├── .github └── workflows │ └── test.yml ├── .php-cs-fixer.php ├── CHANGELOG.md ├── CONTRIBUTING.md ├── LICENSE.md ├── README.md ├── composer.json ├── config └── config.php └── src ├── Playback.php ├── PlaybackServiceProvider.php ├── RecordedResponse.php └── Recorder.php /.github/workflows/test.yml: -------------------------------------------------------------------------------- 1 | name: run-tests 2 | 3 | on: 4 | push: 5 | branches: 6 | - master 7 | pull_request: 8 | branches: 9 | - master 10 | 11 | jobs: 12 | test: 13 | name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }} - ${{ matrix.os }} 14 | runs-on: ${{ matrix.os }} 15 | 16 | strategy: 17 | fail-fast: true 18 | matrix: 19 | # Disable testing on windows for now... 20 | # os: [ubuntu-latest, windows-latest] 21 | os: [ubuntu-latest] 22 | php: [7.4, 8.0, 8.1] 23 | laravel: [8.*, 9.*] 24 | #stability: [prefer-lowest, prefer-stable] 25 | stability: [prefer-stable] 26 | include: 27 | - laravel: 8.* 28 | testbench: ^6.6 29 | - laravel: 9.* 30 | testbench: 7.* 31 | # Laravel 7 has no support for PHP 8.1 32 | exclude: 33 | # Laravel 9 doesn't support < PHP 8 34 | - laravel: 9.* 35 | php: 7.4 36 | 37 | services: 38 | redis: 39 | image: redis 40 | ports: 41 | - 6379:6379 42 | options: --health-cmd="redis-cli ping" --health-interval=10s --health-timeout=5s --health-retries=3 43 | 44 | steps: 45 | - name: Checkout code 46 | uses: actions/checkout@v2 47 | 48 | - name: Setup PHP 49 | uses: shivammathur/setup-php@v2 50 | with: 51 | php-version: ${{ matrix.php }} 52 | extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo 53 | coverage: none 54 | 55 | - name: Setup problem matchers 56 | run: | 57 | echo "::add-matcher::${{ runner.tool_cache }}/php.json" 58 | echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json" 59 | - name: Install dependencies 60 | run: | 61 | composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update 62 | composer update --${{ matrix.stability }} --prefer-dist --no-interaction 63 | - name: Execute tests 64 | run: vendor/bin/phpunit -------------------------------------------------------------------------------- /.php-cs-fixer.php: -------------------------------------------------------------------------------- 1 | notPath('vendor') 5 | ->in([ 6 | __DIR__ . '/src', 7 | __DIR__ . '/tests', 8 | __DIR__ . '/config', 9 | ]) 10 | ->name('*.php') 11 | ->notName('*.blade.php') 12 | ->ignoreDotFiles(true) 13 | ->ignoreVCS(true); 14 | 15 | $config = new PhpCsFixer\Config(); 16 | 17 | return $config->setRules([ 18 | '@PSR2' => true, 19 | 'array_syntax' => ['syntax' => 'short'], 20 | 'ordered_imports' => ['sort_algorithm' => 'length'], 21 | 'no_unused_imports' => true, 22 | 'not_operator_with_successor_space' => true, 23 | 'trailing_comma_in_multiline' => true, 24 | 'phpdoc_scalar' => true, 25 | 'unary_operator_spaces' => true, 26 | 'binary_operator_spaces' => true, 27 | 'blank_line_before_statement' => [ 28 | 'statements' => ['break', 'continue', 'declare', 'return', 'throw', 'try'], 29 | ], 30 | 'phpdoc_single_line_var_spacing' => true, 31 | 'phpdoc_var_without_name' => true, 32 | 'class_attributes_separation' => [ 33 | 'elements' => [ 34 | 'method' => 'one', 35 | ], 36 | ], 37 | 'method_argument_space' => [ 38 | 'on_multiline' => 'ensure_fully_multiline', 39 | 'keep_multiple_spaces_after_comma' => true, 40 | ], 41 | 'single_trait_insert_per_statement' => true, 42 | ]) 43 | ->setFinder($finder); 44 | -------------------------------------------------------------------------------- /CHANGELOG.md: -------------------------------------------------------------------------------- 1 | # Changelog 2 | 3 | All notable changes to `swiftmade/playback` will be documented in this file 4 | 5 | ## 0.1.0 - 2020-09-23 6 | 7 | - initial release 8 | 9 | ## 0.2.0 - 2020-09-24 10 | 11 | - Fix lock key 12 | - Add a test case for the handling of race condition 13 | - Minor refactor and documentation improvements 14 | - Remove predis dependency -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing 2 | 3 | Contributions are **welcome** and will be fully **credited**. 