fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Harden module runtime: audited listener failures and DI-first resolver

Browse Source
This commit is contained in:
Felix Schneider
2026-03-25 10:02:03 +01:00
parent a721ec0043
commit cb5f7037b2
12 changed files with 314 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/App/Container/Registrars/ServiceFactoryRegistrar.php
View File

@@ -4,6 +4,7 @@ namespace MintyPHP\App\Container\Registrars;
use MintyPHP\App\AppContainer;
use MintyPHP\App\Container\ContainerRegistrar;
use MintyPHP\App\Module\ModuleClassResolver;
use MintyPHP\App\Module\ModuleEventDispatcher;
use MintyPHP\App\Module\ModuleRegistry;
use MintyPHP\Http\CookieStoreInterface;
@@ -116,7 +117,8 @@ final class ServiceFactoryRegistrar implements ContainerRegistrar
$container->set(AccessPolicyFactory::class, static fn (AppContainer $c): AccessPolicyFactory => new AccessPolicyFactory(
$c->get(PermissionService::class),
$c->get(TenantScopeService::class),
$c->has(ModuleRegistry::class) ? $c->get(ModuleRegistry::class) : null
$c->has(ModuleRegistry::class) ? $c->get(ModuleRegistry::class) : null,
static fn (string $class): ?object => ModuleClassResolver::resolve($c, $class)
));
$container->set(UserGatewayFactory::class, static fn (AppContainer $c): UserGatewayFactory => new UserGatewayFactory(
$c->get(AccessServicesFactory::class),

50
lib/App/Module/ModuleClassResolver.php Normal file
View File

@@ -0,0 +1,50 @@
<?php
namespace MintyPHP\App\Module;
use MintyPHP\App\AppContainer;
/**
* Resolve module-declared classes from DI first and only fall back to direct
* instantiation when the class is not container-bound and has no required
* constructor arguments.
*/
final class ModuleClassResolver
{
public static function resolve(AppContainer $container, string $class): ?object
{
$class = trim($class);
if ($class === '') {
return null;
}
if ($container->has($class)) {
try {
$resolved = $container->get($class);
return is_object($resolved) ? $resolved : null;
} catch (\Throwable) {
return null;
}
}
if (!class_exists($class)) {
return null;
}
try {
$reflection = new \ReflectionClass($class);
if (!$reflection->isInstantiable()) {
return null;
}
$constructor = $reflection->getConstructor();
if ($constructor !== null && $constructor->getNumberOfRequiredParameters() > 0) {
return null;
}
return $reflection->newInstance();
} catch (\Throwable) {
return null;
}
}
}

36
lib/App/Module/ModuleEventDispatcher.php
View File

@@ -4,6 +4,8 @@ namespace MintyPHP\App\Module;
use MintyPHP\App\AppContainer;
use MintyPHP\App\Module\Contracts\EventListener;
use MintyPHP\Http\RequestContext;
use MintyPHP\Service\Audit\SystemAuditService;
/**
* Fire-and-forget event dispatcher for module lifecycle events.
@@ -19,7 +21,8 @@ final class ModuleEventDispatcher
*/
public function __construct(
private readonly array $listenerMap,
private readonly AppContainer $container
private readonly AppContainer $container,
private readonly ?SystemAuditService $systemAuditService = null
) {
}
@@ -31,19 +34,42 @@ final class ModuleEventDispatcher
$listeners = $this->listenerMap[$event] ?? [];
foreach ($listeners as $descriptor) {
$class = '';
$method = '';
try {
$class = $descriptor['class'];
$method = $descriptor['method'];
$listener = $this->container->get($class);
$listener = ModuleClassResolver::resolve($this->container, $class);
if (!$listener instanceof EventListener) {
$listener = new $class();
continue;
}
$listener->{$method}($event, $payload);
} catch (\Throwable) {
// Swallow — one failing listener must not break the chain.
} catch (\Throwable $exception) {
$this->recordListenerFailure($event, $class, $method, $exception);
}
}
}
private function recordListenerFailure(
string $event,
string $listenerClass,
string $listenerMethod,
\Throwable $exception
): void {
if ($this->systemAuditService === null) {
return;
}
$this->systemAuditService->record('module.listener.failed', 'failed', [
'metadata' => [
'module_event' => $event,
'listener_class' => $listenerClass,
'listener_method' => $listenerMethod,
'exception_class' => $exception::class,
'request_id' => RequestContext::id(),
],
]);
}
}

