v0.1.2 — Housekeeping, checks that run themselves, and MIT

Housekeeping, checks that run themselves, and a licence that matches where the code lives.

Two kinds of row that accumulate, with opposite defaults

An expired remember-me token does not work any more; it is only taking up room. Nothing is decided about it, so nothing needs configuring — over is over, and the maintenance job drops them.

A history is the other case. How long to keep one is a policy somebody answers for, so the installation states it: audit_retention_days, zero by default, and zero means forever. A log that quietly shortened itself would be worse than none at all, which is why the safeguard is the default rather than a warning.

Entries are deleted in batches of a thousand. The first time a year-old log is shortened is the only moment that matters, and one statement over a great many rows would take one lock on a table every page writes to. PostgreSQL has no LIMIT on DELETE and names the rows through a subquery instead.

An index on activities.created_at comes with it. The history has always been read newest first and paged by id, so nothing needed one; everything before a moment is a different question, and without the index a job running every minute would read the whole table to answer it.

Checks that run themselves

This package now checks every push: that the manifest is valid, that every PHP file and every template parses, and that the browser modules pass.

Not the whole suite, and the workflow says so. The database tests want MariaDB and PostgreSQL, the HTTP tests want a server answering over HTTPS, and the extension tests build throwaway hosts to install the examples into. That environment lives in the skeleton with its Compose file, and make test there runs all of it — 110 unit, 214 database on both engines, 3 worker, 158 HTTP, 49 JavaScript and 130 across four extension-host configurations, which is what this release was verified with.

naf/rbac and naf/websocket gained workflows too, and theirs do run their full suites.

MIT

The manifest said proprietary while this repository was private, which was consistent. It is public now and on Packagist, so that line had stopped describing anything: it told whoever installed the package that they may not use it, which is not a protection but an invitation to misread.

MIT, like the rest of the packages here. AGPL was considered and rejected — a plugin runs in this process and would arguably become a derivative work, which for an application built around plugins would poison the thing it is for.

Requires

naf/framework ^0.2.6, naf/rbac ^0.1.1. Unchanged from v0.1.1; nothing here needs a newer anything.