chore(sdk): sync PHP SDK v12.0.0-rc.1

.env.example

@@ -0,0 +1,23 @@
+# Copy to v12/.env and fill in your own values (v12/.env is gitignored), or
+# export these directly before running the demo:
+#
+#   php -S localhost:8080 demo/index.php
+
+# Tenant API key from the LoginRadius admin console. Required.
+LR_API_KEY=
+
+# Server-side only. Required for registration (the demo mints a SOTT with it).
+LR_API_SECRET=
+
+# Optional server-selection trio — leave unset to use the production API.
+LR_DOMAIN=
+LR_CUSTOM_DOMAIN=
+LR_BASE_URL=
+
+# Where email links point back to.
+#
+# LR_VERIFICATION_URL must address the demo's own verify ROUTE, not the site
+# root — LoginRadius appends ?vtoken=... to it, and the handler reads that,
+# verifies the account and redirects to / with a banner.
+LR_VERIFICATION_URL=http://localhost:8080/api/auth/verify
+LR_RESET_PASSWORD_URL=http://localhost:8080/?reset=1

.github/workflows/ci.yml

@@ -0,0 +1,80 @@
+# GENERATED FILE — do not edit it in this repository.
+# This workflow is produced alongside the rest of this SDK and is overwritten
+# whenever the SDK is regenerated. Raise changes where the SDK is generated.
+#
+# These steps mirror this SDK's own build verification, with the pinned
+# composer:2.7 / php:8.1-cli images replaced by setup-php.
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # 8.1 is composer.json's declared floor — a promise to
+        # customers, and testing only above it never discovers the promise is
+        # broken. The newer versions are there to catch deprecations early.
+        php: ['8.1', '8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          # The extensions composer.json requires.
+          extensions: curl, json, mbstring
+          coverage: none
+
+      - name: Validate composer.json
+        run: composer validate --no-check-publish --no-check-all
+
+      # `update`, not `install`: composer.lock is gitignored for this SDK (see
+      # .gitignore), so there is no lock to install from. That also means CI
+      # resolves fresh dependencies on every run, which is the point for a
+      # library — it is what notices an incompatible upstream release.
+      - name: Install dependencies
+        run: composer update --prefer-dist --no-progress --no-interaction
+
+      - name: Test
+        run: vendor/bin/phpunit --testdox
+
+  style:
+    name: Code style
+    runs-on: ubuntu-latest
+    # Advisory, not a gate. The generator's own .php-cs-fixer.dist.php has a
+    # finder of in(__DIR__) excluding only vendor/test/tests, so it also lints
+    # src/Internal/OpenApi/ — generated code, formatted on a best-effort basis.
+    # Failing the build on it would block every PR on noise nobody here can fix
+    # by hand.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          extensions: curl, json, mbstring
+          coverage: none
+
+      - name: Install dependencies
+        run: composer update --prefer-dist --no-progress --no-interaction
+
+      # --allow-risky=yes: the ruleset enables strict_comparison/strict_param,
+      # which php-cs-fixer classifies as risky and refuses to run without this.
+      # That ruleset ships with this SDK rather than being overridden here.
+      - name: Check formatting
+        run: vendor/bin/php-cs-fixer fix --dry-run --diff --using-cache=no --allow-risky=yes

