v2.3: Code review fixes, Docker deployment, and documentation update by devsimsek · Pull Request #18 · devsimsek/project-sdf

devsimsek · 2026-06-12T09:18:03Z

Summary

Bump version to v2.3 with code review bug fixes, new Docker deployment infrastructure, and comprehensive documentation update.

Code Review Fixes

#	File	Fix
1	`UserProvider.php`	`retrieveByCredentials()` iterates all credential fields, skips password
2	`Scope.php`	Added `validate()` method with allowlist enforcement
3	`SessionGuard.php`	`login()` throws `RuntimeException` when user id is null
4	`sdf/cli`	`getPortArg()` changed from static `$GLOBALS` to instance method
5	`sdf/cli`	SQLite DSN guards against double `sqlite:` prefix
6	`RedisDriver.php`	`setMultiple()` checks availability before multi/exec
7	`FileDriver.php`	`saveTagIndex()` adds `LOCK_EX` for concurrent safety
8	`Cache.php`	`normalizeKey()` removes `!-` violating PSR-16 charset
9	`Router.php`	Regex delimiter changed from `#` to `~` to avoid URL collision
10	`ModelTimestampTest.php`	Removed brittle `sleep(1)` dependency

Docker

Dockerfile — multi-stage (base/dev/production) with FrankenPHP
compose.yaml — app + MySQL 8.4 + Redis 7-alpine
Caddyfile — static serving, security headers, forbidden paths
.dockerignore — build exclusions

Documentation

README fully rewritten with all features, Docker guide, test stats
Version bumped to 2.3.0 throughout codebase

Tests: 428 tests, 763 assertions, 0 failures

…ocalization, mail, queues

…fail, hasColumn wildcards, logger docblocks

…, queue, fuse inheritance) + home nav + skill update

…, Queue - 110 new tests covering all new features - Fix Job::getPayload() to use actual property values - Fix Schema::buildCreateSql() to avoid double PK on SQLite - Fix Translator::choice() double-colon replacement - Fix Translator::matchesExplicitRule() to handle * wildcard - 393 tests total, 710 assertions, 0 failures

- StorageDriver interface with 16 methods - LocalDriver for local filesystem operations - S3Driver using AWS SDK (optional soft dependency) - Storage static facade with fromConfig() and disk() switching - Config at app/config/storage.php - 22 tests covering all operations - 415 tests total, 743 assertions, 0 failures

- Auto created_at/updated_at on save (configurable via ) - Soft delete with deleted_at column ( = true) - withTrashed() / onlyTrashed() query scopes - restore() / forceDelete() / trashed() methods - QueryBuilder IS NOT NULL support - 13 tests, 428 total, 761 assertions, 0 failures

- Bump version to 2.3.0 throughout the codebase - UserProvider::retrieveByCredentials() iterates all credential fields - Scope::validate() with allowlist enforcement - SessionGuard::login() throws on null user id - CLI getPortArg() changed to instance method using $this->argv - CLI SQLite DSN guards against double 'sqlite:' prefix - RedisDriver::setMultiple() checks availability before transaction - FileDriver::saveTagIndex() adds LOCK_EX - Cache::normalizeKey() complies with PSR-16 charset - Router regex delimiter # -> ~ to avoid URL collision - ModelTimestampTest removes brittle sleep(1) - Add Dockerfile (multi-stage), compose.yaml, Caddyfile, .dockerignore - Update README with all features, Docker guide, test stats

…o Docker dev stage

devsimsek · 2026-06-12T10:58:18Z

Code Review – v2.3

Reviewed 16 files changed in this pr.

Finding 1: Docker dev stage missing system deps + composer install (FIXED)

File: Dockerfile:28-50
Severity: HIGH
Issue: The dev stage starts fresh from dunglas/frankenphp:1-php8.4 (does not inherit from base), so it lacks system packages (git, unzip, libicu-dev, etc.) and never runs composer install. The /app/vendor/ directory would not exist in dev builds.
Fix applied: Added apt-get install for system packages and RUN composer install --no-interaction to the dev stage.

