Nette API

Slovenčina

English

Slovenčina

English

Vzhľad

INFO

Changelog sa vedie po anglicky, rovnako ako v repozitári.

Change Log ​

All notable changes to this project will be documented in this file. Updates should follow the Keep a CHANGELOG principles.

[Unreleased][unreleased] ​

Planned for 4.0, developed on master. 3.x is maintained on the 3.x branch.

Changed (BC breaks) ​

  • Minimum PHP version is 8.4. CI runs on PHP 8.4 and 8.5; PHP 8.6 runs as an experimental job.
  • Raised dependency minimums: nette/application ^3.2, nette/http ^3.3, tracy/tracy ^2.10, latte/latte ^3.0.20, league/fractal ^0.21, justinrainbow/json-schema ^6.0.
  • Removed deprecated Tomaj\NetteApi\Misc\BearerTokenRepositoryInterface and Tomaj\NetteApi\Misc\StaticBearerTokenRepository. Use TokenRepositoryInterface and StaticTokenRepository.
  • All source files declare strict_types=1.
  • Constructor-promoted and readonly properties, typed class constants (ApiPresenter::DEFAULT_MASKED_LOG_HEADERS, MASKED_LOG_HEADER_VALUE) and native type declarations replace docblock-only types. Subclasses that reassigned inherited properties, or overrode methods without matching types, must be updated.
  • QueryApiKeyAuthentication, HeaderApiKeyAuthentication and CookieApiKeyAuthentication reject a non-string API key (e.g. ?api_key[]=x) with API key is not set instead of throwing a TypeError.
  • BasicAuthentication constructor parameter $autentications was renamed to $authentications (affects named arguments only).
  • ApiDecider::getApi() declares its Api return type natively.
  • BearerTokenAuthorization treats a non-string Authorization header as missing.
  • OpenApi\SchemaRegistry and OpenApi\EndpointFilter are final; SpecBuilder::$pathBuilder is typed as PathBuilderInterface.
  • Removed deprecated InputParam::setExample() and AbstractOutput::setExample(). Use addExample().
  • Validation\InputType is a string-backed enum; its string constants (InputType::INTEGER, ...) are kept. It can no longer be instantiated or extended.
  • Classes not meant for extension are final: Api, ApiHolder, EndpointIdentifier, NoAuthorization, NoRateLimit, RateLimitResponse, IpDetector, StaticIpDetector, StaticTokenRepository, ConsoleRequest, ConsoleResponse, OpenApiTransform, ParamsProcessor, InputValidator, JsonSchemaValidator, ValidationResult, DebuggerConfigurator, EnvConfigurator, QueryConfigurator. See UPGRADE-4.0.md.
  • TextApiResponse throws InvalidArgumentException for arrays and non-Stringable objects instead of outputting Array with a warning (arrays) or failing with an Error (objects); non-string values in validation messages, IP headers, console fields and OpenAPI examples are converted to strings instead of raising warnings or TypeError.

Added ​

  • Rector config with a CI dry-run job, PHP_CodeSniffer config (PSR-12), Infection mutation testing in CI, lowest-dependency test job.
  • UPGRADE-4.0.md.
  • Enums Validation\InputType, Params\ParamType (InputParam::getParamType()) and Presenters\CorsMode (accepted by ApiPresenter::setCorsHeader()). Constructors and validators accept an enum case or a string.
  • #[\Override] on all overriding methods.
  • CodeQL and OpenSSF Scorecard workflows; Scorecard badge in README.
  • OpenAPI builder interfaces (SpecBuilderInterface, PathBuilderInterface, ParameterBuilderInterface, RequestBodyBuilderInterface, ResponseBuilderInterface, SecuritySchemeBuilderInterface). OpenApiHandler, SpecBuilder and PathBuilder accept the interfaces.

Changed ​

  • Dev tools: PHPUnit ^12 || ^13, PHPStan ^2.1 (level max, no baseline), Rector ^2.2, PHP_CodeSniffer ^4.0, Infection; symfony/yaml ^7.4.12 || ^8.0.12.
  • vendor/bin/phpunit no longer requires XDEBUG_MODE=coverage; coverage reports are opt-in via composer coverage.

3.6.0 - 2026-10-27 ​

Security ​

  • BasicAuthentication and StaticTokenRepository compare passwords and tokens with hash_equals() (constant time) instead of === / in_array(). Results are unchanged, including for non-string passwords and numeric tokens, which never matched before and still don't.

