Fix the phpseclib conflict: own the Solid-OIDC client, verify the callback, and adopt release/v* tagging

.github/workflows/create-release.yml

@@ -14,7 +14,8 @@ jobs:
           with:
             tag_name: ${{ github.ref_name }}
             name: ${{ github.ref_name }}
-            generate_release_notes: true 
+            body_path: RELEASE.md
+            generate_release_notes: true
             draft: false
             prerelease: false
           env:

.github/workflows/ember.yml

@@ -6,23 +6,22 @@ on:
     tags:
       - 'v*'
   pull_request:
-    branches: [ main ]
+    branches: [ main, 'release/v*', 'dev-v*' ]
+
+env:
+  NODE_VERSION: 22.x
 
 jobs:
   build:
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [18.x]  # Build on Node.js 18
-
     steps:
     - uses: actions/checkout@v2
 
-    - name: Setup Node.js ${{ matrix.node-version }}
+    - name: Setup Node.js ${{ env.NODE_VERSION }}
       uses: actions/setup-node@v2
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: ${{ env.NODE_VERSION }}
 
     - name: Setup pnpm
       uses: pnpm/action-setup@v2.0.1
@@ -42,10 +41,10 @@ jobs:
     steps:
     - uses: actions/checkout@v2
 
-    - name: Setup Node.js 18.x
+    - name: Setup Node.js ${{ env.NODE_VERSION }}
       uses: actions/setup-node@v2
       with:
-        node-version: 18.x
+        node-version: ${{ env.NODE_VERSION }}
 
     - name: Setup pnpm
       uses: pnpm/action-setup@v2.0.1
@@ -71,10 +70,10 @@ jobs:
     steps:
       - uses: actions/checkout@v2
 
-      - name: Setup Node.js 18.x
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@v2
         with:
-          node-version: 18.x
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v2.0.1
@@ -102,10 +101,10 @@ jobs:
     steps:
       - uses: actions/checkout@v2
 
-      - name: Setup Node.js 18.x
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
         uses: actions/setup-node@v2
         with:
-          node-version: 18.x
+          node-version: ${{ env.NODE_VERSION }}
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v2.0.1
@@ -126,35 +125,3 @@ jobs:
 
       - name: Publish to Fleetbase registry
         run: flb publish
-
-  fleetbase_publish_qa:
-    needs: build
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup Node.js 18.x
-        uses: actions/setup-node@v2
-        with:
-          node-version: 18.x
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v2.0.1
-        with:
-          version: latest
-
-      - name: Install Dependencies
-        run: pnpm install
-
-      - name: Build
-        run: pnpm run build
-
-      - name: Install Fleetbase CLI
-        run: npm i -g @fleetbase/cli npm-cli-login
-
-      - name: Login to Fleetbase Registry
-        run: npm-cli-login -u ${{SECRETS.FLEETBASE_QA_REGISTRY_USERNAME}} -p ${{SECRETS.FLEETBASE_QA_REGISTRY_PASSWORD}} -e ${{SECRETS.FLEETBASE_QA_REGISTRY_EMAIL}} -r https://registry.qa.fleetbase.io
-
-      - name: Publish to Fleetbase registry
-        run: flb publish --registry https://registry.qa.fleetbase.io