Finding 2: Unused variable in test (FIXED)

File: tests/ModelTimestampTest.php:77
Severity: LOW
Issue: $originalUpdated is assigned but never read after the sleep(1) was removed.
Fix applied: Removed the unused variable.

Finding 3: compose.yaml mounts gitignored composer.lock

File: compose.yaml:24
Severity: LOW
Issue: composer.lock is gitignored. If the host file doesn't exist, Docker creates an empty directory at the mount point, potentially breaking Composer inside the container.
Recommendation: Remove the composer.lock bind mount from the dev service, or ensure a fallback default.

All other changes look correct:

UserProvider::retrieveByCredentials() properly iterates all credential fields
Scope::validate() uses private ALL constant for allowlist
SessionGuard::login() throws RuntimeException on null ID
CLI getPortArg() now uses instance method correctly
Cache::normalizeKey() complies with PSR-16
Router # → ~ delimiter avoids URL collisions
RedisDriver/FileDriver concurrency fixes are correct
README and version bumps look accurate

…ands

devsimsek

I like the code I like and the code open code writes at the same time. Though there exist a few security issues which are well documented within youtrack. Ill fix em now.

…ssignment, CORS, queue changes

devsimsek · 2026-06-12T11:39:28Z

Finally :)

devsimsek added 8 commits June 11, 2026 13:03

feat: add PSR-3 adapter, schema builder, blade inheritance, events, l…

0578071

…ocalization, mail, queues

fix: schema id primaryKey, DB queue pop data loss, worker release on …

7dfabf7

…fail, hasColumn wildcards, logger docblocks

docs: new feature wiki pages (log, schema, events, localization, mail…

3d4af37

…, queue, fuse inheritance) + home nav + skill update

docs: fix localization range syntax and queue interface name in docs

59b4a0a

devsimsek self-assigned this Jun 12, 2026

devsimsek added the v2.3 label Jun 12, 2026

devsimsek added 2 commits June 12, 2026 11:54

feat(cli): add --clear-cache flag to serve command

51454a0

fix: remove unused variable in timestamp test, add composer install t…

94a59ef

…o Docker dev stage

ci: add GitHub Actions workflow, update project skill with tools/comm…

edf4fad

…ands

devsimsek commented Jun 12, 2026

View reviewed changes

Comment thread sdf/core/Spark.php

devsimsek commented Jun 12, 2026

View reviewed changes

Comment thread Caddyfile

devsimsek commented Jun 12, 2026

View reviewed changes

Comment thread sdf/core/Request.php

devsimsek added 3 commits June 12, 2026 13:14

docs: rewrite project-sdf skill for end users

6f3b98a

fix: resolve CI failures and YouTrack tickets SDF-21 to SDF-31

b347654

docs: update wiki and skill for router patterns, NativeMailer, mass a…

22db7c7

…ssignment, CORS, queue changes

devsimsek merged commit 618d830 into main Jun 12, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v2.3: Code review fixes, Docker deployment, and documentation update#18

v2.3: Code review fixes, Docker deployment, and documentation update#18
devsimsek merged 14 commits into
mainfrom
dev

devsimsek commented Jun 12, 2026

Uh oh!

devsimsek commented Jun 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

devsimsek left a comment

Uh oh!

Uh oh!

devsimsek commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devsimsek commented Jun 12, 2026

Summary

Code Review Fixes

Docker

Documentation

Uh oh!

devsimsek commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review – v2.3

Finding 1: Docker dev stage missing system deps + composer install (FIXED)

Finding 2: Unused variable in test (FIXED)

Finding 3: compose.yaml mounts gitignored composer.lock

Uh oh!

Uh oh!

Uh oh!

devsimsek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devsimsek commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devsimsek commented Jun 12, 2026 •

edited

Loading