Added ​

  • ApiPresenter::setCorsAllowedOrigins(): opt-in CORS allowlist based on the Origin header (with optional credentials and Vary: Origin). Existing setCorsHeader() values, including 'auto', behave exactly as before.
  • README: warning about the 'auto' CORS mode (any site can make credentialed requests) and a migration path to the allowlist.
  • ApiPresenter::setMaskedLogHeaders(): opt-in masking of sensitive request header values (Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-Api-Key by default, or a custom case-insensitive list) before they are passed to ApiLoggerInterface. Logging is unchanged unless enabled.
  • Tomaj\NetteApi\OpenApi builders (SpecBuilder, PathBuilder, ParameterBuilder, RequestBodyBuilder, ResponseBuilder, SecuritySchemeBuilder) that can be extended and replaced via DI, and helpers SchemaRegistry and EndpointFilter created per generated spec. OpenApiHandler accepts an optional SpecBuilder as the last constructor argument; links are always created by the handler's ApiLink.
  • Docs (EN + SK): OpenAPI builders and how to replace them via DI.

Changed ​

  • OpenApiHandler was split into the builders above; it now only selects the output format. The generated spec is unchanged (covered by snapshot tests).
  • Schema definitions are collected per generated spec instead of per OpenApiHandler instance.

Fixed ​

  • OpenApiHandler: endpoints with version 0 are included in the spec of version 0.
  • OpenApiHandler: examples of outputs and JSON params that are not strings or arrays (e.g. 42, true) no longer cause TypeError.
  • OpenApiHandler: numeric definition names (e.g. "definitions": {"200": ...}) are kept in components/schemas, so $ref to them works.

3.5.0 ​

Added ​

  • Added support for PHP 8.5

3.4.5 ​

Fixed ​

  • OpenApiHandler: ErrorWrongInput can contain any message in the response.

3.4.4 ​

Fixed ​

  • Multi value validation and transformation if expected type is not array but instead expects array of specific type. For example if expected type is integer and value is array of integers, validation and transformation will pass.
  • Added check for required numeric values in InputValidator's transformType method.

3.4.3 ​

Fixed ​

  • Invalid input type returned when value is empty in InputValidator

3.4.2 ​

Fixed ​

  • Input validation before authorization check in ApiPresenter (causes issues with some authorization handlers that need to check input params)

3.4.1 ​

Fixed ​

  • Don't overwrite global preflight handler if it is set and enableGlobalPreflight is called without parameter

3.4.0 ​

Added ​

  • Allowed endpoints filter for OpenApiHandler

Removed ​

  • Support for justinrainbow/json-schema (causes issues with validating schema)

3.3.0 ​

Changed ​

  • update minimum PHP to version 8.2 (currently still supported version) + update league/fractal library [BC]
  • change Inject from PHPDoc format to native PHP attribute
  • [Reverted] Remove BC addApi register method now requires ApiHandlerInterface as second parameter instead of string or service name

3.2.0 ​

Added ​

  • Input type validation for InputParam
  • Allow justinrainbow/json-schema to use v6 if necessary

3.1.0 ​

Changed ​

  • Update Request body schema in OpenApiHandler
  • Set null value when process empty file params, instead of false
  • [BC] Update to php >= 8.3, support for 8.4
  • [BC] addApi register method now requires ApiHandlerInterface as second parameter instead of string or service name

3.0.0 ​

Changed ​

  • Support for semantic versioning api.
  • [BC] DefaultHandler response code 404 instead 400
  • [BC] Added Container to API Decider
  • [BC] Output Configurator, Allows different methods for output configuration. Needs to be added to config services.
  • [BC] Error handler, Allows for custom error handling of handle method. Needs to be added to config services.
  • Query configurator rework

Added ​

  • CorsPreflightHandlerInterface - resolve multiple service registered handler error
  • Lazy API handlers

2.12.0 ​

Added ​

  • Button to copy Body content in api console
  • Ability to disable schema validation and provide additional error info with get parameters.

Changed ​

  • Handler tag wrapper has changed class from btn to label

Fixed ​

  • Allowed equal definitions in different handlers in OpenAPIHandler

2.11.0 ​

Added ​

  • Support for symfony/yaml ^5.0 and ^6.0
  • Support for JsonSerializable payload in JsonApiResponse
  • Support for latte/latte ^3.0 (Added Latte extension for ApiLink)

2.10.1 ​

Fixed ​

  • Fix null $body for php 8.0

2.10.0 - 2023-03-21 ​

Added ​

  • Allow to set expiration to false in JsonApiResponse and XmlApiResponse
  • Render body of response if there is a debug message: Tracy Debug Bar

