>getInputFilter()</code> method returns an instance of our <code>FilesInputFilter</code>. After that we apply validation and if no exception is thrown and the method <code>isValid()</code> returns true, then everything worked and we can continue with the next file. If an error occurred we return the ERROR code.</p><p>It is <strong>important</strong> to call <code>$filter-&gt;getValues()</code> even if we are not going to use them, because that is what makes the function <code>move_uploaded_file</code> to be called, otherwise we won&#x27;t get the files moved to their final directory.</p><p>Now the application keeps working, but our uploaded files are filtered and validated.</p><p>Zend Framework 2 has other <a target="_blank" rel="noopener noreferrer" href="https://zf2.readthedocs.org/en/latest/modules/zend.filter.file.html">filters</a> and <a target="_blank" rel="noopener noreferrer" href="http://zf2.readthedocs.org/en/latest/modules/zend.validator.file.html">validators</a> you can use with files. Take a look at them.</p><p>And this is it. We have our fully functional file uploading application.</p>

File uploads with Zend Framework 2 and jQuery

<p>The <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/HTML5">HTML5</a> specification is in process to be a standard. New features are being included but some of them are already supported by major modern browsers.</p><p>One of those features is a group of new HTML tag attributes, really useful to solve situations that used to be fixed by using javascript.</p><h3>Autofocus</h3><p>This attribute makes an element to gain focus once te page has been loaded. Can be used with either an <code>input</code>, a <code>textarea</code> or a <code>button</code></p><p>This is a boolean attribute, which means any value assigned to it is a valid value, it only needs to be present. Also, HTML5 specifications allows attributes without values, so it would be only necessary to attach the attribute to the element.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;input type=&quot;text&quot; autofocus&gt;
&lt;textarea autofocus&gt;&lt;/textarea&gt;
&lt;button type=&quot;submit&quot; autofocus&gt;Send&lt;/button&gt;
</code></pre></pre><p>In a page there should be only one element with this attribute, but the last one will gain focus if more than one is present.</p><p>This attribute is supported by Google Chrome, Mozilla Firefox, Safari and Internet Explorer 10+.</p><h3>Placeholder</h3><p>The placeholder attribute allows us to define a helper text or default value in text input elements, dropping that value at the moment the user starts writing on the element, and displaying it again once the element gets an empty value. It can be used in both <code>&lt;input&gt;</code> and <code>&lt;textarea&gt;</code>.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;input type=&quot;text&quot; placeholder=&quot;Name&quot;&gt;
&lt;input type=&quot;email&quot; placeholder=&quot;Email address&quot;&gt;
&lt;input type=&quot;password&quot; placeholder=&quot;Enter password&quot;&gt;
&lt;textarea placeholder=&quot;Comments&quot;&gt;&lt;/textarea&gt;
</code></pre></pre><p>This attribute is very useful in <code>&lt;input[type=password]&gt;</code> elements, where the placeholder value will be displayed despite that the user input will be hidden.</p><p>Internet Explorer 10+, Google Chrome, Mozilla Firefox, Safari and Opera do support this attribute.</p><p><strong>Example:</strong></p><input type="password" placeholder="Enter your password" class="form-control"/><h3>Spellcheck</h3><p>Nowadays, many browsers include dictionaries that allows us to see spelling errors in real time.</p><p>With spellcheck attribute we can define if certain element should use this feature or we want to disable it. It can be used in both <code>&lt;input&gt;</code> and <code>&lt;textarea&gt;</code></p><p>Spellcheck accepts values true to enable the feature and false to disable it.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;input type=&quot;text&quot; spellcheck=&quot;true&quot;&gt;
&lt;textarea spellcheck=&quot;false&quot;&gt;&lt;/textarea&gt;
</code></pre></pre><p>It is enabled in major browsers by default, so we will only need to disable it if needed.</p><p>Spellcheck is supported by Opera, Goocle Chrome and Safari.</p><h3>Maxlength</h3><p>This is also an attribute that can only be used on text input elements. It allows to define the maximum number of characers that can be written on that element.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;input type=&quot;text&quot; maxlength=&quot;10&quot; placeholder=&quot;You can&#x27;t write more than 10 characters in here&quot;&gt;
&lt;textarea maxlength=&quot;200&quot;&gt;&lt;/textarea&gt;
</code></pre></pre><p>This attribute is useful to make client-side validation of the length of a field, but make sure to make server-side validation too.</p><p>All major browsers support this attribute.</p><p><strong>Example:</strong></p><input type="text" maxLength="10" placeholder="You can&#x27;t write more than 10 characters in here" class="form-control"/><h3>Start</h3><p>The start attribute is only used at ordered lists, <code>&lt;ol&gt;</code>, and is used to define the first numeric value of the list.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;ol start=&quot;6&quot;&gt;
    &lt;li&gt;Item nuber six&lt;/li&gt;
    &lt;li&gt;Item number seven&lt;/li&gt;
    &lt;li&gt;Item number eight&lt;/li&gt;
&lt;/ol&gt;
</code></pre></pre><p>All major browsers support this attribute.</p><p><strong>Example:</strong></p><ol start="6"><li>Item nuber six</li><li>Item number seven</li><li>Item number eight</li></ol><h3>Reversed</h3><p>As well as the previous attribute, this is only used in ordered lists, <code>&lt;ol&gt;</code>, and is used to reverse the numeration of the list, making it start at the length of the list and end at 1.</p><p>It is boolean, so its only presence will make the magic.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;ol reversed&gt;
    &lt;li&gt;Item number three&lt;/li&gt;
    &lt;li&gt;Item number two&lt;/li&gt;
    &lt;li&gt;Item number one&lt;/li&gt;
&lt;/ol&gt;
</code></pre></pre><p><strong>Example:</strong></p><ol reversed=""><li>Item number three</li><li>Item number two</li><li>Item number one</li></ol><p><strong>Tip of the day!</strong></p><p>Reversed attribute and start attribute can be combined in the same list, making the list go backwards but starting at the number we want to.</p><p><strong>Example:</strong></p><ol start="2"><li>Item</li><li>Item</li><li>Item</li><li>Item</li><li>Item</li></ol><p>Unfortunately only Google Chrome supports the reversed attribute.</p><h3>Contenteditable</h3><p>Last but not least. The contenteditable attribute acn be used on any element, making the content of that element editable directly from the browser.</p><p>Accepts values <em>true</em> and <em>false</em>, enabling or disabling the behavior.</p><p><strong>Usage:</strong></p><pre><pre><code class="language-html">&lt;p contenteditable=&quot;true&quot;&gt;This content is editable&lt;/p&gt;
&lt;div contenteditable=&quot;false&quot;&gt;This content is NOT editable&lt;/div&gt;
</code></pre></pre><p>This attribute is compatible with all major browsers.</p><p><strong>Example:</strong></p><div contenteditable="true">This content is editable. Try it!</div>

Alejandro Celaya | Blog

Software development, agile methodologies and open source projects.

category Archive — "web"

— 2020 —

— 2018 —

— 2016 —

— 2014 —