added security checker and additional docs

Author: dmitriy

composer.json

@@ -31,6 +31,7 @@
     },
     "require-dev": {
         "codedungeon/phpunit-result-printer": "^0.26.0",
+        "sensiolabs/security-checker": "^5.0",
         "symfony/browser-kit": "4.2.*",
         "symfony/css-selector": "4.2.*",
         "symfony/debug-pack": "*",
@@ -67,7 +68,8 @@
     "scripts": {
         "auto-scripts": {
             "cache:clear": "symfony-cmd",
-            "assets:install %PUBLIC_DIR%": "symfony-cmd"
+            "assets:install %PUBLIC_DIR%": "symfony-cmd",
+            "security-checker security:check": "script"
         },
         "post-install-cmd": [
             "@auto-scripts"

composer.lock

@@ -0,0 +1,8 @@
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+
+    SensioLabs\Security\SecurityChecker: ~
+
+    SensioLabs\Security\Command\SecurityCheckerCommand: ~

config/packages/security_checker.yaml

@@ -0,0 +1,41 @@
+# General
+* Follow the [PSR-2 guide](https://www.php-fig.org/psr/psr-2/) in terms of style.
+* Try to keep class names informative but not too long.
+* Follow Symfony conventions and [best practices](https://symfony.com/doc/current/best_practices/index.html).
+* Separate application logic from presentation and data-persistence layers.
+* Use namespaces to group all related classes into separate folders.
+* Put stuff in the cache when its easy enough to invalidate.
+* Use [messenger](https://symfony.com/doc/current/components/messenger.html) to delegate when you don't need to wait for data to return.
+* Write documentation for all things outside of standard MVC functions.
+* Write integration and unit tests for all new features (in that order of priority).
+* All functionality needs to be "mockable", so that you can test every part of the app without 3rd party dependencies.
+* Use strict_types, scalar type hinting and return type hinting.
+
+## Exceptions
+* All Exceptions that should terminate the current request (and return an error message to the user) should be handled
+using Symfony [best practice](https://symfony.com/doc/current/controller/error_pages.html#use-kernel-exception-event).
+* All Exceptions that should be handled in the controller, or just logged for debugging, should be wrapped in a
+try catch block (catchable Exceptions).
+* Use custom Exceptions for all catchable scenarios, and try to use standard Exceptions for fatal Exceptions.
+* Use custom Exceptions to log.
+
+## Models
+Models should only be data-persistence layers, i.e. defines relationships, attributes, helper methods
+but does not fetch collections of data.
+
+## Repositories
+Most application logic in controllers should be wrapped in repository functions.
+Never lazyload more than you need.
+
+## Events
+Events for models are handled by event listeners. Please follow instruction [here](https://symfony.com/doc/current/event_dispatcher.html).
+
+## Controllers
+Keep controllers clean of application logic. They should ideally just inject repositories - either through
+the constructor (if used more than once) or in the controller method itself.
+
+## Serializers
+Use [Serializer component](https://symfony.com/doc/current/components/serializer.html) to transform model data into JSON.
+
+## Services
+Isolate 3rd party dependencies into Service classes for simple refactoring/extension.

docs/general.md

@@ -0,0 +1,7 @@
+# Configuring IDE JetBrains PhpStorm
+* Go to Settings->Plugins and install next plugins:
+    - Symfony
+    - Php Annotations
+    - Php Toolbox
+* Go to Settings->Languages & Frameworks->Php->Symfony and check "Enable plugin for this project" and set Web Directory value as "public".
+* Go to Settings->Languages & Frameworks->Php->Composer and set path to composer.json.

docs/phpstorm.md

@@ -108,9 +108,11 @@ Note: OS recommendation - Linux Ubuntu based.
 * [phpunit-result-printer](https://github.com/mikeerickson/phpunit-pretty-result-printer)
 * [browser-kit](https://github.com/symfony/browser-kit)
 * [css-selector](https://github.com/symfony/css-selector)
+* [security-checker](https://github.com/sensiolabs/security-checker)
 
 ## General guidelines
 * **[General](docs/general.md)**
+* [Configuring IDE JetBrains PhpStorm](docs/phpstorm.md)
 
 ## Working on your project
 1. For new feature development, fork `develop` branch into a new branch with one of the two patterns:

readme.md

@@ -8,6 +8,9 @@
     "codedungeon/phpunit-result-printer": {
         "version": "0.26.0"
     },
+    "composer/ca-bundle": {
+        "version": "1.1.4"
+    },
     "doctrine/annotations": {
         "version": "1.0",
         "recipe": {
@@ -190,6 +193,18 @@
             "config/packages/sensio_framework_extra.yaml"
         ]
     },
+    "sensiolabs/security-checker": {
+        "version": "4.0",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "master",
+            "version": "4.0",
+            "ref": "05daf6b214e54aed4089f3480f944a67ac3a7889"
+        },
+        "files": [
+            "config/packages/security_checker.yaml"
+        ]
+    },
     "swiftmailer/swiftmailer": {
         "version": "v6.1.3"
     },