Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
80cbc17
feat: import nxe-cedar src/ snapshot and rename for PHP extension
kjdev May 27, 2026
683c626
feat: add NGINX type/function compatibility layer
kjdev May 27, 2026
4a4b908
feat: implement PHP extension with PolicyStore and AuthorizationClient
kjdev May 27, 2026
d03abdf
test: cover PolicyStore and AuthorizationClient behavior with .phpt
kjdev May 27, 2026
dfc21ee
feat: support context.contextMap, entities.entityList, and non-scalar…
kjdev May 27, 2026
b7bb73b
test: cover context.contextMap, entities.entityList, and AttributeVal…
kjdev May 27, 2026
9a8851d
feat: implement isAuthorizedWithToken with a claim mapper
kjdev May 27, 2026
78e9da7
test: cover isAuthorizedWithToken golden path and error surfaces
kjdev May 27, 2026
d8bd2af
test: cover AVP PhotoFlash sample and additional Cedar syntax
kjdev May 27, 2026
21fb00e
docs: add README, MIT LICENSE, PIE manifest, and CI workflow
kjdev May 27, 2026
34d74cc
docs: add AVP drop-in replacement section to README
kjdev May 27, 2026
6e4c7ae
fix: define TSRMLS cache symbol for ZTS DSO builds
kjdev May 28, 2026
9ebd785
test: cover loadFile failure when the policy file cannot be opened
kjdev May 28, 2026
c7d9a96
test: cover strict long/boolean AttributeValue rejection
kjdev May 28, 2026
894a881
test: cover entity that is both principal and resource
kjdev May 28, 2026
6dddca7
test: use a unique temp file with guaranteed cleanup in loadFile test
kjdev May 28, 2026
0233c4b
fix: make the policy store id fallback counter atomic for ZTS safety
kjdev May 29, 2026
f9d0cf5
chore: declare ZTS as a supported build in the manifest and CI
kjdev May 29, 2026
d39fb3d
docs: mark ZTS as supported in the ZTS status section
kjdev May 29, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 67 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
name: CI

on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:

jobs:
build-and-test:
name: PHP ${{ matrix.php-version }} (${{ matrix.ts }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
php-version: ['8.4', '8.5']
ts: [nts, zts]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
set-safe-directory: true
token: ${{ github.token }}

- name: Setup PHP (${{ matrix.php-version }} ${{ matrix.ts }})
uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
with:
php-version: ${{ matrix.php-version }}
extensions: none
coverage: none
ini-values: zend.assertions=1
env:
phpts: ${{ matrix.ts }}

- name: Show PHP build info
run: |
php -v
php -r 'echo "ZTS: ", PHP_ZTS ? "yes" : "no", PHP_EOL;'
php-config --configure-options | tr ' ' '\n' | grep -i zts || true

- name: phpize
run: phpize

- name: configure
run: ./configure --enable-cedar

- name: make
run: make -j2

- name: make test
run: |
# NO_INTERACTION=1 keeps run-tests.php non-interactive on
# failure; REPORT_EXIT_STATUS=1 makes a single failed test
# fail the job.
NO_INTERACTION=1 REPORT_EXIT_STATUS=1 make test

- name: Upload failed test diffs
if: failure()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
with:
name: phpt-failures-${{ matrix.php-version }}-${{ matrix.ts }}
path: |
tests/**/*.diff
tests/**/*.log
tests/**/*.out
if-no-files-found: ignore
44 changes: 44 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
# phpize / autotools build artifacts
*.dep
*.la
*.lo
*.loT
*.o
.deps/
.libs/
.libtool
autom4te.cache/
build/
config.h
config.h.in
config.h.in~
config.log
config.nice
config.status
configure
configure~
configure.ac
configure.in
libtool
ltmain.sh
Makefile
Makefile.fragments
Makefile.global
Makefile.objects
mkinstalldirs
modules/
run-tests.php
acinclude.m4
aclocal.m4

# gen_stub.php artifacts
cedar_legacy_arginfo.h

# test artifacts
tests/**/*.diff
tests/**/*.exp
tests/**/*.log
tests/**/*.out
tests/**/*.php
tests/**/*.sh
tests/**/*.mem
26 changes: 26 additions & 0 deletions LICENSE
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
Copyright (c) 2026 Tatsuya Kamijo
Copyright (c) 2026 Bengo4.com, Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

The bundled Cedar evaluator sources under `src/cedar/` (excluding
`php_cedar_compat.h`, `php_cedar_compat.c`, and `UPSTREAM.md`) are a snapshot
of nxe-cedar (https://github.com/kjdev/nxe-cedar). They retain their original
license from upstream; see `src/cedar/UPSTREAM.md` for the snapshot commit and
re-import policy.
Loading