<p>Two days ago I released the first major version in almost 2 years for <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlink-web-client</a>, a web UI for <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">shlink</a>, my self-hosted URL shortener.</p><p>This new version introduces several improvements to the project, and I thought it was worth writing a post to explain all of them in depth.</p><h3>New design</h3><p>The project has been using the same design almost since the beginning. It was clean, but it laked a bit of contrast and consistency in many sections.</p><p>Now the main background is light-gray, with components composed in white cards with a slight box shadow, that makes them easier to spot inside the app.</p><p>Also, the main area has now a max-width that prevents components from stretching too much on wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/design-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/design-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Overview page</h3><p>Up until now, after connecting to a Shlink server, you went directly to the list of short URLs.</p><p>With this new version, you now see an overview page first, which displays some general stats, a quick short URL creation form, and the latest 5 short URLs.</p><p>From there, you can navigate to the full list of short URLs, with filtering capabilities, or go to the advanced short URL creation form.</p><div class="row"><div class="col-md-8 col-md-offset-2 "><img alt="Overview" src="/assets/img/shlink-web-client-3/overview.png" class="gallery-item"/><p class="text-center"><small>Overview</small></p></div></div><h3>Improved short URL creation form</h3><p>One of the sections with more room for improvement was the short URL creation form. It had all the inputs mixed, displaying just the &quot;long url&quot; one, with the option to un-collapsing the rest at will.</p><p>The new design groups the inputs by context, which makes it more clear. It also displays the inputs all the time, since the &quot;quick form&quot; is now located in the overview page.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/creation-form-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/creation-form-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Enhanced visits page</h3><p>The visits page had a problem, it was trying to display too much information in a single place.</p><ul><li>Visits over time</li><li>Visits from every platform</li><li>Visits from every location</li><li>A list of visits as a table</li></ul><p>The new approach splits those in subsections with their own sub-route each (<code>/by-location</code>, <code>/by-context</code>, etc). This helps to render a smaller amount of charts at once, since they are a bit CPU greedy.</p><p>Also, only the visits from the last 30 days are loaded by default, making it load way faster for URLs with a lot of visits.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/visits-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/visits-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Outer sections</h3><p>The app has some sections which are not related to a specific server, like creating/editing servers, or the settings page.</p><p>These sections have also been adapted to the new style, and they also have a max-width for wide screens.</p><div class="row"><div class="col-md-6  "><img alt="Before" src="/assets/img/shlink-web-client-3/create-server-before.png" class="gallery-item"/><p class="text-center"><small>Before</small></p></div><div class="col-md-6  "><img alt="After" src="/assets/img/shlink-web-client-3/create-server-after.png" class="gallery-item"/><p class="text-center"><small>After</small></p></div></div><h3>Date range selector</h3><p>A new component allows selecting date ranges either by relative time ranges (last 30 days, last 90 days...) or by selecting absolute start and end dates.</p><p>This component is used to filter both short URL lists and visits lists.</p><div class="row"><div class="col-md-6  col-md-offset-3"><img alt="Date range selector" src="/assets/img/shlink-web-client-3/date-range-selector.png" class=""/><p class="text-center"><small>Date range selector</small></p></div></div><h3>Domain selector</h3><p>Shlink has had multi-domain support for some versions, but changing the domain from the web client required to set the value manually, which is a bit error-prone.</p><p>This version introduces a new component which allows selecting from domains already used in the past (which is what you will want in most of the cases), preventing accidental typos.</p><p>It also allows setting new values in case you want to use a new domain that you never used before. This domain will then appear in the list the next time.</p><div class="row"><div class="col-md-6  "><img alt="Existing domains" src="/assets/img/shlink-web-client-3/domains-existing.png" class=""/><p class="text-center"><small>Existing domains</small></p></div><div class="col-md-6  "><img alt="New domain" src="/assets/img/shlink-web-client-3/domains-new.png" class=""/><p class="text-center"><small>New domain</small></p></div></div><h3>Other improvements</h3><p>The changes described so far were the major ones. However, v3.0.0 includes a few other minor improvements.</p><ul><li>Result and loading messages have been standardized: They are now more consistent and use the same set of components, which also ensures consistency in the future.</li><li>Error messages are now more descriptive: Instead of showing generic error messages when API calls fail, the actual error message is now always displayed, so that it&#x27;s easier to know what failed.</li><li>Dropped support for Shlink v1: All major versions come with some breaking changes that improve code maintainability. This one drops Shlink v1 support, which allows removing some conditional paths here and there.</li></ul><p>Other than the last point, Shlink v3.0.0 is mostly backwards compatible, so it&#x27;s safe to upgrade if you are already using Shlink v2.x</p><h3>Next steps</h3><p>Of course this doesn&#x27;t end here, and I have a lot of ideas to improve it even further.</p><ul><li>Dark theme: It&#x27;s what the cool kids do these days, and I have already done some experiments around it.</li><li>Shlink dashboard: Next gen web app for Shlink. You can read the whole reasoning in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client/issues/338">this issue</a>.</li><li>Filtering in lists added to URL: Many sections allow filtering lists, but the state is saved in memory, which means it gets lost if the page is refreshed, and it cannot be bookmarked. The intention is to make all filtering params to become part of the URL.</li><li>Exporting visits in CSV: It&#x27;s cool to see charts full of info, but sometimes admins need to feed other services with the data, and consuming the original API is not always an option. Exporting visits to a CSV file will be supported soon by shlink-web-client.</li></ul>

Released shlink-web-client v3.0.0

<p>Let&#x27;s not deny that <a target="_blank" rel="noopener noreferrer" href="https://github.com/features/actions">GitHub actions</a> are hitting hard in the tech community, and many projects are transitioning from other continuous integration systems like <a target="_blank" rel="noopener noreferrer" href="https://circleci.com/">Circle CI</a> or <a target="_blank" rel="noopener noreferrer" href="https://travis-ci.org/">Travis CI</a>.</p><p>Personally I have been using Travis a lot during the past years, for all my OSS projects, and I have gotten very used to it.</p><p>However, people seem to be &quot;abandoning&quot; travis in favor of GitHub Actions, for different reasons. &quot;It&#x27;s faster&quot;, &quot;I can run smaller tasks in parallel&quot;, etc.</p><p>In my case, I have moved a few very specific tasks there, where travis was becoming a bottleneck, but I still have mixed feelings about the very-verbose yaml-based config needed to configure a few GitHub Actions, compared to the more concise travis one.</p><p>In this article I&#x27;ll explain how I improved a travis build to run several smaller tasks in parallel jobs, without having to completely move away from it.</p><h3>Initial state</h3><p>This project&#x27;s travis config is relatively simple. It is used to build a JS project for the web browser, and it has to run the next tasks:</p><ul><li>Lint the code, to make sure it fulfils the project&#x27;s coding standards.</li><li>Run unit tests.</li><li>Run mutation tests.</li><li>Build the docker image, to make sure none of the new changes broke it.</li><li>Conditionally publish a release on GitHub, with a dist file attached to it, if the build is being run for a git tag.</li></ul><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

services:
  - docker

node_js:
  - &#x27;12.16.3&#x27;

install: npm ci

before_script:
  - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
  - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)

script:
  - npm run lint
  - npm run test:ci
  - npm run mutate:ci
  - docker build -t project:test .

after_success:
  - node_modules/.bin/ocular coverage/clover.xml

before_deploy: npm run build ${TRAVIS_TAG#?}

deploy:
  - provider: releases
    api_key:
      secure: &lt;key&gt;
    file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
    skip_cleanup: true
    on:
      tags: true
</code></pre></pre><h3>Problems with this approach</h3><p>This is more or less ok, but the last two commands in <code>script</code> can be relatively slow and can delay the whole process.</p><p>Also, specially the mutation tests one, which is currently always considered successful regardless the result, can make the build reach the maximum run time allowed by travis, making the whole build falsely fail.</p><blockquote><p>The reason for the <code>before_script</code> step is to determine which source code files changed, and run mutation tests on them only, in order to mitigate this.</p></blockquote><p>Other than this, the build config defines &quot;global&quot; customizations that are actually only used for some tasks:</p><ul><li>Running <code>npm ci</code> is not required for the <code>docker build</code> task.</li><li>Getting the <code>docker</code> service is not required by any of the other tasks.</li><li>Determining changed files is only used by the <code>mutation tests</code> task.</li></ul><h3>Making use of jobs</h3><p>One cool feature travis supports is the use of a job <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/build-matrix/">build matrix</a>, that lets you define multiple jobs that run in parallel as part of the same build, and make each one of them do unrelated tasks.</p><p>Using this feature it is possible to improve the <code>.travis.yml</code> file, making it look like this:</p><pre><pre><code class="language-yaml">dist: bionic

language: node_js

branches:
  only:
    - /.*/

cache:
  directories:
    - node_modules

node_js:
  - &#x27;12.16.3&#x27;

jobs:
  fast_finish: true
  allow_failures:
    - name: &#x27;Mutation tests&#x27;
  include:

    - name: &#x27;Lint&#x27;
      install: npm ci
      script: npm run lint

    - name: &#x27;Unit tests&#x27;
      install: npm ci
      script: npm run test:ci
      after_success:
        - node_modules/.bin/ocular coverage/clover.xml

    - name: &#x27;Mutation tests&#x27;
      install: npm ci
      before_script:
        - echo &quot;Building commit range ${TRAVIS_COMMIT_RANGE}&quot;
        - export MUTATION_FILES=$(git diff ${TRAVIS_COMMIT_RANGE:-origin/main} --name-only | grep -E &#x27;src\/(.*).(ts|tsx)$&#x27; | paste -sd &quot;,&quot;)
      script: npm run mutate:ci

    - name: &#x27;Build docker image&#x27;
      services:
        - docker
      install: skip
      script: docker build -t project:test .

    - name: &#x27;Publish release&#x27;
      if: tag IS present
      install: skip
      script: skip
      before_deploy: npm run build ${TRAVIS_TAG#?}
      deploy:
        - provider: releases
          api_key:
            secure: &lt;key&gt;
          file: &quot;./dist/project_${TRAVIS_TAG#?}_dist.zip&quot;
          skip_cleanup: true
          on:
            tags: true
</code></pre></pre><p>This approach introduces all these benefits:</p><ul><li>Now linting, testing, mutation testing and building the docker image run in parallel, making the build finish earlier.</li><li>The mutation testing step is allowed to fail, and thanks to the <code>fast_finish</code> flag, travis won&#x27;t even wait for it to finish, considering the build successful once the rest have passed.</li><li>Configs that are only meaningful for certain jobs are defined in the job itself, instead of globally.</li><li>The &quot;publish release&quot; job only runs conditionally if the build is for a tag, thanks to the <code>if: tag IS present</code> condition. (More info about <a target="_blank" rel="noopener noreferrer" href="https://docs.travis-ci.com/user/conditional-builds-stages-jobs/">conditional jobs</a> in travis).</li><li>As soon as any of the jobs fails, the whole build fails and you don&#x27;t have to continue waiting. Before this, if the third task failed, you still had to wait for the previous two to finish.</li><li>Each job can have a name, making it more clear in travis UI what tasks are being run:</li></ul><p><img src="/assets/img/travis-multiple-jobs/travis-jobs.png" alt="Travis CI jobs"/></p><h3>Conclusion</h3><p>The main purpose of this article was to showcase that travis still has a lot to give. Github Actions are definitely cool, but there&#x27;s usually no silver bullet for everything, and a combination with other tools might be more suitable.</p><p>Also, this allows people using travis to improve their builds without having to change everything. Then, once you have split your tasks, if you still want to move to Github Actions, it should be easier.</p><blockquote><p>If you are curious, this is the project in which I use this travis configuration: <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-web-client">shlinkio/shlink-web-client</a>.</p></blockquote>

Running several steps of a Travis CI build in parallel

<p>Asynchronous and non-blocking runtimes are pretty usual in many programming languages, as well as long-lived web apps that stay in memory and are capable of dispatching multiple HTTP requests without having to be fully bootstrapped every time. This has not been traditionally the case with PHP apps. </p><p>However, many projects are starting to get some adoption, that bring this long-lived approach to the PHP world.</p><p>The problem with this is that PHP developers are not used to this, and they tend to continue acting as they have always done. Also, libraries might have made some assumptions, making them not work as expected when used under this context.</p><p>Some of these projects are <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk">swoole</a>, <a target="_blank" rel="noopener noreferrer" href="https://reactphp.org/">ReactPHP</a> or <a target="_blank" rel="noopener noreferrer" href="https://amphp.org/">Amphp</a>, to give some examples.</p><p>In this article, I will be focusing on the first one, and explain how to approach some of the pain points I have found after using it for a year and a half on an <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink">existing PHP project</a>.</p><h3>Introducing Swoole</h3><p>The main difference swoole has compared to other similar projects is that it&#x27;s written as a native PHP extension, and needs to be installed with <code>pecl</code>.</p><p>This is obviously a bit cumbersome, but the benefit is that, since it&#x27;s written in C++, it has a better handling of memory allocation, which is very important to achieve what it tries to do.</p><p>What swoole does is running a main process which bootstraps the PHP application once, and then keeps it in memory so that it can continue dispatching requests without having to load resources every time. This makes it really fast.</p><p>Those HTTP requests are handled by a set of child processes called &quot;web workers&quot;. Swoole forks the contents in memory for the main process to each one of the workers, so each worker has a &quot;copy&quot; of the application in memory.</p><p>Each worker is independent, but each one of them can only handle one request at a time, so you have to increase the number of workers if you expect a lot of concurrent traffic.</p><p>Other than web workers, swoole also has another set of child processes called &quot;task workers&quot;, which can be used to delegate long tasks at runtime to prevent web workers from getting blocked.</p><p>Here you can see a diagram of swoole&#x27;s architecture.</p><p><img src="https://www.swoole.co.uk/images/how-swoole-works.png" alt="How Swoole works"/></p><blockquote><p>More information can be found in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/how-it-works">Swoole&#x27;s website</a>.</p></blockquote><h3>Problems to solve</h3><p>Now that we know how swoole works, let&#x27;s see some of the challanges I have faced in th past, which are usually not that ovbious when you are used to think in terms of &quot;blocking&quot; and &quot;short-lived&quot;.</p><h4>Database connections are kept open</h4><p>One of the first things you find out is that, since the application stays in memory, any database connection that has been opened by a worker (either web or task worker), will be kept open and reused in subsequent executions or HTTP requests served by the app.</p><p>This, which is in theory good, has a side effect, which is not obvious during development: <strong>the opened connection will eventually expire</strong>.</p><p>Since most of the popular database abstraction layers in PHP are coming from the times in which PHP was just a bootstrap-on-every-request technology, they never cared too much about expired database connections, as they would be opened again on next request.</p><p>However, when using swoole and the like, you have to implement some mechanism which takes care of reconnecting or gracefully recovering when this happens.</p><blockquote><p>I wrote an article explaining how I solved this on a middleware-based app served with swoole and using doctrine: <a href="/2019/11/04/how-to-properly-handle-a-doctrine-entity-manager-on-an-expressive-application-served-with-swoole/">How to properly handle a doctrine entity manager on an expressive application served with swoole</a></p></blockquote><p>Obviously, swoole (and also others) provides some tools to work with databases (like this <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-async-mysql-client">MySQL client</a>), which I&#x27;m sure do not have this problem (although, I haven&#x27;t personally tried this), but they are more limited than other well adopted libraries.</p><h4>In-memory caches don&#x27;t behave as expected</h4><p>It is a frequent practice to use local in-memory caches, like APCu, to improve applications performance in production.</p><p>Usually APCu is faster than other options, like redis or memcached, so it&#x27;s the choice when you only have one instance of your app running (meaning, you don&#x27;t have a cluster behind a load balancer).</p><p>However, even if you are running your app on just one server with swoole, because of the web worker system explained earlier, you actually have several copies of your app in memory, and each one of them will have a separated and not shared cache when using APCu.</p><p>This can lead to inconsistencies which are hard to debug, so you need to have it in mind.</p><p>Also, since the information that is being loaded is kept in memory anyway, you will not notice such a big improvement by using APCu or other in-memory caches.</p><blockquote><p>Notice that this problem does not happen when using distributed/centralized caching solutions, such as redis or memcached, as in that case, the caching technology is shared by all workers.</p></blockquote><h4>No need to optimize file including/requiring</h4><p>Many projects have complex configuration systems which are spread into several files. While this make it more maintainable, it also has a performance impact when all those files need to be loaded on every request.</p><p>Because of that, there are libraries like <a target="_blank" rel="noopener noreferrer" href="https://github.com/laminas/laminas-config-aggregator">laminas-config-aggregator</a> that can dynamically load config from many sources and, if some conditions are met, they can merge the result in a single bigger file that can be used in later requests.</p><p>In the case of swoole, as all the files will be kept in memory once loaded for the first time, there&#x27;s no need for this kind of optimization.</p><h4>Class autoloading happens once</h4><p>This point is very related with the previous one.</p><p>Composer offers a lot of optimization options so that class autoloading is faster in production. While you usually will still want to use some of those so that the first time a class is being loaded it is still reasonably fast, any subsequent hits will just use the class which is already in memory.</p><p>One of the composer flags you will probably don&#x27;t want use with swoole is <code>--apcu-autoloader</code>, because of the reasons mentioned two points above this one.</p><h4>Services should be truly stateless</h4><p>This is something that you should always do anyway, but it&#x27;s specially important when a service instance is kept in memory between HTTP requests.</p><p>Sometimes it&#x27;s easy to end up having some small piece of internal state on a service, where we save something as a side effect of a method call, to end up using it when another one of the public methods is invoked.</p><p>While this could seem harmless when the whole app is bootstrapped on every request, it can have very dangerous side effects when the app is served with swoole, because the instance will persist until another request is dispatched by the same web worker.</p><p>Just imagine you saved some user data on a service, and it ends up being served to another user on the next request. That won&#x27;t look good.</p><p>Because of this, make sure your services are truly stateless, and if for any reason that&#x27;s not possible, at least remember to have some mechanism in place that flushes the data just before finishing the request.</p><h4>Hot reloading for dev envs is not that good</h4><p>One thing we usually take for granted is that we can modify a PHP file and just by making a new request, the new code will be executed. However, when the code is kept in memory, it&#x27;s not that straightforward.</p><p>When you are developing a project which is served with swoole, you will have to restart the server every time to get your changes applied.</p><p>Swoole has a mechanism to do a light server reload, which is faster. You can find the docs in <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/docs/modules/swoole-server-reload">it&#x27;s website</a>.</p><p>The problem with this is that you need to implement the mechanism to invoke that when a file is changed, or use some library that does it for you.</p><p>Also, I have noticed that even calling that and seeing that the server is reloaded, does not always have the expected effect, and you have to still end up doing a hard reload. It&#x27;s something I don&#x27;t fully understand and I still need to investigate a bit further.</p><h3>Conclusion</h3><p>As it always happens when new technologies appear, it takes some time to get used to them, but I strongly suggest you to give a try to swoole or any other non-blocking runtime, because it makes your apps super fast.</p><p>Just remember to have all of the above in mind ;-)</p><p>That said, here you can find some libraries that will make your life easier when trying to serve existing projects with swoole, without having to couple with it and being able to continue using your favourite framework:</p><ul><li>IDE helper: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swoft-cloud/swoole-ide-helper">https://github.com/swoft-cloud/swoole-ide-helper</a></li><li>Mezzio (formerly Zend Expressive): <a target="_blank" rel="noopener noreferrer" href="https://github.com/mezzio/mezzio-swoole">https://github.com/mezzio/mezzio-swoole</a></li><li>Symfony: <a target="_blank" rel="noopener noreferrer" href="https://github.com/k911/swoole-bundle">https://github.com/k911/swoole-bundle</a></li><li>Laravel: <a target="_blank" rel="noopener noreferrer" href="https://github.com/swooletw/laravel-swoole">https://github.com/swooletw/laravel-swoole</a></li></ul><p>Also, here you can find some more articles talking about this topic:</p><ul><li><a target="_blank" rel="noopener noreferrer" href="https://www.zend.com/blog/why-you-should-use-asynchronous-php">https://www.zend.com/blog/why-you-should-use-asynchronous-php</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/">https://samsonasik.wordpress.com/2020/04/05/using-swoole-in-mezzio-application-with-sdebug/</a></li></ul>