Fixed ​

  • Fixed request url separator if url already contain some param

2.9.0 - 2022-11-10 ​

Added ​

  • Support for generating examples for RawInputParam by OpenApiHandler
  • PHP 8.1 support (league/fractal 0.20.1)
  • PHP 8.2 support
  • Support for league/fractal ~0.17 (Possible BC if you use Fractal classes, you have to update typehints)

Changed ​

  • If output doesn't match any output schema, error is just logged and output is returned in production mode

Fixed ​

  • Missing expiration params in XmlApiResponse
  • Missing body request for PUT methost

2.8.0 - 2022-06-15 ​

Changed ​

  • ApiLinkMacro now uses latte filter to avoid use presenter context (BC break in nette/application 3.1)

Fixed ​

  • BaseUrl in OpenApiHandler

2.7.0 - 2022-04-07 ​

Added ​

  • RedirectResponse which implements ResponseInterface
  • Available values now can have description in Console and OpenApiHandler. Just use associative array - keys are available values, values are their description

Fixed ​

  • Yaml format for OpenApiHandler is available only if symfony/yaml is installed
  • RedirectOutput use new RedirectResponse
  • Property with name type is now available in json schema

2.6.0 - 2021-10-08 ​

Updated ​

  • Use relaxed TokenRepositoryInterface in BearerTokenAuthorization (more info here)

2.5.0 - 2021-09-17 ​

Fixed ​

  • Empty console input fixed by adding checkbox for each parameter
  • Handling wrong input for Get and Post InputParam
  • File and cookie parameters in Open API handler
  • Correct error shown when putting non-OutputInterface into ApiHandlerInterface::outputs()

2.4.0 - 2021-04-24 ​

Added ​

  • User can set own form renderer for API console and own template file(s) for API console and for API listing

2.3.1 - 2021-04-13 ​

Fixed ​

  • Added RateLimit to ApiDecider::addApi

2.3.0 - 2021-01-20 ​

Changed ​

  • Form in API console is rendered with BootstrapVerticalRenderer instead of BootstrapRenderer (labels are over fields instead of left side)

Added ​

Fixed ​

  • Open API handler warnings about unused security schemes

  • ApiPresenter detailed error unit test

  • Compatibility with latte 2.9.0

2.2.0 - 2020-08-27 ​

Added ​

  • Added Basic authentication

2.1.0 - 2020-05-12 ​

Changed ​

  • Rewritten ApiPresenter

Added ​

  • Added API rate limit
  • Added custom headers to API console
  • Added field for timeout to API console
  • OpenAPI handler
  • Information about RESTful urls

Fixed ​

  • Fixed sending empty string in multi params
  • UrlEncoding values sending through get param inputs
  • Fixed static url part /api/ in console
  • Fixed generating urls in console for RESTful urls using ApiLink and EndpointInterface

2.0.1 - 2020-03-24 ​

Fixed ​

  • Fixed return types for ConsoleRequest::processParam() and ConsoleResponse::getResponseHeaders()

2.0.0 - 2019-06-12 ​

Changed ​

  • Updated nette libs to version 3.0.0 (BC break)
  • Added typehints (BC break)
  • Splitted InputParam to multiple subclasses (BC break)
  • Removed type TYPE_POST_JSON_KEY (BC break)
  • Wrong input now returns code 400 instead of 500 (BC break if somebody checks return code)
  • Replaced handler information array triplet (endpoint, handler, authorization) with class Api (BC break for API console usage)
  • Renamed some methods from ApiDecider (BC break)
  • Pretty JSON output in API console - without escaping unicode and slashes

Added ​

  • Added type JsonInputParam with scheme as replacement for type TYPE_POST_JSON_KEY
  • Detailed error for wrong input if debugger is enabled
  • Added summary (short description), description, tags and deprecated flag for API handlers
  • Added description, default value and example for input params
  • Added output validator

Removed ​

  • Removed support for PHP 5.6, 7.0 and hhvm (BC Break)
  • Removed deprecated class ApiResponse (BC Break)

1.17.0 - 2020-08-27 ​

Changed ​

  • Detailed error message enabled only for non production mode

1.16.0 - 2019-06-19 ​

Added ​

  • Added ApiLink Macro

1.15.0 - 2019-03-13 ​

Added ​

  • Added possibility to set own scope to Manager
  • Added JSON validation - if JSON is invalid, throw "wrong input" error instead of setting params to null

1.14.0 - 2018-08-02 ​

Added ​

  • Added possibility to set own headers for CorsPreflightHandler
  • Added expiration to JsonApiResponse

