I would find practical for migrating project to the boilerplate to know which files come from the boilerplate. That way it is easier to know if the example files come from our project are from the boilerplate for example.

Something like :

This file come from the Symfony-Boilerplate, you may update it or delete it depending on your project needs

Add a documentation on xDebug.

Update the stack to make xDebug works with Vagrant.

^

^

Description

We need to include Safe in the project's CI configuration.

Priority

Low

Description

We need to incorporate UUIDs into the constructors.

Proposed Implementation

This package, symfony/uid, is available for our use.

Priority

Medium

^

Hi,
thanks for your work!
Actually, it's not an issue but something more related to the docs.

I'm trying to undertand how your process with authentification.
I see that in your security.yaml you don't configure any authentificator.

But in your webapp, you use the PHPSESSID cookie that is generated by Symfony. How do you do that? ^^

I don't understand very well GraphQL, but on login, i understand that you retrieve the user from your custom user provider but then it's quite mysterious.
In a second time, i understand that you set the cookie header (on the node server) based on the cookie the user have.

If you have any spare time, to explain this part a bit more, it would be very nice
Thank you

Description

We need to create documentation that explains how to code on the frontend for seamless testing with Cypress.

Priority

Low

I think the file upload documentation is missing a few sample.

At the very end of the document, there is a simple Vue form to upload files, but you should probably also put here the GraphQL query and the PHP UseCase (and the Storable too).

That would really help understand how this works. Otherwise, you have to really now GraphQLite quite well to understand you can type-hint on a UploadedFileInterface.

https://symfony.com/doc/current/reference/constraints/Valid.html

^ from thecodingmachine Docker PHP images version 4.

Description

As part of enhancing the overall quality of our frontend codebase, we have identified the need to implement frontend unit tests.

Priority

Low

^

^

https://github.com/fabpot/local-php-security-checker

^

Description

We need to implement voters with param converters.

Priority

Description

We need to address a proxy-related issue within the frontend of our application.

Additional Information

• Upgrade to h3 1.8
• Add streamRequest option

Priority

High

Description

We need to implement Primevue and Primeflex into the application.

Priority

High

Currently, there are no links for files in the documentation.

We should add these links so that user may access to the source code easily from the documentation.

Caution: links should be related to the current version of the documentation, not the master branch.

Description

We should incorporate frontend testing into the project. Additionally, we can include it in the CI pipeline.

Priority

Low

As the faker package used by the Symfony Boilerplate is no longer maintained, we should change it to the fork that will still be maintained : https://github.com/fakerphp/faker

^ organize by application layer

Register all update / create / delete of entity in a history

^

The page creation is not take in account per the hotreload. A make down up is required when adding a new page

^

Description

We need to verify the security of headers (HSTS XFO XCTO CSP RP) within our application.

Priority

Description

We need to implement a verification process using Phpstan for the usage of Symfony's Voter component

Priority

Description

We need to implement rights and roles management system that involves using the "page-ini-data" approach. This task encompasses conducting a (POC) and engaging in discussions.

Priority

The "edit this page" link in the documentation generated by Docusaurus is broken and leads to a 404 page.

Description

We need to integrate Minio Storage Solution.

Priority

High

Environnement creation fail when the commit name have an utf8 encoding

When the host user is not 1000, the ownership is not reflected to the docker user inside the container

Description

We need to incorporate a global loader into the application.

Priority

Low

^

Description

We should perform environment initialization using CSV files.

Priority

Low

^ works better for Vagrant values.

Description

We need to implement secure same-site cookies within our application.

Priority

Description

We need to implement a secure password reset functionality that utilizes email communication for user verification and password updating.

Priority

High

In the Doctrine migration docs, we are recommanding putting "->graphqlField()" annotations directly in the schema.

See https://thecodingmachine.github.io/symfony-boilerplate/docs/database/doctrine-migrations

I think the whole "->graphqlField()" method was actually a mistake I made.
Because you cannot really add security annotations in the DB model. And therefore, by recommanding adding these annotations, we are pushing the developer into developing an insecure API.

Instead, we should recommand using a @SourceField annotation in the entity class. This is cleaner, easier to read (when you are looking for the list of fields of a class) and you can add security annotations in the SourceField annotation easily.

Currently node-sass is compiled only for amd so we may need to change some configuration to allow compatibility with arm64

https://sass-lang.com/blog/libsass-is-deprecated
https://stackoverflow.com/questions/71651500/how-do-i-install-node-sass-on-macosx-m1/71651569

^ from thecodingmachine Docker PHP images version 4.

Description

We need to implement a comprehensive error handling mechanism within our frontend.

Priority

Medium

Issue

Long running process might go out of memory (OOM) if buffered log handlers are filled

while (true) {
    $this->bufferedLogHandler->info('test');
}

fingers_crossed is buffer based so it can run into this issue.

Fix

A buffer_size should be append to the config. This settings will tell the handler to keep only the nth most recent messages so this will avoid OOM.

The configuration doc can be found there (permalink)

A value of 100 should be far enough.

GraphQLite seems to have an issue when you uses $user as argument:

    /**
     * @Query
     * @Logged
     * @Security("is_granted('GET_USER', user)")
     */
    public function user(User $user): User
    {
        // ...
    }

Here the subject of the voter, user, is always equals to the authenticated user.

Workaround: rename the argument $user.

Description

We need to implement internationalization using i18n. A merge request should have already been created.

Priority

Some files from private storage may be serve "inline" (images etc.). Add cache.