4 | 5 | Please read and understand the contribution guide before creating an issue or pull request. 6 | 7 | ## Etiquette 8 | 9 | This project is open source, and as such, the maintainers give their free time to build and maintain the source code 10 | held within. They make the code freely available in the hope that it will be of use to other developers. It would be 11 | extremely unfair for them to suffer abuse or anger for their hard work. 12 | 13 | Please be considerate towards maintainers when raising issues or presenting pull requests. Let's show the 14 | world that developers are civilized and selfless people. 15 | 16 | It's the duty of the maintainer to ensure that all submissions to the project are of sufficient 17 | quality to benefit the project. Many developers have different skillsets, strengths, and weaknesses. Respect the maintainer's decision, and do not be upset or abusive if your submission is not used. 18 | 19 | ## Viability 20 | 21 | When requesting or submitting new features, first consider whether it might be useful to others. Open 22 | source projects are used by many developers, who may have entirely different needs to your own. Think about 23 | whether or not your feature is likely to be used by other users of the project. 24 | 25 | ## Procedure 26 | 27 | Before filing an issue: 28 | 29 | - Attempt to replicate the problem, to ensure that it wasn't a coincidental incident. 30 | - Check to make sure your feature suggestion isn't already present within the project. 31 | - Check the pull requests tab to ensure that the bug doesn't have a fix in progress. 32 | - Check the pull requests tab to ensure that the feature isn't already in progress. 33 | 34 | Before submitting a pull request: 35 | 36 | - Check the codebase to ensure that your feature doesn't already exist. 37 | - Check the pull requests to ensure that another person hasn't already submitted the feature or fix. 38 | 39 | ## Requirements 40 | 41 | If the project maintainer has any additional requirements, you will find them listed here. 42 | 43 | - **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](https://pear.php.net/package/PHP_CodeSniffer). 44 | 45 | - **Add tests!** - Your patch won't be accepted if it doesn't have tests. 46 | 47 | - **Document any change in behaviour** - Make sure the `README.md` and any other relevant documentation are kept up-to-date. 48 | 49 | - **Consider our release cycle** - We try to follow [SemVer v2.0.0](https://semver.org/). Randomly breaking public APIs is not an option. 50 | 51 | - **One pull request per feature** - If you want to do more than one thing, send multiple pull requests. 52 | 53 | - **Send coherent history** - Make sure each individual commit in your pull request is meaningful. If you had to make multiple intermediate commits while developing, please [squash them](https://www.git-scm.com/book/en/v2/Git-Tools-Rewriting-History#Changing-Multiple-Commit-Messages) before submitting. 54 | 55 | **Happy coding**! 56 | -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) Swiftmade OÜ 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Laravel Playback 2 | 3 | [![Latest Version on Packagist](https://img.shields.io/packagist/v/swiftmade/playback.svg?style=flat-square)](https://packagist.org/packages/swiftmade/playback) 4 | ![GitHub Actions](https://github.com/swiftmade/playback/actions/workflows/test.yml/badge.svg) 5 | [![Total Downloads](https://img.shields.io/packagist/dt/swiftmade/playback.svg?style=flat-square)](https://packagist.org/packages/swiftmade/playback) 6 | 7 | _Idempotent endpoints in Laravel à la Stripe._ 8 | 9 | Playback gives you idempotent endpoints in Laravel, using Redis locks. [What's even idempotency, and why should I care?](https://stripe.com/docs/api/idempotent_requests) 10 | 11 | ## Features 12 | 13 | - 📼 Records and plays back 2xx and 5xx responses, without running your controller code again. 