Considerations when working with async PHP runtimes like swoole

<p>Some of you probably know that I have a pet project in which I like to work from time to time. This project is a self-hosted URL shortener called <a target="_blank" rel="noopener noreferrer" href="https://shlink.io">Shlink</a>.</p><p>Shlink is built using expressive as the base framework for the HTTP-dispatching task. A while ago, an expressive module was released to officially support serving expressive apps with <a target="_blank" rel="noopener noreferrer" href="https://www.swoole.co.uk/">swoole</a>, and I decided to include it on Shlink.</p><h3>How does swoole work?</h3><p>Swoole is an asynchronous non-blocking I/O framework which works in a similar way as node.js, but for PHP apps.</p><p>It has been conceived in a way that the app stays in memory between requests, removing the bootstrapping step and making apps to be served much faster.</p><p>Swoole can serve as many simultaneous requests as you tell it to. For this it makes use of workers. Each worker can serve one request at a time, and every worker has a separate instance of the app loaded in memory (this is something I <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/dominikzogg/status/1189403552399134720">learned recently</a>).</p><p>Because of this, you have to sometimes change a bit the way you design your code. For example, if a service needs to be stateful (it shouldn&#x27;t, but shit happens), you will have to remember that the state will persist between requests, and you will want to somehow reset it to avoid unexpected side effects.</p><h3>How does this affect the EntityManager?</h3><p>One of the main services that keeps this internal state in Shlink is the doctrine <a target="_blank" rel="noopener noreferrer" href="https://www.doctrine-project.org/projects/doctrine-orm/en/current/tutorials/getting-started.html#obtaining-the-entitymanager">EntityManager</a>.</p><p>Due to the fact that it was originally designed to be used on a classical web server + CGI context, assuming it would be recreated on every request, there are a few considerations to take into account:</p><ul><li>It implements the unit of work pattern. It internally keeps track of all the entities that have been created/changed until you decide to flush it.</li><li>If something fails, the <code>EntityManager</code> can get closed, which makes it unusable after that moment.</li><li>If the database connection expires, the <code>EntityManager</code> will not gracefully recover. Instead, it will fail, since it&#x27;s not aware of the connection not being usable, getting yourself in previous point.</li></ul><h3>How to workaround it</h3><p>I learned about these issues by try and error, by using it on the app and getting the failures. Now, I want to share how I workaround those issues.</p><p>The first one I faced was the one making the app unusable after the <code>EntityManager</code> was closed. In order to solve this I created a decorated instance (naming, an object implementing <code>EntityManagerInterface</code> which in turn was wrapping an actual <code>EntityManager</code>), which was making sure the wrapped instance was transparently recreated if at some point it was closed.</p><p>However, this caused some side effects, and I finally realized that it was better to make the <code>EntityManager</code> to have to be reopened from the outside, and only once per request (this is closer to how it would behave on a classical set-up).</p><p>That&#x27;s how I came up with the <code>ReopeningEntityManager</code> Shlink is currently using (as of v1.20.0):</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Doctrine;

use Doctrine\ORM\Decorator\EntityManagerDecorator;

class ReopeningEntityManager extends EntityManagerDecorator
{
    /** @var callable */
    private $createEm;

    public function __construct(callable $createEm)
    {
        parent::__construct($createEm());
        $this-&gt;createEm = $createEm;
    }

    public function open(): void
    {
        if (! $this-&gt;wrapped-&gt;isOpen()) {
            $this-&gt;wrapped = ($this-&gt;createEm)();
        }
    }
}
</code></pre></pre><blockquote><p>You can find the actual code in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Doctrine/ReopeningEntityManager.php">shlink-common</a>.</p></blockquote><p>It just expects a factory that creates the actual <code>EntityManager</code>, and exposes an <code>open</code> public method which re-creates the wrapped instance if closed.</p><p>This method is called from a <a target="_blank" rel="noopener noreferrer" href="https://www.php-fig.org/psr/psr-15/">PSR-15</a> middleware which needs to be registered early in the middleware pipeline. It makes sure the method is called before the next middleware on the stack is invoked:</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Shlinkio\Shlink\Common\Doctrine\ReopeningEntityManager;