.github/workflows/release.yml

@@ -0,0 +1,48 @@
+name: Release Tag
+
+# Tags a release when a release branch is merged to main, and pushes the tag. Delegates
+# to the reusable workflow in fleetbase/fleetbase. Requires org secret _GITHUB_AUTH_TOKEN
+# (inherited); no-ops with a warning until it is set.
+#
+# It pushes the tag and nothing else — create-release.yml and the publish jobs in this
+# repository already chain off `push: tags: v*`.
+#
+# The version is never retyped: it comes from the branch name, and the tag is refused
+# unless the files below and RELEASE.md already agree with it. This repository is
+# an ember addon plus a server, so it carries composer.json, package.json and extension.json.
+# All three must be bumped together — the tag job fails if any one of them disagrees.
+#
+# RELEASE.md is required, and its first line must name the version being released. That
+# check is the only thing that can tell notes written for this release from the previous
+# release's notes nobody replaced.
+#
+# Deliberately unpinned, like postman.yml — it tracks the reusable workflow on main, so
+# there is no ref here to remember to bump.
+#
+# workflow_dispatch is the recovery path. Use it when a release failed validation and the
+# fix landed on main after the merge: re-running the merge event would check out the
+# merge commit and never see that fix.
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to tag, e.g. 1.2.3. Recovery only — a normal release reads it from the branch."
+        required: true
+permissions:
+  contents: read
+
+jobs:
+  tag:
+    if: github.event_name == 'workflow_dispatch' ||
+        (github.event.pull_request.merged == true &&
+         (startsWith(github.event.pull_request.head.ref, 'release/v') ||
+          startsWith(github.event.pull_request.head.ref, 'dev-v')))
+    uses: fleetbase/fleetbase/.github/workflows/release-tag.yml@main
+    with:
+      version-files: composer.json,package.json,extension.json
+      version: ${{ github.event.inputs.version || '' }}
+    secrets: inherit

.github/workflows/server.yml

@@ -6,7 +6,7 @@ on:
     tags:
       - 'v*'
   pull_request:
-    branches: [ main ]
+    branches: [ main, 'release/v*', 'dev-v*' ]
 
 jobs:
   build:
@@ -28,14 +28,51 @@ jobs:
         sudo apt-get update
         sudo apt-get install -y libzip-dev libgd-dev libfreetype6-dev libjpeg-dev libpng-dev imagemagick libmagickwand-dev libmemcached-dev libgeos-dev libgmp-dev default-mysql-client libicu-dev
 
+    - name: Configure Composer Auth for Github
+      run: composer config --global github-oauth.github.com ${{ secrets._GITHUB_AUTH_TOKEN }}
+
     - name: Validate composer.json and composer.lock
       run: composer validate
 
     - name: Install dependencies
       run: composer install --prefer-dist --no-progress
 
+    # test:lint rather than lint: `composer lint` runs php-cs-fixer in *fix* mode,
+    # so in CI it rewrote files in the runner and exited 0 whatever the state of
+    # the branch. The dry-run form is the actual gate, and the tree is clean now.
     - name: Run Lint
-      run: composer lint
+      run: composer test:lint
+
+    # Newly enforceable: phpstan at level max is clean against
+    # phpstan-baseline.neon, so new code is held to it.
+    - name: Run Static Analysis
+      run: composer test:types
+
+    # Re-enabled. Pest's binary resolves its autoloader from a hardcoded
+    # `vendor/`, which this package does not have -- it installs to server_vendor --
+    # so `pest` could not start here at all. scripts/pest-runner.php, taken from
+    # storefront, bridges that with a symlink for the duration of the run.
+    - name: Run Tests
+      run: composer test:unit
 
-    # - name: Run Tests -- Will add tests back after phppest issue https://github.com/pestphp/pest/issues/920 is fixed
-    #   run: composer test:unit
+    - name: Generate Coverage Baseline
+      run: XDEBUG_MODE=coverage composer coverage:baseline
+
+    - name: Upload Coverage Baseline
+      uses: actions/upload-artifact@v4
+      with:
+        name: solid-coverage-clover
+        path: coverage/clover.xml
+        if-no-files-found: error
+
+    # No --fail-under gate, unlike fleetops: most of this package predates its
+    # tests and sits at 0%, so a gate would only ever be red. The report is
+    # published so the number is visible and can be moved deliberately.
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        files: coverage/clover.xml
+        disable_search: true
+        flags: backend
+        fail_ci_if_error: false