14 | - 🔐 Built-in validation to prevent attacks by stolen/guessed idempotency keys. 15 | - ⚠️ Won't store the response if there was a validation error (4xx). 16 | - 🏎 Prevents race conditions using atomical Redis locks. 17 | 18 | ## Installation 19 | 20 | > 💡 Supports Laravel 8.x, Laravel 9.x on PHP 7.4, 8.0 or 8.1 21 | 22 | 1. You can install the package via composer: 23 | 24 | ```bash 25 | composer require swiftmade/playback 26 | ``` 27 | 28 | 2. Publish the config file (optional): 29 | 30 | ```bash 31 | php artisan vendor:publish --provider="Swiftmade\Playback\PlaybackServiceProvider" 32 | ``` 33 | 34 | 3. Add the playback cache store 35 | 36 | Open `config/cache.php` and add a new store. 37 | 38 | ```php 39 | 'stores' => [ 40 | // ... other stores 41 | 'playback' => [ 42 | 'driver' => 'redis', 43 | // 👇🏻 Caution! 44 | // You probably don't want to use the cache connection in production. 45 | // Playback cache can grow to a big size for busy applications. 46 | // Make sure your redis instance is ready. 47 | 'connection' => 'cache', 48 | ], 49 | ] 50 | ``` 51 | 52 | 💡 **Apply the middleware** 53 | 54 | Just apply the `Swiftmade\Playback\Playback` middleware to your endpoints. There are many ways of doing it, so here's a link to the docs: 55 | 56 | - https://laravel.com/docs/9.x/middleware 57 | 58 | ## Use 59 | 60 | Even when middleware is active on a route, it's business as usual unless the client sends an `Idempotency-Key` in their request header. 61 | 62 | ``` 63 | Idempotency-Key: preferrably uuid4, but anything flies 64 | ``` 65 | 66 | Once Playback detects a key, it'll look it up in redis. If found, it will serve the same response **without hitting your controller action again**. You can know that happened by looking at the response headers. If it contains `Is-Playback`, you know it's just a repetition. 67 | 68 | If the key is not found during the lookup, a race begins. The first request to acquire the redis lock gets to process the request and cache the response. Any other unlucky requests that land during that time window will return `425` status code. 69 | 70 | #### Errors: 71 | 72 | - **400 Bad Request** 73 | If you get back status `400`, it means your request was not identical to the cached one. It's the client's responsibility to repeat the exact same request. This is also why another user can't steal a response just by stealing/guessing the idempotency key. The cookies/authentication token would be different, which fails the signature check. 74 | 75 | - **425 Too Early** 76 | If you get this error, it means you retried too fast after your initial attempt. Don't panic and try again a second later or so. It's perfectly safe to do so! 77 | 78 | 🚨 Pro tip: If your controller action returns 4xx or 3xx status code, Playback won't cache the response. It's your responsibility to ensure no side effects take place (or they are rolled back) if a validation fails, a related db record was not found, etc and therefore the response status is 4xx or 3xx. 79 | 80 | ### Testing 81 | 82 | ```bash 83 | composer test 84 | ``` 85 | 86 | ### Changelog 87 | 88 | Please see [CHANGELOG](CHANGELOG.md) for more information what has changed recently. 89 | 90 | ## Contributing 91 | 92 | Please see [CONTRIBUTING](CONTRIBUTING.md) for details. 93 | 94 | ### Security 95 | 96 | If you discover any security related issues, please email hello@swiftmade.co instead of using the issue tracker. 