Download the PHP package rasuvaeff/yii3-outbox-webhooks-bridge without Composer
On this page you can find all versions of the php package rasuvaeff/yii3-outbox-webhooks-bridge. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package yii3-outbox-webhooks-bridge
rasuvaeff/yii3-outbox-webhooks-bridge
Русская версия
Bridges yii3-outbox and yii3-webhooks for durable at-least-once webhook delivery. Each outbox message is converted to a WebhookEvent and dispatched to configured endpoints via an injected WebhookDispatcher.
Using an AI coding assistant? llms.txt has a compact API reference designed for LLMs.
Requirements
- PHP 8.3–8.5
rasuvaeff/yii3-outbox^1.0rasuvaeff/yii3-webhooks^1.0 || ^2.0 — prefer 2.x: it carries the length-prefixed signature format and the SSRF-hardenedWebhookEndpoint(credentials in the URL, private/loopback hosts rejected unlessallowPrivateNetwork: true). The bridge consumes the same API on both lines; 2.x only rejects endpoint URLs it used to accept, at construction time in your own configuration code.- A
WebhookDispatcherimplementation (e.g. a PSR-18-based adapter in your app) - A
WebhookDeliveryStorageimplementation (e.g.yii3-webhooks-db)
Installation
Usage
1. Configure endpoints
2. Wire the publisher
3. Run the outbox processor
Behaviour
| Situation | Result |
|---|---|
Endpoint returns Delivered |
Delivery saved; message marked published |
Endpoint returns Failed |
Delivery saved; PublishException thrown → outbox retries |
| Dispatcher throws | PublishException thrown → outbox retries |
| No endpoints for type | Silent success (zero deliveries, message published) |
| Multiple endpoints, one fails | All dispatched; PublishException thrown → all retried |
Retry is all-or-nothing across endpoints
Fan-out has no partial state. If a type maps to five endpoints and the fifth
fails, publish() throws — and the outbox retries the message, not the one
endpoint. The next attempt dispatches to all five again, so the four that already
succeeded receive the event a second time.
This is deliberate: the bridge keeps no per-endpoint delivery cursor, and adding
one would duplicate state that WebhookDeliveryStorage already records. But it
has consequences you must design for:
| Consequence | What to do |
|---|---|
| Healthy endpoints get duplicates whenever any sibling fails | Receivers must deduplicate on the event id — see below. This is a requirement, not a recommendation |
WebhookDeliveryStorage gets a second row for an endpoint that already succeeded |
Do not put a unique constraint on (event_id, endpoint_url). It will raise a duplicate-key error on a perfectly normal retry, and that error surfaces as a delivery failure rather than as the schema problem it is |
| One permanently broken endpoint keeps the whole message retrying | The message reaches Failed after maxAttempts and stops — but every attempt until then re-delivers to the healthy endpoints. Keep maxAttempts low, or give a flaky endpoint its own message type so its failures cannot drag siblings along |
Event id dedup
The outbox message id is reused as the WebhookEvent id, unchanged. On retry —
including the all-or-nothing retry above — the same id is sent again, which is
what makes receiver-side deduplication possible at all.
Receivers must key idempotency on that id. It travels in the X-Webhook-Id
header when your dispatcher signs with HmacSha256Signer from yii3-webhooks;
with a different dispatcher, make sure the id is transmitted somehow, or
receivers have nothing to deduplicate on.
Two further contract details worth knowing:
occurredAtis the outbox message'screatedAt, not the moment of the delivery attempt. A receiver measuring an SLA fromoccurredAtmeasures from when the event happened, which is correct — but on a backlogged outbox a perfectly healthy delivery can look overdue. Use the transport timestamp if you want delivery latency.- Retry lives in the outbox, not in
yii3-webhooks.WebhookRetryPolicyfrom that package is not used here;Processor'sRetryPolicyis the only retry loop. Configuring both means two schedules for the same event.
Custom endpoint provider
Implement WebhookEndpointProvider to load endpoints from a database, cache, or
any runtime source:
Security
- Secrets are never stored in
WebhookDelivery(comes fromyii3-webhooks). - Use
HmacSha256Signer(fromyii3-webhooks) as yourWebhookDispatcher's signer to authenticate outbound requests. - Receivers should validate the signature via
WebhookVerifierand useReplayGuardagainst nonce replay. - Endpoint URLs are masked before they enter a
PublishExceptionmessage. The outboxProcessorlogs that message verbatim, so an endpoint carrying a credential in its query string (?access_token=…) or in its userinfo component (https://user:pass@…) would otherwise end up in every log sink the application has. Scheme, host, port, path and query keys survive — the log line stays diagnosable; query values, the password and the fragment are replaced with***. Prefer sending credentials as headers configured on theWebhookDispatcherall the same: masking is a safety net, not a licence. - The upstream half of that message is scrubbed too. A failure line is
<masked endpoint>: <upstream error>, and the upstream part is text this package did not write — a delivery'sgetLastError(), or the message of whatever the dispatcher threw. A PSR-18 client routinely puts the whole request URI into it (cURL error 7: Failed to connect ... for https://host/e?access_token=…), so masking only the endpoint would put the credential straight back into the log. Every secret the endpoint URL carries is removed from that text wherever it appears, percent-encoded or not. A short query value (?page=1) makes this over-redact the text around it, which is the cheaper of the two mistakes.
Examples
See examples/ for runnable scripts.
Development
License
BSD-3-Clause. See LICENSE.md.
All versions of yii3-outbox-webhooks-bridge with dependencies
rasuvaeff/yii3-outbox Version ^1.7
rasuvaeff/yii3-webhooks Version ^1.0 || ^2.0