Release v17.3.0

[oat-github-bot]

Release notes

Full change list here

• Feature EP-765 User Identity based on a Bearer access token #1181 by @wazelin

Summary by CodeRabbit

• New Features

  • Added support for signing in through JWT access tokens supplied in request headers or query parameters.
  • Added authenticated sessions with user identifiers, roles, and login details.
  • Preserved fallback support for cookie-based and anonymous sessions.

• Bug Fixes

  • Updated runtime and continuous integration coverage to include PHP 8.5.

• Tests

  • Added coverage for token parsing, authentication, query parameters, and session fallback behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: https://raw.githubusercontent.com/oat-sa/tao-code-quality/main/coderabbit/php/authoring/v1/.coderabbit.yaml (via .coderabbit.yaml)

Review profile: CHILL

Plan: Pro Plus

Run ID: 23df7cb3-bdcc-4afd-a1bd-7719cc1723b6

📥 Commits

Reviewing files that changed from the base of the PR and between d4c8002 and 4204232.

📒 Files selected for processing (6)

• .github/workflows/continuous-integration.yaml
• common/oatbox/user/BasicUser.php
• common/session/class.SessionManager.php
• composer.json
• test/unit/ConfigurationTest.php
• test/unit/common/session/SessionManagerTest.php

Disabled knowledge base sources:

• Jira integration is disabled

You can enable these sources in your CodeRabbit configuration.

---

📝 Walkthrough

Walkthrough

The PR adds BasicUser and JWT access-token session support. SessionManager extracts and parses tokens, creates authenticated sessions, and falls back to existing sessions. Tests cover token and anonymous flows. CI now includes PHP 8.5.

Changes

Access-token session support

Layer / File(s)	Summary
User and session contract common/oatbox/user/BasicUser.php, common/session/class.SessionManager.php	BasicUser stores the identifier, roles, and login. SessionManager creates authenticated BasicSession instances from token user data.
Token extraction and behavior validation common/session/class.SessionManager.php, test/unit/common/session/SessionManagerTest.php, composer.json	SessionManager reads bearer tokens and jwt query parameters, parses JWT payloads, and builds user identities. Tests cover authenticated and anonymous sessions.
PHP 8.5 CI and configuration tests .github/workflows/continuous-integration.yaml, test/unit/ConfigurationTest.php	The CI matrix adds PHP 8.5. Configuration tests update runtime and extension expectations to PHP 8.5 and use imported classes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Request
  participant SessionManager
  participant BasicUser
  participant BasicSession
  Request->>SessionManager: send bearer token or jwt query parameter
  SessionManager->>SessionManager: parse JWT payload and user identity
  SessionManager->>BasicUser: create authenticated user
  SessionManager->>BasicSession: create access-token session
  SessionManager-->>Request: return authenticated session

Loading

Possibly related PRs

• oat-sa/generis#1181: Contains the same access-token authentication, BasicUser, session-manager, dependency, CI, and test changes.

Suggested labels: ⏱️ 10-30 Min Review

Suggested reviewers: bartlomiejmarszal, karol-stelmaczonek, kirylhatalski

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v17.3.0

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 PHPStan (2.2.7)

/common/cache/class.Exception.php
/common/cache/class.FileCache.php
/common/cache/class.KeyValueCache.php
/common/cache/class.NoCache.php
/common/cache/class.NotFoundException.php
/common/cache/class.PartitionedCachable.php
/common/cache/class.PsrWrapperCache.php
/common/cache/class.PurgeCache.php
/common/cache/class.SingletonCache.php
/common/cache/interface.Cache.php
/common/class.AjaxResponse.php
/common/class.Collection.php
/common/class.Config.php
/common/class.Exception.php
/common/class.Logger.php
/common/class.Object.php
/common/class.Utils.php
/common/configuration/class.BoundableComponent.php
/common/configuration/class.Component.php
/common/configuration/class.ComponentCollection.php
/common/configuration/class.ComponentFactory.php
/common/configuration/class.ComponentFactoryException.php
/common/configuration/class.CyclicDependencyException.php
/common/configuration/class.FileSystemComponent.php
/common/configuration/class.MalformedRightsException.php
/common/configuration/

... [truncated 11241 characters] ...

ions.php
/common/report/class.RecursiveReportIterator.php
/common/report/class.Report.php
/common/session/class.AnonymousSession.php
/common/session/class.BasicSession.php
/common/session/class.DefaultSession.php
/common/session/class.RestSession.php
/common/session/class.RestrictedSession.php
PHP Fatal error: Class common_session_RestrictedSession contains 1 abstract method and must therefore be declared abstract or implement the remaining methods (common_session_Session::getContexts) in /common/session/class.RestrictedSession.php on line 32
Fatal error: Class common_session_RestrictedSession contains 1 abstract method and must therefore be declared abstract or implement the remaining methods (common_session_Session::getContexts) in /common/session/class.RestrictedSession.php on line 32

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}