class CloseDbConnectionMiddleware implements MiddlewareInterface
{
    /** @var ReopeningEntityManager */
    private $em;

    public function __construct(ReopeningEntityManager $em)
    {
        $this-&gt;em = $em;
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        $this-&gt;em-&gt;open();

        try {
            return $handler-&gt;handle($request);
        } finally {
            $this-&gt;em-&gt;getConnection()-&gt;close();
            $this-&gt;em-&gt;clear();
        }
    }
}
</code></pre></pre><blockquote><p>Again, the code can be found in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Middleware/CloseDbConnectionMiddleware.php">shlink-common</a></p></blockquote><p>This middleware also does two more things (this time, after calling the next middleware on the stack, and making sure it does it even if an exception is thrown).</p><ul><li>It first closes the database connection. By doing it so, we make sure the <code>EntityManager</code> will reconnect the next time it needs to interact with the database, and therefore, we avoid the &quot;expired connection&quot; issue.</li><li>Then it clears the <code>EntityManager</code> itself. This avoids memory leaks, and also prevents that any orphan/non-flushed entity &quot;transcends&quot; to the next request, solving the first problem.</li></ul><h3>Further considerations</h3><p>This approach has been working well so far, but it&#x27;s important to assume that the <code>EntityManager</code> was not really designed for this non-blocking kind of context.</p><p>You need to know that the worker making use of it will not be able to serve any request until the <code>EntityManager</code> finishes its job. Because of this you might want to increase the number of swoole workers.</p><p>Also, closing the DB connection on every request is not the most optimal approach. It would be perfect to have a connection pool that was able to recreate connections when expired, and to keep them open as long as possible for faster operations. However, the <code>EntityManager</code> was not designed for that, so it&#x27;s better to close it.</p><p>You also need a <code>callable</code> to pass to the <code>ReopeningEntityManager</code>. The way you solve this depends on your implementation and the dependencies you use.</p><p>In my case, in Shlink I make use of the <code>ServiceManager</code>, so I have a delegator factory which takes the actual factory and passes it to the <code>ReopeningEntityManager</code>:</p><pre><pre><code class="language-php">&lt;?php

declare(strict_types=1);

namespace Shlinkio\Shlink\Common\Doctrine;

use Psr\Container\ContainerInterface;

class ReopeningEntityManagerDelegator
{
    public function __invoke(ContainerInterface $container, string $name, callable $createEm): ReopeningEntityManager
    {
        return new ReopeningEntityManager($createEm);
    }
}
</code></pre></pre><blockquote><p>You can find the actual code in <a target="_blank" rel="noopener noreferrer" href="https://github.com/shlinkio/shlink-common/blob/master/src/Doctrine/ReopeningEntityManagerDelegator.php">shlink-common</a>.</p></blockquote><h3>Conclusion</h3><p>I wanted to write this article as a recap for myself too, since I had to ask and investigate many times, and I couldn&#x27;t find a single source of truth explaining everything.</p><p>I hope that, if you ended up here, this article served you well.</p>

How to properly handle a doctrine entity manager on an expressive application served with swoole

<p>For a long time, I have been trying to include tests in every project in which I&#x27;ve worked on.</p><p>There are several types of automated tests (or what should actually be called <a target="_blank" rel="noopener noreferrer" href="https://abstracta.us/insights/guide-continuous-testing/automated-checks">automated checks</a>). From unit tests, integration and functional tests, to end-to-end tests.</p><p>Each one of them differs from the rest by the scope they try to cover. From small units of code which are tested completely detached from external dependencies, to a whole app which is tested as a black box like if an end consumer was using it.</p><p>I&#x27;m not going to deeply discuss the semantics behind this, or where an integration test ends and an end-to-end test starts, because it&#x27;s quite frequently a blurry line.</p><p>I want to focus on unit tests, and a frequently used practice (even in my own tests), which I have read (and felt) several times, it might not be the best approach.</p><blockquote><p>This article is not focused on any particular technology, since I have found this in a lot of different projects.</p></blockquote><h3>What&#x27;s a unit test</h3><p>According to <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Unit_testing">Wikipedia</a>, unit testing is a &quot;method by which individual units of source code [...] are tested to determine whether they are fit for use&quot;.</p><p>While this might look like a clear definition, it&#x27;s actually quite open because, what&#x27;s a &quot;unit&quot; in the context of unit testing?</p><p>Very often, in object oriented programming projects, people take a class as a unit to test, and create a unit test for every class. In other paradigms, like functional programming, you might consider a function as the unit to be tested, or a set of functions which you have decided to put together in a module.</p><p>This is not really important for the purpose of this article. What&#x27;s really important is to take into account that, in order to properly &quot;unit test&quot; a &quot;unit of source code&quot;, you have to do it by isolating it from any dependency of that unit.</p><p>One of the better ways to achieve this is by following the <strong><a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Dependency_inversion_principle">Dependency Injection Principle</a></strong>. Without it you will probably end up trying to hack yourself in order to detach a &quot;unit&quot; from its dependencies.</p><blockquote><p>You can find other articles about <a href="/tag/dependency-injection/">Dependency Injection</a> in my blog.</p></blockquote><h3>Replacing dependencies</h3><p>A very frequent practice when unit testing a unit of source code is to replace its dependencies with <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Test_double">test doubles</a>, in order to properly isolate every unit when testing it.</p><p>Test doubles are basically objects compatible with the dependencies of the subject under test, that are created just for the purpose of the test and have some useful capabilities, like capturing how they have been called, or what should they return when called.</p><p>When you use one of those test doubles to assert how they were called as part of the test itself, you are using them as &quot;spies&quot;.</p><h3>Over-trusting spies</h3><p>All this introduction and contextualization had a single purpose.</p><p>I find myself (and others) in the situation in which you prepare a test double to behave in a certain way, then you call your subject under test, and then assert that your expectations on how the test double was called are correct, by spying on it.</p><p>This sometimes feels wrong, since it seems you are testing the test double/s instead of the subject under test.</p><p>I have read many times that, in a unit test, we should not actually know the internal implementation of the subject under test, but only test that, based on certain input, the expected output is returned (so, trust its public API).</p><p>However, there are cases in which some function/method does not really have any output, and we can only verify everything is going right by spying on the test doubles.</p><p>So, at the end of the day, I have mixed feelings about this practice.</p><h3>Conclusion</h3><p>Sadly, I cannot state a clear conclusion. This is actually an open article, and I would love to get your point of view in the form of a <a href="#comments-box">comment</a>.</p><p>It would be great to see how others face this, if you use other kinds of test doubles instead of spies, or if you are just ok with the implications.</p>

Is spying on mocks a bad practice for unit tests?