97 | 98 | ## Credits 99 | 100 | - [Ahmet Özisik](https://github.com/swiftmade) 101 | - [All Contributors](../../contributors) 102 | 103 | ## License 104 | 105 | The MIT License (MIT). Please see [License File](LICENSE.md) for more information. 106 | -------------------------------------------------------------------------------- /composer.json: -------------------------------------------------------------------------------- 1 | { 2 | "name": "swiftmade/playback", 3 | "description": "Implement idempotent endpoints in Laravel à la Stripe", 4 | "keywords": [ 5 | "laravel", 6 | "idempotent" 7 | ], 8 | "homepage": "https://github.com/swiftmade/playback", 9 | "license": "MIT", 10 | "type": "library", 11 | "authors": [ 12 | { 13 | "name": "Ahmet Özisik", 14 | "email": "hello@swiftmade.co", 15 | "role": "Developer" 16 | } 17 | ], 18 | "require": { 19 | "php": "^7.3|^8.0", 20 | "illuminate/support": "^8.0|^9.0" 21 | }, 22 | "require-dev": { 23 | "friendsofphp/php-cs-fixer": "^3.9", 24 | "orchestra/testbench": "^6.0|^7.0", 25 | "phpunit/phpunit": "^9.0", 26 | "spatie/async": "^1.5" 27 | }, 28 | "autoload": { 29 | "psr-4": { 30 | "Swiftmade\\Playback\\": "src" 31 | } 32 | }, 33 | "autoload-dev": { 34 | "psr-4": { 35 | "Swiftmade\\Playback\\Tests\\": "tests" 36 | } 37 | }, 38 | "scripts": { 39 | "test": "vendor/bin/phpunit", 40 | "test-coverage": "vendor/bin/phpunit --coverage-html coverage" 41 | }, 42 | "config": { 43 | "sort-packages": true 44 | }, 45 | "extra": { 46 | "laravel": { 47 | "providers": [ 48 | "Swiftmade\\Playback\\PlaybackServiceProvider" 49 | ] 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /config/config.php: -------------------------------------------------------------------------------- 1 | env('PLAYBACK_DISABLED', false), 9 | 10 | /* 11 | * How long should idempotency keys survive (in seconds)? 12 | * The default is set to 1 day. 13 | */ 14 | 'ttl' => 86400, 15 | 16 | /* 17 | * Where to look for the idempotency key 18 | */ 19 | 'header_name' => 'Idempotency-Key', 20 | 21 | /* 22 | * If the response is a playback, 23 | * this header will be set 24 | */ 25 | 'playback_header_name' => 'Is-Playback', 26 | 27 | /* 28 | * If you want to create a separate cache store 29 | * for idempotency records, this is the place to do it. 30 | * 31 | * Please see config/cache.php for more details 32 | * 33 | */ 34 | 'cache_store' => 'playback', 35 | ]; 36 | -------------------------------------------------------------------------------- /src/Playback.php: -------------------------------------------------------------------------------- 1 | method() !== 'POST') { 15 | return $next($request); 16 | } 17 | 18 | // If the client did not provide a key, skip it. 19 | if (! ($key = $this->getIdempotencyKey($request))) { 20 | return $next($request); 21 | } 22 | 23 | // If cached, play back the response. 24 | if ($recordedResponse = Recorder::find($key)) { 25 | return $recordedResponse->playback( 26 | $this->requestHash($request) 27 | ); 28 | } 29 | 30 | // The key doesn't exist yet... Start a race. 31 | return Recorder::race( 32 | $key, 33 | // Winner gets to process the request 34 | function () use ($key, $request, $next) { 35 | $response = $next($request); 36 | 37 | if ($this->isResponseRecordable($response)) { 38 | Recorder::save( 39 | $key, 40 | $this->requestHash($request), 41 | $response 42 | ); 43 | } 44 | 45 | return $response; 46 | }, 47 | // Too early for the losers 48 | function () { 49 | return abort(425, 'Your request is still being processed.' 50 | . 