Download the PHP package pier-infor/nymfonya without Composer

:elephant: Nymfonya

is not a Symfony app...¯\(ツ)/¯

ʕʘ̅͜ʘ̅ʔ Why

I want :

• Play rest only.
• Slim conf.
• Console features.
• Low memory footprint.
• Minimize load files (max 150) for any final purpose.
• Response time always lower than 10ms.
• All testable.
• Packageable.
• CI compliant.

:eyes: Introduction

Involved into backend projects based on Symfony or Laravel with Angular as front, I was frustrated about performances. I turned to micro frameworks like Silex, Slim...to improve more. A lot of them have been abandonned in favor of majors actors. I can't figure why, maybe a lake of maintainers or people prefered something more generalistic and large feature oriented.

Composer package manager, introduced in 2011 changed the way to design php app with the concept of package and dependencie. Autoloading RFCs as PSR-0 then PSR-4 were introduced a bit later aligning packages with namespace as vendor/feature.
Php is still interpreted and requires sources to be loaded, parsed(AST), assembled(as opcode) then executed in Zend VM @ request time. Some companies tried to compile source with JIT to speed up these steps (HipHop, HHVM) but did not ensure compatibility with the native source... :disappointed: !

:crying_cat_face: Situation

To speed up packages's dependencies Composer introduced optimization options to build a 'resource catalog' by namespace. To speed up the interpretation process php introduced Opcache as opcode cache but first run is still slower. Despite all these benefits, some frameworks require around 3K files to boot, multiplying I/O on storage device and wasting memory.
This is frustrating :rage: !
We can do better, don't we ?

:ocean: Best practices

• Instanciate objects once.
• Inject container everywhere.
• Type hinting usage when we can (better with php => 7.3).
• Avoid slow processes as Reflection when we can.
• Prohibit functional annotations.
• Log everything (Monolog) by env even errors.
• Responds minimal error structure with error code and message even no error.
• No magic methods.
• No globals nor define.
• Avoid static.
• Declare class constant in Interfaces.

:horse: Arch

• :sunglasses: rest App.
• :tropical_fish: Extra packages as features (unsupported).
• :beer: I would say Mvc but I love to forget about controllers and use Closure instead.
• :cyclone: Configs in config/$env.
• :shell: Run with php >= 7.0.

Config

• :fish: nymfonya-config external package dependencie (supported).
• Config manager.
• Keep config as associative arrays.
• Isolate by Env.
• Testable : check autoload-dev psr-4 for namespace.

Container

• :fish: nymfonya-container external package dependencie (supported).
• not PSR-11.
• Instanciate classes with injected params.
• Roll-in precedence order.
• Container config is associative array (classname => params).
• Testable : check autoload-dev psr-4 for namespace.

Kernel & Http Foundation

• :fish: nymfonya-http-foundation external package (supported).
• Load Config.
• Run Kernel in server and cli mode.
• Instanciate services from container.
• Setup middlewares in design order (before/core/after).
• Run middleware sequence when routes match.
• Execute controler action as middleware core Closure.
• Testable : check autoload-dev psr-4 for namespace.

Services

• Config
• Logger (Monolog)
• Request (not PSR-7 yet)
• Routes
• Router
• Controller
• Response (nor PSR-7 yet)

Rules

• Request is 'Immutable'.
• Container services can be modified.
• Container injects Peel method middleware as first param.
• Container injects Constructor controller method as first param.
• Response modified at any time both by middlewares and controllers.

Middlewares

Middleware stack must contain at least one.

• Cors : play with cross domain request (\ö/ Angular OPTIONS preflight).
• Jwt : deal with auth based on Jwt Token.
• After : terminator to ensure middleware logic is fully functional.

:boom: Usage

Server

Start

From root path

Play

Postman recommended.

Middleware Jwt

Free access

• http://localhost:8888/api/v1/stat/opcache
• http://localhost:8888/api/v1/test/pokerelay
• http://localhost:8888/api/v1/restful

Bearer Token required

• http://localhost:8888/api/v1/stat/filecache
• http://localhost:8888/api/v1/test/jwtaction
• http://localhost:8888/api/v1/test/upload

Middleware Restufl

• http://localhost:8888/api/v1/restful

Middleware Cors & After

Enabled for all endpoints.

Cli

Ideal for batch mode, cron stuffs. From the root of the project. This does not require any server to be running. Middleware Jwt is disable.
Use jq to pretty or filter json in console.

Sample Auth

Sample Stat Opcache

Sample OpenApi Generator

:star2: Code

Catalog

Complexity

• run phploc

Mess

• run phpmd (mess detector)

:innocent: Tests

Run phpunit all tests.

To get the code coverage the command below then browse coverage/index.html file.

To run xdebug driver (xdebug required), considered as fat and buggy.

To run phpdbg driver (phpdbg required), faster and precise.

You can also use a very fast driver PCOV.
Check S.Bergmann travis config.

:fire: Security

Develop app is dev job, secure it is one other.

Dev side

Use filters and validators everywhere and never trust input params.

• Filters type , filter_input. , filter_input_array. , filter_var_array.

Devops side

Devops/SysAdmins should propose/setup solutions.

• Prefer php-fpm to modules for flexibility.
• Prefer Nginx to Apache for performance and http/2.
• Do not use php server in prod (single threaded).
• For static content setup varnish.

I would recommend third part services if exposed as below :

• apache(2) mod_security(2) to let OWASP breaks and logs most common attacks.
• Nginx ModSecurity.
• fail2ban in conjonction with mod_security(2) or ModSecurity to ban recurent attackers.

This should stop most common attacks but do not exempt your app to be bullet proofed.

Check your app logs with Tail for Monolog make logs reading easier.

Change some settings in php.ini

• Read Linux 25 PHP Security Best Practices For Sys Admins

:hamster: Todo

Core

• Refacto Request to use behind a proxy.
• Console tool.
• More middlewares before Acl, Waf, after Transfos...
• Implement Controller forward method.
• Implement Response redirect 30X.

Extra packages

• Model with doctrine, mongodb, elasticsearch.
• Mail with swiftmailer.

:chicken: Naming convention

• (I)nterface.
• (T)rait.

Controller action must be declared as final public.

:tongue: Conclusion

I'm aware it requires improvements on many points and I'm sorry to break most PSR.(⌐■_■)
Performance rocks (response 15ms for a 40X at first run, then 6ms).

I attempted to keep the code :

• short.
• readable and annotated.
• testable (Wip 93% methods coverage).
• explicit.
• decoupled.
• linted.
• type hinted (insofar as php v7.X compatibility).

Can't wait trying Php v8.0 JIT with DynAsm.
It should perf x4 face to v7.4 and generate native code (VM + AOT).
You can try JIT from Php v7.4 as experimental feature (compile time) !
Star and or fork then PR to improve it.
Test it and be happy or not ¯\(ツ)/¯

:panda_face: Extras

• Markdown Emoji.