Türker Yıldırım

api-design

  • Symfony 6.1 lets a controller return a plain object

    Note2 min read

    6.1 adds argument and return value resolution that removes the serialisation boilerplate from a controller action. Moving serialisation out of the action makes the controller shorter and moves…

  • Forced scoping on a nested route binding

    Note2 min read

    A nested route binding resolved both models independently, so a request for one customer’s order under another customer’s URL returned the order. The unscoped behaviour is an authorisation…

  • An audit log that a lawyer could read

    Deep dive9 min read

    A dispute, and a log that recorded that something changed. “Order updated” with no before, no after and no actor.

  • Types are gone, four years after the deprecation

    Note1 min read

    Mapping types were deprecated in 6.0, made single-only in 7.0 and removed entirely in 8.0, which is an unusually long and well-signposted removal. The four-year runway means most…

  • Two-factor as a requirement, not an option

    Note1 min read

    Optional two-factor is adopted by the people who were already careful, which is not the population it was introduced for. The reset path is the security weak point…

  • A health check format agreed across two runtimes

    Note2 min read

    A load balancer, an orchestrator and a monitoring system each want a health endpoint, and two services answering differently is two integrations. Excluding third-party dependencies is the rule…

  • Enums, and the string column that was pretending

    Deep dive16 min read

    8.1 on 25 November, and the feature PHP had been simulating with class constants for a decade. A status column holding three spellings of the same thing.

  • from() throws and tryFrom() returns null

    Note2 min read

    Hydrating an enum from a request parameter with from() produced an uncaught ValueError on the first malformed input, which was about nine minutes after deploy. The two methods…

  • Readonly properties and the value object that stops defending itself

    Deep dive10 min read

    8.1, and a keyword that removes a getter per property. Forty value objects, each with private fields and public accessors that existed only to prevent writes.

  • An additive change is not breaking unless a client validates strictly

    Note2 min read

    Adding a field to a response is safe by convention and unsafe in practice, because some client somewhere is validating against a schema that forbids unknown properties. Stating…