4
lib/App/registerContainer.php
View File

@@ -12,6 +12,7 @@ use MintyPHP\App\Container\Registrars\SettingsRegistrar;
use MintyPHP\App\Container\Registrars\UserRegistrar;
use MintyPHP\App\Module\ModuleEventDispatcher;
use MintyPHP\App\Module\ModuleRegistry;
use MintyPHP\Service\Audit\SystemAuditService;
$container = new AppContainer();
@@ -46,7 +47,8 @@ $moduleRegistry = ModuleRegistry::boot($modulesDir, $enabledModules);
$container->set(ModuleRegistry::class, static fn (): ModuleRegistry => $moduleRegistry);
$container->set(ModuleEventDispatcher::class, static fn () => new ModuleEventDispatcher(
$moduleRegistry->getEventListeners(),
$container
$container,
$container->has(SystemAuditService::class) ? $container->get(SystemAuditService::class) : null
));
// Disallow overriding existing core bindings from module registrars.

26
lib/Service/Access/AccessPolicyFactory.php
View File

@@ -15,12 +15,17 @@ class AccessPolicyFactory
private ?TenantAuthorizationPolicy $tenantAuthorizationPolicy = null;
private ?DepartmentAuthorizationPolicy $departmentAuthorizationPolicy = null;
private ?AuthorizationService $authorizationService = null;
private \Closure $moduleClassResolver;
public function __construct(
private readonly PermissionService $permissionService,
private readonly TenantScopeService $tenantScopeService,
private readonly ?ModuleRegistry $moduleRegistry = null
private readonly ?ModuleRegistry $moduleRegistry = null,
?callable $moduleClassResolver = null
) {
$this->moduleClassResolver = $moduleClassResolver !== null
? \Closure::fromCallable($moduleClassResolver)
: static fn (string $class): ?object => null;
}
public function createUserAuthorizationPolicy(): UserAuthorizationPolicy
@@ -108,26 +113,11 @@ class AccessPolicyFactory
private function instantiateModulePolicy(string $policyClass): ?AuthorizationPolicyInterface
{
if (!class_exists($policyClass)) {
return null;
}
try {
$reflection = new \ReflectionClass($policyClass);
$constructor = $reflection->getConstructor();
if ($constructor === null || $constructor->getNumberOfRequiredParameters() === 0) {
$instance = $reflection->newInstance();
return $instance instanceof AuthorizationPolicyInterface ? $instance : null;
}
if ($constructor->getNumberOfRequiredParameters() === 1) {
$instance = $reflection->newInstance($this->permissionService);
return $instance instanceof AuthorizationPolicyInterface ? $instance : null;
}
$instance = ($this->moduleClassResolver)($policyClass);
return $instance instanceof AuthorizationPolicyInterface ? $instance : null;
} catch (\Throwable) {
return null;
}
return null;
}
}

6
lib/Service/Auth/AuthSessionTenantContextService.php
View File

@@ -4,6 +4,7 @@ namespace MintyPHP\Service\Auth;
use MintyPHP\App\AppContainer;
use MintyPHP\App\Module\Contracts\SessionProvider;
use MintyPHP\App\Module\ModuleClassResolver;
use MintyPHP\App\Module\ModuleRegistry;
use MintyPHP\Http\SessionStoreInterface;
use MintyPHP\Service\User\UserTenantContextService;
@@ -70,10 +71,7 @@ class AuthSessionTenantContextService
return [];
}
foreach ($registry->getSessionProviders() as $providerClass) {
if (!class_exists($providerClass)) {
continue;
}
$provider = new $providerClass();
$provider = ModuleClassResolver::resolve($this->container, $providerClass);
if ($provider instanceof SessionProvider) {
$providers[] = $provider;
}