.github/workflows/release.yml

@@ -0,0 +1,116 @@
+# GENERATED FILE — do not edit it in this repository.
+# This workflow is produced alongside the rest of this SDK and is overwritten
+# whenever the SDK is regenerated. Raise changes where the SDK is generated.
+#
+# Packagist has nothing to push to: it reads the repository and derives versions
+# from tags, normally via a webhook. So this workflow re-runs the gate, records
+# the GitHub Release, and only nudges Packagist in case the webhook is absent.
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to release (e.g. v12.0.0-rc.1)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Release loginradius/php-sdk
+    runs-on: ubuntu-latest
+    # Requires a human approval on the 'release' environment. The Packagist
+    # credentials belong on that environment, not on the repository.
+    environment: release
+    permissions:
+      contents: write   # create the GitHub Release
+    # Job-level, not step-level: a step's own `if:` is evaluated before its
+    # `env:` block exists, so the Packagist skip below cannot see them there.
+    env:
+      PACKAGIST_USERNAME: ${{ secrets.PACKAGIST_USERNAME }}
+      PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }}
+    steps:
+      - name: Resolve tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "name=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "name=${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.tag.outputs.name }}
+          fetch-depth: 0
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          extensions: curl, json, mbstring
+          coverage: none
+
+      # composer.json carries an explicit "version" for this SDK, and Packagist
+      # will believe it over the tag. If the two disagree, customers get a
+      # version string that does not match what they installed.
+      - name: Tag matches composer.json and the SDK version
+        run: |
+          expected='12.0.0-rc.1'
+          declared="$(php -r 'echo json_decode(file_get_contents("composer.json"))->version ?? "";')"
+          tag='${{ steps.tag.outputs.name }}'
+          if [ "${declared}" != "${expected}" ]; then
+            echo "::error::composer.json version ${declared} does not match the generated SDK version ${expected}"
+            exit 1
+          fi
+          if [ "${tag}" != "v${expected}" ]; then
+            echo "::error::tag ${tag} does not match the generated SDK version v${expected}"
+            exit 1
+          fi
+
+      - name: Validate composer.json
+        # --no-check-publish is dropped here on purpose: at release time the
+        # package must actually be publishable, which is the one moment that
+        # check is worth failing on.
+        run: composer validate --no-check-all
+
+      - name: Install dependencies
+        run: composer update --prefer-dist --no-progress --no-interaction
+
+      - name: Test
+        run: vendor/bin/phpunit --testdox
+
+      - name: Create the GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.tag.outputs.name }}
+        run: |
+          if gh release view "${TAG}" >/dev/null 2>&1; then
+            echo "release ${TAG} already exists — nothing to do"
+            exit 0
+          fi
+          PRERELEASE='--prerelease'
+          gh release create "${TAG}" --verify-tag --title "${TAG}" \
+            --notes-file CHANGELOG.md ${PRERELEASE}
+
+      # Only needed when the GitHub->Packagist webhook is not configured. Left
+      # non-fatal and skipped when the secrets are absent: Packagist picking the
+      # tag up by itself is the normal path, and a missing optional credential
+      # must not fail a release that has already happened.
+      - name: Notify Packagist
+        if: ${{ env.PACKAGIST_USERNAME != '' && env.PACKAGIST_TOKEN != '' }}
+        continue-on-error: true
+        run: |
+          curl --silent --show-error --fail-with-body \
+            -X POST \
+            -H 'Content-Type: application/json' \
+            -d '{"repository":{"url":"https://github.com/${{ github.repository }}"}}' \
+            "https://packagist.org/api/update-package?username=${PACKAGIST_USERNAME}&apiToken=${PACKAGIST_TOKEN}"

.gitignore

@@ -0,0 +1,4 @@
+/vendor/
+composer.lock
+.php-cs-fixer.cache
+.phpunit.result.cache

.php-cs-fixer.dist.php

@@ -0,0 +1,29 @@
+<?php
+
+/**
+ * @generated
+ * @link https://github.com/FriendsOfPHP/PHP-CS-Fixer/blob/HEAD/doc/config.rst
+ */
+$finder = PhpCsFixer\Finder::create()
+    ->in(__DIR__)
+    ->exclude('vendor')
+    ->exclude('test')
+    ->exclude('tests')
+;
+
+$config = new PhpCsFixer\Config();
+return $config->setRules([
+        '@PSR12' => true,
+        'phpdoc_order' => true,
+        'array_syntax' => [ 'syntax' => 'short' ],
+        'strict_comparison' => true,
+        'strict_param' => true,
+        'no_trailing_whitespace' => false,
+        'no_trailing_whitespace_in_comment' => false,
+        'braces' => false,
+        'single_blank_line_at_eof' => false,
+        'blank_line_after_namespace' => false,
+        'no_leading_import_slash' => false,
+    ])
+    ->setFinder($finder)
+;