v2.1.0

Fixes across the batch revocation, the MongoDB ODM and the values read from the request. Nothing has to be changed in an application using the bundle through its configuration and its services: see UPGRADE-2.1.md for the return values an application may be reading.

Fixed

• revokeAllInvalidBatch() returned the last batch read, which is empty once the loop ends, so it always returned an empty array and gesdinet:jwt:clear reported that there was nothing to revoke after deleting tokens
• revokeAllInvalidBatch() looped forever with the MongoDB ODM, as its condition tested the repository result with empty(), which is never true for the iterator the ODM returns
• revokeAllInvalidBatch() skipped expired tokens: each batch is deleted before the next is read, so the remaining tokens shift down and the offset has to stay where it is
• The document repository reads its results through Query::getIterator(), so they are the iterable the interface promises
• delete() returns 0 when the token is not in storage, which the ODM reported as 1 regardless
• The success listener no longer brings the request down when a token has no expiration date
• A refresh token without a username is rejected with an InvalidTokenException instead of a TypeError while building the passport
• refresh_token_class reports a configuration error when the class cannot be loaded, instead of a TypeError while building the container
• gesdinet:jwt:clear rejects a --batch-size that is not a positive number, which read no tokens and reported success while leaving every expired token in place
• Both request extractors check what they read before returning it, and the authentication token checks the serialized state it is given

Changed

• AuthenticationSuccessHandler::onAuthenticationSuccess() is typed ?Response, matching the handler it decorates. What is returned at runtime has not changed
• RefreshTokenRepositoryInterface documents, through a @method tag, that findOneBy() takes an optional $orderBy argument
• The php constraint is written as ^8.2, the same minimum without claiming support for a future PHP 9

Quality

Test coverage is at 98%, PHPStan runs at level 10 and the security scan runs the project's own Psalm. The suite supports PHPUnit 10.5, 12 and 13.

Full Changelog: v2.0.0...v2.1.0