'You retried too early. You can safely retry later.'); 51 | } 52 | ); 53 | } 54 | 55 | protected function isResponseRecordable(Response $response): bool 56 | { 57 | $status = $response->getStatusCode(); 58 | 59 | return ($status >= 200 && $status <= 299) 60 | || ($status >= 500 && $status <= 599); 61 | } 62 | 63 | protected function getIdempotencyKey(Request $request) 64 | { 65 | if ($key = $request->header(config('playback.header_name'))) { 66 | return $key; 67 | } 68 | } 69 | 70 | protected function requestHash(Request $request): string 71 | { 72 | // TODO: We may use a faster hashing function here... 73 | return md5(json_encode( 74 | [ 75 | $request->path(), 76 | $request->all(), 77 | $request->headers->all(), 78 | ] 79 | )); 80 | } 81 | } 82 | -------------------------------------------------------------------------------- /src/PlaybackServiceProvider.php: -------------------------------------------------------------------------------- 1 | app->runningInConsole()) { 15 | $this->publishes([ 16 | __DIR__ . '/../config/config.php' => config_path('playback.php'), 17 | ], 'config'); 18 | 19 | // Registering package commands. 20 | // $this->commands([]); 21 | } 22 | } 23 | 24 | /** 25 | * Register the application services. 26 | */ 27 | public function register() 28 | { 29 | // Automatically apply the package configuration 30 | $this->mergeConfigFrom(__DIR__ . '/../config/config.php', 'playback'); 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /src/RecordedResponse.php: -------------------------------------------------------------------------------- 1 | key = $key; 19 | $this->body = $body; 20 | $this->status = $status; 21 | $this->headers = $headers; 22 | $this->requestHash = $requestHash; 23 | } 24 | 25 | /** 26 | * @param string $key 27 | * @param string $requestHash 28 | * @param Response|JsonResponse $response 29 | */ 30 | public static function fromResponse($key, $requestHash, $response) 31 | { 32 | return new self( 33 | $key, 34 | $requestHash, 35 | $response->getContent(), 36 | $response->getStatusCode(), 37 | $response->headers->all() 38 | ); 39 | } 40 | 41 | public function playback($requestHash) 42 | { 43 | if ($requestHash !== $this->requestHash) { 44 | abort(400, 'Keys for idempotent requests can only be used with ' 45 | . 'the same parameters they were first used with.' 46 | . 'Try using a key other than \'' . e($this->key) . '\' if' 47 | . 'you meant to execute a different request.'); 48 | } 49 | 50 | return response($this->body, $this->status, $this->headers); 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /src/Recorder.php: -------------------------------------------------------------------------------- 1 | get($key); 17 | } 18 | 19 | public static function race($key, Closure $winner, Closure $loser) 20 | { 21 | $lock = static::store()->lock(static::getRedisLockKey($key)); 22 | 23 | if ($lock->get()) { 24 | try { 25 | return $winner(); 26 | } finally { 27 | $lock->release(); 28 | } 29 | } else { 30 | return $loser(); 31 | } 32 | } 33 | 34 | /** 35 | * @param string $key 36 | * @param string $requestHash 37 | * @param JsonResponse|Response $response 38 | */ 39 | public static function save(string $key, string $requestHash, $response) 40 | { 41 | $playbackResponse = clone $response; 42 | $playbackResponse->header(config('playback.playback_header_name'), $key); 43 | 44 | static::store()->put( 45 | $key, 46 | RecordedResponse::fromResponse( 47 | $key, 48 | $requestHash, 49 | $playbackResponse 50 | ), 51 | config('playback.ttl') 52 | ); 53 | } 54 | 55 | protected static function store() 56 | { 57 | return cache()->store(config('playback.cache_store')); 58 | } 59 | 60 | protected static function getRedisKey($key) 61 | { 62 | return 'ir.' . $key; 63 | } 64 | 65 | protected static function getRedisLockKey($key) 66 | { 67 | return static::getRedisKey($key) . '.l'; 68 | } 69 | 70 | public static function flush() 71 | { 72 | self::store()->flush(); 73 | } 74 | } 75 | --------------------------------------------------------------------------------