12
lib/Service/Auth/LdapConnectionGateway.php
View File

@@ -31,8 +31,10 @@ class LdapConnectionGateway
return @ldap_bind($conn, $dn, $password);
}
/** @return \LDAP\Result|false */
public function search(\LDAP\Connection $conn, string $baseDn, string $filter, array $attributes = [], int $scope = 0): \LDAP\Result|false
/**
* @return mixed LDAP\Result on success, false on failure.
*/
public function search(\LDAP\Connection $conn, string $baseDn, string $filter, array $attributes = [], int $scope = 0): mixed
{
if ($scope === 1) {
return @ldap_list($conn, $baseDn, $filter, $attributes);
@@ -40,8 +42,12 @@ class LdapConnectionGateway
return @ldap_search($conn, $baseDn, $filter, $attributes);
}
public function getEntries(\LDAP\Connection $conn, \LDAP\Result $result): array|false
public function getEntries(\LDAP\Connection $conn, mixed $result): array|false
{
if (!$result instanceof \LDAP\Result) {
return false;
}
return ldap_get_entries($conn, $result);
}

37
lib/Support/SearchConfig.php
View File

@@ -20,10 +20,15 @@ class SearchConfig
/** @var (callable(): ModuleRegistry)|null */
private static $moduleRegistryResolver = null;
/** @var (callable(string): ?object)|null */
private static $moduleClassResolver = null;
public static function configure(callable $moduleRegistryResolver): void
public static function configure(callable $moduleRegistryResolver, ?callable $moduleClassResolver = null): void
{
self::$moduleRegistryResolver = $moduleRegistryResolver;
self::$moduleClassResolver = $moduleClassResolver !== null
? \Closure::fromCallable($moduleClassResolver)
: null;
self::resetModuleProviders();
}
@@ -155,10 +160,7 @@ class SearchConfig
return self::$moduleProviders;
}
foreach ($registry->getSearchResources() as $providerClass) {
if (!class_exists($providerClass)) {
continue;
}
$provider = new $providerClass();
$provider = self::resolveModuleProvider($providerClass);
if ($provider instanceof SearchResourceProvider) {
self::$moduleProviders[] = $provider;
foreach ($provider->resources() as $key => $resource) {
@@ -182,6 +184,31 @@ class SearchConfig
self::$moduleProviderByKey = [];
}
private static function resolveModuleProvider(string $providerClass): ?SearchResourceProvider
{
try {
if (is_callable(self::$moduleClassResolver)) {
$resolved = (self::$moduleClassResolver)($providerClass);
return $resolved instanceof SearchResourceProvider ? $resolved : null;
}
if (!class_exists($providerClass)) {
return null;
}
$reflection = new \ReflectionClass($providerClass);
$constructor = $reflection->getConstructor();
if ($constructor !== null && $constructor->getNumberOfRequiredParameters() > 0) {
return null;
}
$instance = $reflection->newInstance();
return $instance instanceof SearchResourceProvider ? $instance : null;
} catch (\Throwable) {
return null;
}
}
public static function hotkeyPreviewResource(string $query): ?array
{
return SearchSpecialResourceProvider::hotkeyPreviewResource($query);

8
lib/Support/helpers/app.php
View File

@@ -60,7 +60,8 @@ function setAppContainer(\MintyPHP\App\AppContainer $container): void
);
\MintyPHP\Support\SearchConfig::configure(
static fn (): \MintyPHP\App\Module\ModuleRegistry => $container->get(\MintyPHP\App\Module\ModuleRegistry::class)
static fn (): \MintyPHP\App\Module\ModuleRegistry => $container->get(\MintyPHP\App\Module\ModuleRegistry::class),
static fn (string $class): ?object => \MintyPHP\App\Module\ModuleClassResolver::resolve($container, $class)
);
}
@@ -691,10 +692,7 @@ function appBuildLayoutNavContext(array $layoutAuth, array $session, array $quer
}
foreach ($moduleRegistry->getLayoutContextProviders() as $providerClass) {
if (!class_exists($providerClass)) {
continue;
}
$provider = new $providerClass();
$provider = \MintyPHP\App\Module\ModuleClassResolver::resolve($container, $providerClass);
if ($provider instanceof \MintyPHP\App\Module\Contracts\LayoutContextProvider) {
$providerData = $provider->provide($session, $container);
if (!is_array($providerData)) {