Advanced usage of ServiceManager in Zend Framework 2

<p>One of the first articles I wrote in this blog was an introduction to unit testing PHP applications. You can find it <a href="/2014/01/29/introduction-to-php-unit-testing-with-phpunit/">here</a> in case you need to know the first steps and the theory.</p><p>On this article I&#x27;m going to explain how to get a Zend Framework 2 module tested. It is indeed very similar to test any PHP application, we just have to be sure the framework classes are properly loaded.</p><h3>Structure</h3><p>Zend Framework 2 modules usually have a standard folder structure. A view folder with templates, a config folder with configuration files, a src folder with PHP classes and tests are usually placed in a tests folder (sometimes it is just test). There can be other folders like public, languages, etc.</p><p>This could be the structure of our module:</p><pre><pre><code>MyModule
| - config
| - languages
| - src
|   | - Controller
|   |   | - IndexController.php
|   |   | - [...]
|   | - Service
|   |   | - MyService.php
|   |   | - [...]
| - tests
|   | - Controller
|   |   | - IndexControllerTest.php
|   |   | - [...]
|   | - Service
|   |   | - MyServiceTest.php
|   |   | - [...]
|   | - bootstrap.php
|   | - phpunit.xml
| - view
| - composer.json
| - Module.php
</code></pre></pre><p>If you don&#x27;t want to create this by yourself, this module can be found <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/zf2-testing">here</a>.</p><p>The content of src and tests folders is the only one that matters for this article. I&#x27;m going to use <a target="_blank" rel="noopener noreferrer" href="https://www.php-fig.org/psr/psr-4/">psr-4</a> autoloading but we&#x27;ll see that later.</p><h3>Bootstrapping</h3><p>When I started to test my first Zend Framework 2 module I found the bootstrap files in the documentation very confusing. There are different approaches.</p><p>In the <a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/ZendSkeletonModule">Zend Skeleton Module</a> the bootstrap tries to load ZF2, then uses <code>Zend\Loader</code> to autoload classes in the framework and the tested module, then initializes the <code>ModuleManager</code> and finally tries to initialize a <code>ServiceManager</code>. It seems very confusing to me in case you need to customize something. You can see the file <a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/ZendSkeletonModule/blob/master/tests/bootstrap.php">here</a>.</p><p>In the getting started documentation used to be a different approach, but it seems it has been removed in one of the last versions. It was also too confusing, trying to load all the framework stuff.</p><p>The thing is that when I make a unit test I just want to test one class, one tiny component, and don&#x27;t need to load everything else. That&#x27;s why I prefer to use the composer&#x27;s autoloader, which makes the bootstrap script much simpler.</p><pre><pre><code class="language-php">&lt;?php
$vendorDir = findParentPath(&#x27;vendor&#x27;);

if (file_exists($file = $vendorDir . &#x27;/autoload.php&#x27;)) {
    require_once $file;
} else {
    throw new \RuntimeException(&quot;Composer autoload not found&quot;);
}

function findParentPath($path)
{
    $dir = __DIR__;
    $previousDir = &#x27;.&#x27;;
    while (!is_dir($dir . &#x27;/&#x27; . $path)) {
        $dir = dirname($dir);
        if ($previousDir === $dir) {
            return false;
        }
        $previousDir = $dir;
    }
    return $dir . &#x27;/&#x27; . $path;
}
</code></pre></pre><p>What this script does is basically trying to recursively find the vendor folder in a parent directory. If it finds it, it includes the autoloader, if not, it throws a <code>RuntimeException</code>.</p><p>This approach is not my own idea, I think I saw it in an <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/Ocramius">@ocramius</a> module and really liked its simplicity.</p><p>That makes us not having to use <code>Zend\Loader</code>, loading modules, preparing a <code>ServiceManager</code> and such. The only thing you need is to define the autoloading strategy of your module in the composer.json file, and the rest of the dependencies will be available too.</p><p>For our example, the composer.json autoloading could be something like this:</p><pre><pre><code class="language-javascript">[...]

&quot;autoload&quot;: {
    &quot;psr-4&quot;: {
        &quot;MyModule\\&quot;: &quot;src/&quot;,
        &quot;MyModuleTest\\&quot;: &quot;tests/&quot;
    },
    &quot;classmap&quot;: [&quot;./Module.php&quot;]
}

[...]
</code></pre></pre><blockquote><p>For more information on how to use composer, read <a href="/2014/07/19/dependency-management-and-autoloading-in-php-projects-with-composer/">this</a>.</p></blockquote><h3>PHPUnit configuration</h3><p>Once the bootstrap script is clear, we need to define the phpunit config file. It is just a common phpunit.xml file, nothing special, you just need to define the test suites you want. In our case there will be two testsuites, one for controllers and one for services, but we could include others if needed.</p><pre><pre><code class="language-xml">&lt;?xml version=&quot;1.0&quot;?&gt;
&lt;phpunit bootstrap=&quot;./bootstrap.php&quot;
         colors=&quot;true&quot;
         convertErrorsToExceptions=&quot;true&quot;
         convertNoticesToExceptions=&quot;true&quot;
         convertWarningsToExceptions=&quot;true&quot;
         verbose=&quot;true&quot;
         stopOnFailure=&quot;false&quot;
         processIsolation=&quot;false&quot;
         backupGlobals=&quot;false&quot;
         syntaxCheck=&quot;true&quot;&gt;

    &lt;testsuite name=&quot;Controller tests&quot;&gt;
        &lt;directory&gt;./Controller&lt;/directory&gt;
    &lt;/testsuite&gt;
    &lt;testsuite name=&quot;Service tests&quot;&gt;
        &lt;directory&gt;./Service&lt;/directory&gt;
    &lt;/testsuite&gt;

    &lt;filter&gt;
        &lt;whitelist&gt;
            &lt;directory suffix=&quot;.php&quot;&gt;./src&lt;/directory&gt;
        &lt;/whitelist&gt;
    &lt;/filter&gt;

&lt;/phpunit&gt;
</code></pre></pre><h3>Writing tests</h3><p>Our example module has two classes, a service and a controller. Let&#x27;s write the tests for both of them.</p><p>The subjects under test (both classes we are going to test) can be found in the example repository. <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/zf2-testing/blob/master/src/Service/MyService.php">MyService</a> and <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/zf2-testing/blob/master/src/Controller/IndexController.php">IndexController</a>.</p><p><strong>MyServiceTest</strong>:</p><pre><pre><code class="language-php">&lt;?php
namespace MyModuleTest\Service;

use MyModule\Service\MyService;
use PHPUnit_Framework_TestCase as TestCase;
use Zend\EventManager\Event;
use Zend\EventManager\EventManager;

class MyServiceTest extends TestCase
{
    /**
     * @var MyService
     */
    private $myService;

    public function setUp()
    {
        $this-&gt;myService = new MyService();
        $this-&gt;myService-&gt;setEventManager(new EventManager());
    }

    public function testFooEventIsTriggeredWhenCallingFoo()
    {
        // With no event handler the event is not triggered
        $fooIsTriggered = false;
        $this-&gt;myService-&gt;foo();
        $this-&gt;assertFalse($fooIsTriggered);

        // Add an event handler
        $test = $this;
        $this-&gt;myService-&gt;getEventManager()-&gt;attach(
            &#x27;foo&#x27;,
            function (Event $e) use (&amp;$fooIsTriggered, $test) {
                $fooIsTriggered = true;
                // Check the param &#x27;argument&#x27; exists with the correct value
                $test-&gt;assertEquals(&#x27;foo&#x27;, $e-&gt;getParam(&#x27;argument&#x27;));
            }
        );
        $this-&gt;myService-&gt;foo();
        // Check the event was triggered
        $this-&gt;assertTrue($fooIsTriggered);
    }

    public function testBarEventIsTriggeredWhenCallingBar()
    {
        // With no event handler the event is not triggered
        $barIsTriggered = false;
        $this-&gt;myService-&gt;bar();
        $this-&gt;assertFalse($barIsTriggered);

        // Add an event handler
        $test = $this;
        $this-&gt;myService-&gt;getEventManager()-&gt;attach(
            &#x27;bar&#x27;,
            function (Event $e) use (&amp;$barIsTriggered, $test) {
                $barIsTriggered = true;
                // Check the param &#x27;argument&#x27; exists with the correct value
                $test-&gt;assertEquals(&#x27;bar&#x27;, $e-&gt;getParam(&#x27;argument&#x27;));
            }
        );
        $this-&gt;myService-&gt;bar();
        // Check the event was triggered
        $this-&gt;assertTrue($barIsTriggered);
    }
}
</code></pre></pre><p>The MyService class just wraps an EventManager which handles two events. When we call MyService::foo, the event manager triggers the foo event, passing a param to it called argument with the value foo. When we call MyService::bar the same happens, but both the event triggered and the param are bar instead of foo.</p><p>In the test we check that the events are triggered if an event handler was previously attached, and that the arguments passed to the event handler are correct.</p><p>As you can see it is a simple PHPUnit test which extends <code>PHPUnit_Framework_TestCase</code>. We use some ZF2 classes just because the subject under test depends on them.</p><p><strong>IndexController</strong>:</p><pre><pre><code class="language-php">&lt;?php
namespace MyModuleTest\Controller;

use MyModule\Controller\IndexController;
use PHPUnit_Framework_TestCase as TestCase;
use Zend\Http;

