Require authentication v4 and conflict with older majors#335
Conversation
The LoginLink authenticator and identifier follow cakephp/authentication v4's current API (matching method signatures, CakePHP 5.1+). Move the dev requirement to v4 and declare a conflict with anything below 4.0, so consumers cannot pair this plugin with an incompatible authentication major.
There was a problem hiding this comment.
Pull request overview
This PR ensures the plugin can’t be installed alongside incompatible major versions of cakephp/authentication, aligning dependency constraints with the LoginLinkAuthenticator / LoginLinkIdentifier code that targets the v4 API.
Changes:
- Add a Composer
conflictrule blockingcakephp/authenticationversions<4.0.0. - Update the
require-devconstraint forcakephp/authenticationfrom^3.1.0to^4.0.0so CI/tests run against the correct major.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Marking draft: bumping require-dev to authentication ^4 reveals that LoginLink is not v4-ready yet. CI surfaces real v4 BC breaks:
So declaring v4-only + conflict <4.0 requires porting the LoginLink authenticator/identifier (and their tests) to authentication v4 first. Holding as draft pending that port. |
Authentication v4 made the authenticator's identifier nullable, removed IdentifierCollection, and typed the abstract identifier's default config: - use getIdentifier() instead of the now-nullable identifier property - type LoginLinkIdentifier's default config as a string-keyed array - construct the identifier directly in the authenticator test (no collection)
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #335 +/- ##
=========================================
Coverage 80.86% 80.86%
Complexity 2133 2133
=========================================
Files 85 85
Lines 5847 5847
=========================================
Hits 4728 4728
Misses 1119 1119 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Summary
Tools\Authenticator\LoginLinkAuthenticatorandTools\Identifier\LoginLinkIdentifierbuild oncakephp/authentication, but the plugin never constrains which major a consumer installs — it only pinned it inrequire-dev(^3.1.0). A consumer could therefore pair this plugin with an incompatible authentication major.The LoginLink classes follow authentication v4's current API (matching
authenticate(ServerRequestInterface): ResultInterfacesignature, CakePHP 5.1+).Change
cakephp/authentication: ^4.0.0(CI now tests against v4).conflict: cakephp/authentication: <4.0.0so the older v3 (and the CakePHP-4-only v2) can't be installed alongside this plugin.This keeps users from installing the wrong authentication version with the LoginLink feature.