.gitignore

@@ -31,6 +31,7 @@ composer.lock
 /server_vendor
 /server/vendor/
 .phpunit.result.cache
+/.phpunit.cache
 .php_cs.cache
 .php-cs-fixer.cache
 *.swp

README.md

@@ -7,6 +7,26 @@
     </p>
 </p>
 
+<p align="center">
+    <a href="https://github.com/fleetbase/solid">
+        <img src="https://img.shields.io/badge/repo-fleetbase%2Fsolid-111827?style=flat-square" alt="Repository">
+    </a>
+    <a href="https://github.com/fleetbase/solid/blob/main/LICENSE.md">
+        <img src="https://img.shields.io/badge/license-AGPL--3.0--or--later-blue?style=flat-square" alt="License: AGPL-3.0-or-later">
+    </a>
+    <a href="https://codecov.io/gh/fleetbase/solid">
+        <img src="https://codecov.io/gh/fleetbase/solid/branch/main/graph/badge.svg" alt="Coverage">
+    </a>
+    <a href="https://www.npmjs.com/package/@fleetbase/solid-engine">
+        <img src="https://img.shields.io/badge/npm-%40fleetbase%2Fsolid--engine-CB3837?style=flat-square" alt="NPM package">
+    </a>
+    <a href="https://packagist.org/packages/fleetbase/solid-api">
+        <img src="https://img.shields.io/badge/packagist-fleetbase%2Fsolid--api-F28D1A?style=flat-square" alt="Packagist package">
+    </a>
+    <img src="https://img.shields.io/badge/node-%3E%3D18-339933?style=flat-square" alt="Node >= 18">
+    <img src="https://img.shields.io/badge/php-%5E8.1-777BB4?style=flat-square" alt="PHP ^8.1">
+</p>
+
 # Introduction:
 
 Solid, an innovative technology developed by Sir Tim Berners-Lee, offers a groundbreaking approach to managing data by enabling decentralized data ownership and interoperability through Linked Data principles. In the realm of logistics, Solid presents a promising solution for revolutionizing supply chain management by facilitating seamless data sharing among stakeholders. This document outlines Solid's capabilities and requirements for implementing a logistics solution, along with a user needs assessment highlighting UI/UX changes necessary for optimal user experience.
@@ -162,6 +182,26 @@ Fleetbase has implemented a Solid Client which implements the Standard Solid aut
 
 - Ability to link Fleetbase account with Solid Web ID later via user settings.
 
+#### Solid-OIDC implementation
+
+The relying-party handshake lives in `server/src/Client/OpenIDConnectClient.php` and
+`server/src/Auth/`, with no third-party OIDC library. Solid-OIDC needs three things a
+general-purpose OAuth client does not provide — RFC 7591 dynamic client registration,
+RFC 9449 DPoP-bound tokens, and an issuer discovered per tenant at runtime — so the
+extension owns that code rather than wrapping a library around it. ID token
+verification follows the same conventions as Core API's `Fleetbase\Auth\OAuth\IdTokenVerifier`:
+a short-lived JWKS cache, resolution by `kid`, one forced refetch when a token names an
+unknown key, and TLS verification that is never inferred from the app environment.
+
+What the handshake checks on the authorization callback: the `state` (single use, server
+side), the ID token's signature against the provider's published JWKS, its `iss`, `aud`
+and `azp`, its expiry, its `nonce`, and that the access token is bound to the DPoP key
+this identity holds.
+
+Everything is configured under the `oidc` key of `server/config/solid.php`. The one
+setting a local development environment usually needs is `SOLID_OIDC_VERIFY_TLS=false`,
+for a Solid server with a self-signed certificate.
+
 # Funding
 
 This project is funded through [NGI0 Entrust](https://nlnet.nl/entrust), a fund established by [NLnet](https://nlnet.nl) with financial support from the European Commission's [Next Generation Internet](https://ngi.eu) program. Learn more at the [NLnet project page]( https://nlnet.nl/project/Fleetbase-Solid).