class IndexControllerTest extends TestCase
{
    /**
     * @var IndexController
     */
    private $indexController;

    public function setUp()
    {
        $this-&gt;indexController = new IndexController();
    }

    public function testIndexAction()
    {
        $resp = $this-&gt;indexController-&gt;indexAction();
        $this-&gt;assertTrue(is_array($resp));
        $this-&gt;assertArrayHasKey(&#x27;foo&#x27;, $resp);
        $this-&gt;assertEquals(&#x27;bar&#x27;, $resp[&#x27;foo&#x27;]);
    }

    public function testModelAction()
    {
        $resp = $this-&gt;indexController-&gt;modelAction();
        $this-&gt;assertInstanceOf(&#x27;Zend\View\Model\ViewModel&#x27;, $resp);
        $this-&gt;assertEquals(&#x27;foo&#x27;, $resp-&gt;getVariable(&#x27;bar&#x27;));
        // Check a nonexistent variable in the model
        $this-&gt;assertNull($resp-&gt;getVariable(&#x27;nonexistent&#x27;));
    }

    public function testDeniedResponseAction()
    {
        $resp = $this-&gt;indexController-&gt;deniedResponseAction();
        $this-&gt;assertInstanceOf(&#x27;Zend\Http\Response&#x27;, $resp);
        $this-&gt;assertEquals(Http\Response::STATUS_CODE_403, $resp-&gt;getStatusCode());
        $this-&gt;assertEquals(&#x27;Permission denied&#x27;, $resp-&gt;getContent());
    }

    public function testRedirectResponseAction()
    {
        $resp = $this-&gt;indexController-&gt;redirectResponseAction();
        $this-&gt;assertInstanceOf(&#x27;Zend\Http\Response&#x27;, $resp);
        $this-&gt;assertEquals(Http\Response::STATUS_CODE_302, $resp-&gt;getStatusCode());
        $headers = $resp-&gt;getHeaders()-&gt;toArray();
        $this-&gt;assertArrayHasKey(&#x27;Location&#x27;, $headers);
        $this-&gt;assertEquals(&#x27;/home&#x27;, $headers[&#x27;Location&#x27;]);
    }
}
</code></pre></pre><p>Once again this is a simple PHPUnit test which checks every method in the IndexController class does what it&#x27;s intended to do.</p><p>In the case of controller tests there is a Zend Framework 2 component that is worth the mention, <code>Zend\Test</code>. It includes a class designed to test HTTP controllers, the <code>Zend\Test\PHPUnit\Controller\AbstractHttpControllerTestCase</code>. It extends <code>PHPUnit_Framework_TestCase</code> so it can be used as a regular test case, but it adds some new methods to check headers, routes and even CSS selectors in returned views. Complete documentation can be found <a target="_blank" rel="noopener noreferrer" href="https://framework.zend.com/manual/2.3/en/modules/zend.test.phpunit.html">here</a>.</p><h3>Conclusions</h3><p>As you can see, testing Zend Framework modules is not harder than testing any other PHP application. The key is using composer to easily bootstrapping the test suits and keeping classes simple and decoupled so that unit tests are really unit.</p><p>If you want to run this examples, clone the <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya-blog/zf2-testing">example repository</a>, run <code>php composer.phar install</code> to install all dependencies and then run <code>vendor/bin/phpunit -c tests/phpunit.xml</code> to run both tests.</p>

Unit testing Zend Framework 2 modules

<p>Authentication is one of the most usual tasks we need to resolve in medium and large web applications.</p><p>There are many kinds of authentication. We could use database table authentication, HTTP authentication, LDAP authentication or any other kind of authentication we could imagine. Maybe we need to authenticate with a web service or by using OAuth.</p><p>The perfect solution would be to have a scalable component wich, today, let us authenticate over a MySQL database and store the session in the standard PHP session, but tomorrow can be easily changed to use HTTP authentication and store the session in a PostgreSQL database, without making big changes in our code.</p><p>Zend Framework 2 implements that in the <a target="_blank" rel="noopener noreferrer" href="http://framework.zend.com/manual/2.3/en/modules/zend.authentication.intro.html">Zend\Authentication component</a></p><h3>The Zend\Authentication component</h3><p>This component has a main class, the <code>Zend\Authentication\AuthenticationService</code>, which encapsulates two adapters:</p><ul><li>The authentication adapter, which is responsible of performing the authentication itself</li><li>The storage adapter, wich is responsible of storing the identity returned by the authentication adapter after a successful authentication. That identity could be any kind of data, from a simple array to a complex object.</li></ul><p>Both of them have some predefined implementations, and we could even define our own by implementing <code>Zend\Authentication\Adapter\AdapterInterface</code> and <code>Zend\Authentication\Storage\StorageInterface</code></p><p>As for this, we could say the <strong>Zend\Authentication</strong> component implements the <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Adapter_pattern">adapter pattern</a>, because the AuthetnicationService will never do the job, but delegate both tasks to its adapters. Changing one of the adapters should result in very little code modifications, because the rest of the application depends only in the AuthenticationService.</p><h3>Installation</h3><p>The easiest and recommended way to install this component is by using <a target="_blank" rel="noopener noreferrer" href="https://getcomposer.org/">composer</a></p><p>Just run <code>php composer.phar require zendframework/zend-authentication:2.3.*</code> to get the dependency installed.</p><p>It will suggest to install other Zend Framework 2 components that you will probably need if you want to use some of the built-in adapters and storages.</p><blockquote><p>For more information on how to use composer, read <a href="/2014/07/19/dependency-management-and-autoloading-in-php-projects-with-composer/">this</a>.</p></blockquote><h3>Usage</h3><p>Let&#x27;s imagine we want our users to use database authentication (the provided username and password will be checked in a table, for example), and store their data in a simple PHP session.</p><h4>Create the service</h4><p>This could be the creation of the AuthenticationService.</p><pre><pre><code class="language-php">// [...]

// We have passwords hashed with password_hash in the database,
// so we need some application level logic to compare hased and plain passwords
$credentialCallback = function ($passwordInDatabase, $passwordProvided) {
    return password_verify($passwordProvided, $passwordInDatabase);
};

// Create the authentication adapter
/** @var \Zend\Db\Adapter\Adapter $dbAdapter */
$adapter = new \Zend\Authentication\Adapter\DbTable\CallbackCheckAdapter(
    $dbAdapter,
    &#x27;users&#x27;, // Table name
    &#x27;username&#x27;, // Identity column
    &#x27;password&#x27;, // Credential column
    $credentialCallback // This adapter will run this function in order to check the password
);

// Create the storage adapter
$storage = new \Zend\Authentication\Storage\Session();

// Finally create the service
$authService = new \Zend\Authentication\AuthenticationService($storage, $adapter);
</code></pre></pre><p>And that would be all we need. That code could be located in some kind of factory or bootstrap script. We could also use a dependency injection container implementation to create the AuthenticationService object.</p><h4>Using the service for authentication</h4><p>Then, if we need to use the autentication service to perform an authentication, this would be the code. I have created a class that could act as a controller.</p><pre><pre><code class="language-php">class MyController
{
    /**
     * @var \Zend\Authentication\AuthenticationService
     */
    protected $authService;

    public function __construct(\Zend\Authentication\AuthenticationService $authService)
    {
        // We should get the previously created AuthenticationService injected
        $this-&gt;authService = $authService;
    }

    public function loginAction($username, $password)
    {
        /** @var \Zend\Authentication\Adapter\DbTable $adapter */
        $adapter = $this-&gt;authService-&gt;getAdapter();
        $adapter-&gt;setIdentity($username);
        $adapter-&gt;setCredential($password);

        $result = $this-&gt;authService-&gt;authenticate();
        return $result-&gt;isValid() ? &#x27;Login OK!&#x27; : &#x27;Wrong username or password&#x27;;
    }
}
</code></pre></pre><p>As you can see, we have to set the identity (usually a username) and the credential (the password) to the adapter wrapped by the AuthenticationService, and then call to the method authenticate.</p><p>That method will return a <code>Zend\Authentication\Result</code> object which can be used to know if authentication was OK (by calling the <code>isValid()</code> method) and get the identity data (by calling <code>getIdentity()</code>).</p><p>In any case, if authentication was valid, the AuthenticationService will automatically store the identity in the sotrage object.</p><p>The identity data contents will depend on the adapter implementation. In the case of the DbTable adapter, it is an array with information of the user&#x27;s table row.</p><blockquote><p>For this tutorial I have avoided the database connection configuration and how we get the username and password. If you want to know how to create a database adapter (<code>Zend\Db\Adapter\Adapter</code>) in Zend Framework 2, just read <a target="_blank" rel="noopener noreferrer" href="https://framework.zend.com/manual/2.3/en/modules/zend.db.adapter.html">this article</a>.</p></blockquote><h4>Checking a stored identity</h4><p>Now that we have performed the authentication, in next requests we need to check if the user is already logged in. The AuthenticationService is also capable of that.</p><p>Since we set a PHP session storage object, it can look at that storage for a previously persisted identity. If it exists we can assume a user is already logged in.</p><p>At some kind of pre-dispatch hook, after any operation that needs atuhentication is preformed, we could do something like this.</p><pre><pre><code class="language-php">// [...]