1.13.2 - 2018-03-23 ​

Fixed ​

1.13.1 - 2018-03-16 ​

Fixed ​

  • Fixed console for POST_JSON_KEY(s)

1.13.0 - 2018-03-15 ​

Added ​

  • New InputParam type - POST_JSON_KEY for parsing key from json data in post body
  • Updated leaguge/fractal and other packages minor upgrade

1.12.0 - 2018-02-08 ​

Fixed ​

  • Fixed console POST FIELDS output for integer values
  • Fixed parsing headers on nginx - missing method getallheaders

1.11.0 - 2017-05-12 ​

Added ​

  • Added possibility to send current PHPSESSID via API Web Console
  • Removed Content-Type from CORS headers

1.10.0 - 2016-12-14 ​

Added ​

  • Added X-Requested-With header to Cors handler

1.9.1 - 2016-11-28 ​

Fixed ​

  • Added possibility to send empty fields via console request

1.9.0 - 2016-11-08 ​

Added ​

  • Added support for PUT fields

1.8.1 - 2016-10-28 ​

  • Updated league/fractal library to 0.14.0

1.8.0 - 2016-09-28 ​

Added ​

  • Added cors headers - Access-Control-Allow-Headers and Access-Control-Allow-Methods

1.7.0 - 2016-09-11 ​

Added ​

  • Added default CORS preflight handler
  • Added possibility to enable global preflight handler for all handlers with enableGlobalPreflight() on ApiDecider

1.6.2 - 2016-07-22 ​

Fixed ​

  • InputParam validation of multi params, if available values are defined

1.6.1 - 2016-07-05 ​

Changed ​

  • End of support for php < 5.6
  • Service of type Tomaj\NetteApi\Misc\IpDetectorInterface is no more required if service of type Tomaj\NetteApi\Logger\ApiLoggerInterface is not configured and used
  • Service of type Tomaj\NetteApi\Logger\ApiLoggerInterface need not be named "apiLogger"

1.6.0 - 2016-05-11 ​

Added ​

  • Added Content-Length header to Json and Xml responses

1.5.0 - 2016-05-04 ​

Changed ​

  • ApiPresenter: getRequestDomain() returns port as well
  • Updated JsonApiResponse - separate charset from content type as changed in nette/application 2.3.12
  • Also change nette/application minimal version to 2.3.12

1.4.0 - 2016-04-01 ​

Changed ​

  • changed rendering in API console when available values are set

Fxed ​

  • fixed negative values for response time in API web console

1.3.0 - 2016-02-17 ​

Added ​

  • added tracy for error logging from ApiPresenter
  • added tests for ApiPresenter

1.2.0 - 2016-02-11 ​

Added ​

  • New ability to send new input types:
    • send RAW POST data
    • send COOKIES
    • send FILEs
    • (more info in readme section Inputs)
  • all new types are available in test console for easy testing api calls

1.1.0 - 2016-01-15 ​

Added ​

  • Added CORS support to ApiPresenter. Available options:
    • 'auto' - send back header Access-Control-Allow-Origin with domain that made request
    • '' - send header with '' - this will work fine if you dont need to send cookies via ajax calls to api with jquery $.ajax with xhrFields: { withCredentials: true } settings
    • 'off' - will not send any CORS header
    • other - any other value will be send in Access-Control-Allow-Origin header
  • Rewritten few internal functions

1.0.1 - 2015-01-07 ​

Fixed ​

  • Fixed parsing array variables from GET and POST when using multi InputParam

1.0.0 - 2016-01-06 ​

Added ​

First version that can be used for api. Contains

  • Authorization
  • Handling api request
  • Logging
  • UI Control for api listing
  • UI Control for web console to test api endpoints
  • Api versioning

Časté otázky ​

Čo je v sekcii Unreleased? ​

Zmeny zlúčené do hlavnej vetvy, ktoré ešte nie sú v žiadnom vydaní. Keď je prázdna, posledné vydanie obsahuje všetko. Funkcie pridané v menšom vydaní označujú poznámky ako „Od verzie 3.6.0“, pozrite si Verzie tejto dokumentácie.

Čo znamená [BC]? ​

Spätne nekompatibilnú zmenu. Objavujú sa len v hlavných vydaniach; návod na upgrade vysvetľuje, ako upraviť kód.

Ktoré vydanie opisuje táto dokumentácia? ​

Radu 3.x po posledné vydanie 3.6.0. Pozrite si Verzie tejto dokumentácie.

Vydané pod licenciou MIT.

Copyright © 2015-2026 Tomas Majer