feat(http): middleware, auth primitives, and a lazily resolved logger

[mikield]

Installing this plugin made an application fail to boot:

Cannot resolve Tempest\Log\Logger because it is not an instantiable class.

  ┌── RoutesDiscovery::__construct(Router $router, RouteCompiler $compiler)
  └── Router::__construct(Container $container, Logger $logger)

Discovery constructs the router while the container is still being assembled — before the initializers that provide the logger have themselves been found. It does this whether or not the application has any routes, so every consumer was affected, not just ones using the plugin.

The registries in the framework (EventsRegistry) and in the tasks plugin already resolve lazily for exactly this reason. This one did not.

Why the tests did not catch it

They build a container of their own with a logger already in it — which is not the container discovery has. There are now two tests for the actual constraint: one builds a Router against an empty GenericContainer and routes a request through it, and one checks the logger is still reached when a handler throws.

🤖 Generated with Claude Code

[mikield]

Pushed the stateless auth primitives onto this branch as well, since the plugin is not released with either yet.

$request->cookie('session');       // off this request's Cookie header
$request->bearerToken();           // from "Authorization: Bearer ..."

Secret::matches($configured, $request->bearerToken() ?? '');
Secret::signed($request->body(), $request->header('X-Signature') ?? '', $secret);

return Response::noContent()->withCookie(new Cookie('session', $id, secure: true));

Why these and not sessions. Everything here is stateless, which is the property that makes it safe in a process serving thousands of requests over weeks. Secret compares in constant time — === on a signature stops at the first differing byte, and that is measurable over enough requests. signed() takes the raw body, since re-encoding changes bytes and the signature is over what was sent.

Cookies default to HttpOnly, SameSite=Lax, Path=/. Secure is left to the caller: a bot behind a plain-HTTP proxy would otherwise set a cookie the browser never returns, which presents as a login loop. Values are rawurlencoded, because a browser hands + back as a plus rather than a space.

The README now also says plainly that session_start(), $_SESSION, $_COOKIE, setcookie() and friends must not be used here, and why — PHP keeps one session per process, which under FPM is one request and here is the whole uptime.

[mikield]

Added middleware support on top, since a signature check has to be able to stop a request rather than disapprove of it afterwards — and there was nowhere to put one.

#[Route(Method::POST, '/api/links', middleware: [VerifySignature::class])]

First listed is outermost; returning an answer instead of calling $next stops the handler and everything behind it in the list. Both are tested, and so is the case of something named as middleware that does not implement the interface — a 500 with the reason logged, rather than calling something that has no idea what $next is.

A handler's answer is normalised to a Response before middleware see it, so one that wraps the answer is never handed whatever a handler happened to return.

55 tests, phpstan clean. This PR is now three things — the boot fix, the auth primitives and middleware — because none of them is released yet and they only make sense together.

[github-actions]

🎉 This PR is included in version 1.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