/** @var \Zend\Authentication\AuthenticationService $authService */
if (!$authService-&gt;hasIdentity()) {
    $response = new Response();
    $response-&gt;setCode(403);
    return $response;
}

// [...]
</code></pre></pre><p>The Response object is a fake object I made up just for this example, but it represents that if the user is not logged in we return a 403 error.</p><p>We could also redirect him to the login form, that just depends on the situation, but as you can see, the <code>hasIdentity()</code> method tells us if some user was logged in.</p><h4>Deleting a stored identity</h4><p>Finally any user could want to logout from the system. The AuthenticationService allows us to destroy the stored identity by calling <code>clearIdentity()</code>, which will make the method <code>hasIdentity()</code> to return false in subsequent calls.</p><p>Let&#x27;s extend the previous <code>MyController</code> class.</p><pre><pre><code class="language-php">class MyController
{
    /**
     * @var \Zend\Authentication\AuthenticationService
     */
    protected $authService;

    public function __construct(\Zend\Authentication\AuthenticationService $authService)
    {
        // We should get the previously created AuthenticationService injected
        $this-&gt;authService = $authService;
    }

    public function loginAction($username, $password)
    {
        // [...]
    }

    public function logoutAction()
    {
        $this-&gt;authService-&gt;clearIdentity();
        return &#x27;User logged out successfully&#x27;;
    }
}
</code></pre></pre><p>And that&#x27;s pretty much all you can (and probably need) to do with the AuthenticationService.</p>

Managing authentication with Zend\Authentication in PHP projects

<p>Some time ago, on January 2014, I decided to start writing a blog.</p><p>Seemed like a good idea. I might be able to show my skills and learn new ones at the same time.</p><p>I didn&#x27;t wanted to use a very complex tool for this purpose, or to create one of my own (why to reinvent the wheel?), so I decided that blogger or wordpress could be the right options.</p><p>After weighing the pros and cons of both options I opted for wordpress, because it seemed more customizable, and having a <a target="_blank" rel="noopener noreferrer" href="https://en.wikipedia.org/wiki/Virtual_private_server">VPS</a> could ease the self-hosting task.</p><p>At the begining it was a good solution, but finally proved to be hard to control. Not easy to customize the layout, very resource consuming, hard to optimize, etc.</p><p>I looked for alternatives and found an interesting one without all the previous problems, <a target="_blank" rel="noopener noreferrer" href="https://sculpin.io/">Sculpin</a>.</p><p>We discussed the tool in the <a target="_blank" rel="noopener noreferrer" href="https://twitter.com/symfony_zgz">Symfony Zaragoza</a> group, and I really loved it from the begining.</p><h3>First approach to Sculpin</h3><p>In the Github era, many static site generators have appeared, because Github allows us to host static sites for free. Those generators allows us to make a &quot;dynamic&quot; website which is compiled into a static site.</p><p>There are many alternatives. From <a target="_blank" rel="noopener noreferrer" href="https://jekyllrb.com/">Jekyll</a>, the Github official static site generator written in ruby, to <a target="_blank" rel="noopener noreferrer" href="http://blog.getpelican.com/">Pelican</a>, another python-powered alternative.</p><p>The problem is that I&#x27;m a PHP developer, and I&#x27;m not as confortable with those languages as I am with PHP, so I looked for a PHP alternative and Sculpin appeared.</p><p>Sculpin uses Symfony components, and is fully integrated with composer. I like both tools so I finally decided to use it.</p><span class="text-muted">For more information about how to use Sculpin, it has a very good [documentation](https://sculpin.io/getstarted/).</span><h3>Migrating from Wordpress</h3><p>There was a few features in wordpress that I didn&#x27;t wanted to loose and are not easy to implement in a static site, like comments, built-in search and RSS feed. I also didn&#x27;t wanted to loose the already indexed content, so I needed to keep the old URLs, at least those pointing to the articles.</p><p>Luckily for me, there is a <a target="_blank" rel="noopener noreferrer" href="https://github.com/sculpin/sculpin-blog-skeleton">Sculpin Blog Skeleton</a> in github with many of the work already done. It includes an atom feed that is refreshed every time you compile your site.</p><p>To get comments in my static blog, I have used <a target="_blank" rel="noopener noreferrer" href="https://disqus.com/">disqus</a>. It uses a very easy javascript api to host your comments which are associated to the article&#x27;s unique URL. Also, they allow to import comments from wordpress, so I could also keep the old comments.</p><p>There are other platforms like this, but they don&#x27;t look as good as disqus.</p><p>The built-in search was one of the hardest features to implement. I have used <a target="_blank" rel="noopener noreferrer" href="http://lunrjs.com/">lunr.js</a>, a javascript full text search engine, but I was not sure how to deal with it, so I finally found a Sculpin blog using it, and copy-pasted the needed code. Thanks to <a target="_blank" rel="noopener noreferrer" href="http://blog.andrewshell.com">Andrew Shell</a> for his code.</p><p>After this I just needed to get the articles from wordpress.</p><p>Sculpin uses <a target="_blank" rel="noopener noreferrer" href="http://twig.sensiolabs.org/">twig</a> templates and/or <a target="_blank" rel="noopener noreferrer" href="http://es.wikipedia.org/wiki/Markdown">markdown</a> to write articles, so it&#x27;s easy to copy-paste html documents on them. That&#x27;s what I did. A little customization and done.</p><p>Keeping the URLs was easy, because I was using the y/m/d/foobar form in wordpress, and the Sculpin skeleton uses that format by default.</p><p>Finally I was considering to host the blog in Github, but I decided to use my VPS, to use some htaccess tricks, like some rewrite rules in order to redirect old URLs to new ones and set a customized 404 page.</p><p>The result is the blog you are now seeing.</p><h3>Conclusion</h3><p>My conclusion is that a dynamically generate static site is a good solution for a personal blog. It loads superfast, is very SEO friendly and is easily customizable, but it has an important problem. <strong>Only advanced users can use it</strong>.</p><p>The lack of <a target="_blank" rel="noopener noreferrer" href="https://es.wikipedia.org/wiki/WYSIWYG">WYSIWYG</a> editor makes users with no experience on HTML/Markdown (at least) impossible to deal with this kind of sites.</p><p>Also, the site needs to be deployed every time a new article is written.</p><p>Apart from that, as I said, It&#x27;s a good solution, and Sculpin is a really good tool. If you are curious, you can see the pre-compiled version of this blog in github, <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya/blog">here</a>.</p>

Migrating from Wordpress to Sculpin

<p>One of the common problems we have to confront when starting a new PHP project is how to handle the different dependencies we are going to have.</p><p>One could think the easier solution is to download all the libraries we are going to need, put them in a <code>lib</code> directory and add them to the version control of the project, but this could be problematic. Let&#x27;s see why.</p><p>The main problems of using this practice are this.</p><ul><li><strong>Dependencies of dependencies:</strong> Our dependencies may have their own dependencies that we will also need to download.</li><li><strong>Updates:</strong> What happens if we need a new feature in the last version of one dependendency? We are going to have to update it manually, and that can be a hard task. Baybe even the new version has new dependencies of its own that we will need to download.</li><li><strong>Autoloading:</strong> How do we deal with autoloading the classes in the dependencies? Some of them may have its own autoloading system, but anyway, we are going to need to <code>include</code> all the autoloaders of each dependency.</li></ul><p>How do we solve all of this? The answer is <a target="_blank" rel="noopener noreferrer" href="http://getcomposer.org">Composer</a>.</p><h3>Starting with composer</h3><p>Composer has become the dependency manager in the main PHP projects. It uses its own library repository (<a target="_blank" rel="noopener noreferrer" href="https://packagist.org/">packagist</a>) to handle dependencies, but you can setup private repositories too.</p><p>It uses a small configuration file, the <code>composer.json</code>, to know which are our dependencies, and it will download their dependencies recursively without us having to do anything special.</p><p>We can define an autoloading strategy in that file too, and forget about that task for our project and our dependencies.</p><p>This are some examples of famous PHP project&#x27;s <code>composer.json</code> files:</p><ul><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/zendframework/zf2/blob/master/composer.json">Zend Framework</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/symfony/symfony/blob/master/composer.json">Symfony</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/doctrine/doctrine2/blob/master/composer.json">Doctrine</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/aws/aws-sdk-php/blob/master/composer.json">AWS PHP SDK</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/Seldaek/monolog/blob/master/composer.json">Monolog</a></li><li><a target="_blank" rel="noopener noreferrer" href="https://github.com/thephpleague/flysystem/blob/master/composer.json">Flysystem</a></li></ul><p>Now lets see a simpler composer file:</p><pre><pre><code class="language-json">{
    &quot;name&quot; : &quot;acelaya/zf2-acmailer&quot;,
    &quot;description&quot; : &quot;Mail sending module for Zend Framework 2&quot;,
    &quot;type&quot; : &quot;library&quot;,
    &quot;authors&quot; : [
        {
            &quot;name&quot; : &quot;Alejandro Celaya Alastrué&quot;,
            &quot;email&quot; : &quot;alejandro@alejandrocelaya.com&quot;,
            &quot;homepage&quot; : &quot;http://www.alejandrocelaya.com&quot;,
            &quot;role&quot; : &quot;Developer&quot;
        }
    ],
    &quot;keywords&quot; : [
        &quot;mail&quot;,
        &quot;zend&quot;,
        &quot;php&quot;
    ],
    &quot;homepage&quot; : &quot;https://github.com/acelaya/ZF2-AcMailer&quot;,
    &quot;license&quot; : [
        &quot;BSD&quot;
    ],
    &quot;require&quot; : {
        &quot;php&quot; : &quot;&gt;=5.3.0&quot;,
        &quot;zendframework/zendframework&quot;: &quot;&gt;=2.2.2&quot;
    },
    &quot;require-dev&quot;: {
        &quot;phpunit/phpunit&quot;: &quot;&gt;=3.7&quot;,
        &quot;squizlabs/php_codesniffer&quot;: &quot;1.*&quot;,
        &quot;phploc/phploc&quot;: &quot;*&quot;,
        &quot;pdepend/pdepend&quot; : &quot;1.1.0&quot;,
        &quot;phpmd/phpmd&quot; : &quot;1.4.*&quot;,
        &quot;sebastian/phpcpd&quot;: &quot;*&quot;,
        &quot;theseer/phpdox&quot;: &quot;0.6.5&quot;
    },
    &quot;autoload&quot; : {
        &quot;psr-0&quot; : {
            &quot;AcMailer&quot; : &quot;src/&quot;
        },
        &quot;classmap&quot; : [
            &quot;./Module.php&quot;
        ]
    }
}
</code></pre></pre><p>This is the composer file of my Zend Framework 2 module <a target="_blank" rel="noopener noreferrer" href="https://github.com/acelaya/ZF2-AcMailer">AcMailer</a>. Let&#x27;s explain it.</p><p>The properties <strong>name</strong>, <strong>description</strong>, <strong>type</strong>, <strong>authors</strong>, <strong>keywords</strong>, <strong>homepage</strong> and <strong>license</strong> are just metadata to provide useful information to other users and ease finding the project in <a target="_blank" rel="noopener noreferrer" href="https://packagist.org/">packagist</a>.</p><p>The <strong>require</strong> property is the place where we define our dependencies and the version we want to install. We can define here the minimum required PHP version and even the php modules we need (like <code>php-pdo</code>, <code>php-intl</code> and such).</p><p>The <strong>require-dev</strong> property allows us to define other dependencies that won&#x27;t be necessery in a production environment, like testing or documentation tools.</p><p>Finally the <strong>autoload</strong> property is where we define how our own classes are loaded. It is very easy to define a <code>psr-0</code> or <code>psr-4</code> autoloading strategy, but we can even define a <code>classmap</code> with a list of paths to files.</p><blockquote><p>You don&#x27;t have to remember the <code>composer.json</code> schema. You can interactively create it by running <code>php composer.phar init</code>.</p></blockquote><h3>Installing dependencies</h3><p>Once this is defined we just need the composer binary file (usually in phar format), that can be found <a target="_blank" rel="noopener noreferrer" href="https://getcomposer.org/download/">here</a>, and run <code>php composer.phar install</code>.</p><p>This will create a <code>vendor</code> folder in the root of our project, download our dependencies there, the dependencies of our dependencies, and set-up an autoloader that will be able to load all our dependencies and our own classes as well.</p><p>After this it&#x27;s enough with a single <code>include</code> statement to <code>vendor/autoload.php</code> to be able to access any class.</p><p>If later in the project we need to update an existing dependency, add new dependencies or change the autoloading, we just need to update the information in the <code>composer.json</code> file and run <code>php composer.phar update</code> to update dependencies and autoloader.</p><blockquote><p>It is recommended to include the composer binary in the PATH to be able to run <code>composer</code> instead of <code>php composer.phar</code>.</p></blockquote><blockquote><p>If you are using a VCS like <a target="_blank" rel="noopener noreferrer" href="https://git-scm.com/">git</a> in your project you will probably want to <em>ignore</em> your <code>vendor</code> folder.</p></blockquote><h3>Advanced usages</h3><p>This should be enough to start working with composer, but it is a much more powerful tool with more features. It is not a bad idea to take a quick read to its <a target="_blank" rel="noopener noreferrer" href="https://getcomposer.org/doc/">documentation</a>, but let&#x27;s see the main advanced features.</p><ul><li><strong>Classmap autoloader:</strong> By running <code>composer dumpautoload --optimize</code> we can generate a much faster autoloader which defines a class =&gt; file map array with all the classes handled by composer. This is the more suitable autoloader for production environments.</li><li><strong>Production dependencies:</strong> If we include de modifier <code>--no-dev</code> while installing or updating dependencies, it will ignore (or remove) the <strong>require-dev</strong> dependencies. For example <code>composer update --no-dev</code></li><li><strong>Private repositories:</strong> If you want to install dependencies from repositories other than <a target="_blank" rel="noopener noreferrer" href="https://packagist.org/">packagist</a>, you can do it by using the <strong>repositories</strong> property. It supports many types of repositories, from VCS to PEAR repositories. Complete documentation <a target="_blank" rel="noopener noreferrer" href="https://getcomposer.org/doc/05-repositories.md">here</a>.</li><li><strong>Global packages:</strong> If you want to install dependencies globally, just add the <code>global</code> keyword before the <code>install</code> or <code>update</code>. That will install the dependencies in the <code>~/.composer/vendor</code> directory instead of installing them in the local <code>vendor</code> directory. For example <code>composer global update</code>.</li></ul><p>And that&#x27;s all you need to know to start working with composer.</p><p><strong>Update 2015-04-25</strong>: I&#x27;ve written an article addressing advanced concepts that is a good continuation to this one. <a href="/2015/04/25/composer-advanced-concepts/">Composer advanced concepts</a>.</p>

Alejandro Celaya | Blog

Software development, agile methodologies and open source projects.

Advanced usage of ServiceManager in Zend Framework 2

Unit testing Zend Framework 2 modules

Managing authentication with Zend\Authentication in PHP projects

Migrating from Wordpress to Sculpin

Dependency management and autoloading in php projects with composer