From 88c5e9d2690803175c65be9f0634305d50086aaf Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Fri, 7 Aug 2026 10:15:49 +0100 Subject: [PATCH 1/6] Document AuthenticatorInterface DI binding requirement Authentication's constructor requires AuthenticatorInterface, with no default implementation for a container to autowire it to. When a framework builds the middleware via autowiring rather than manual construction (e.g. applying it to a route by class name, as yiisoft/router groups commonly do), an unbound AuthenticatorInterface fails with a message that never names the actual gap: No definition or class found for "Yiisoft\Auth\Middleware\Authentication" ID. No definition or class found or resolvable for "Yiisoft\Auth\AuthenticatorInterface" while building "Yiisoft\Auth\Middleware\Authentication" -> "Yiisoft\Auth\AuthenticatorInterface". Hit for real in a production Yii3 app after adopting 3.3.0's AuthenticatorInterface split: the middleware had been referenced via autowiring across most of the app's routes with no binding ever configured, working only because it had never actually been constructed until a compiled DI container cache was invalidated by an unrelated composer update. New "Using with a DI container" README section documents the binding requirement with an example, and calls out the equally valid alternative when a route doesn't need HTTP-challenge-style authentication at all: don't apply this middleware there, rather than binding an authenticator you don't otherwise use just to satisfy the container. Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 3 ++- README.md | 25 +++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 43499db..743de95 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,8 @@ ## 3.3.1 under development -- no changes in this release. +- Enh: Document `AuthenticatorInterface` DI binding requirement for autowired `Authentication` middleware + (@rossaddison) ## 3.3.0 August 06, 2026 diff --git a/README.md b/README.md index 46c880a..3a564de 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,31 @@ public function actionIndex(\Psr\Http\Message\ServerRequestInterface $request): } ``` +### Using with a DI container + +`Authentication`'s constructor requires `\Yiisoft\Auth\AuthenticatorInterface`. If your framework builds the +middleware via autowiring — for example, applying it to a route by class name, as +[yiisoft/router](https://github.com/yiisoft/router) groups commonly do (`->middleware(Authentication::class)`) — +the container needs an explicit binding for `AuthenticatorInterface`, since there is no default implementation to +autowire it to: + +```php +// e.g. in config/web/di/auth.php +AuthenticatorInterface::class => HttpBearer::class, +``` + +Without that binding, the container fails with a message that doesn't name the actual gap: + +``` +No definition or class found for "Yiisoft\Auth\Middleware\Authentication" ID. +No definition or class found or resolvable for "Yiisoft\Auth\AuthenticatorInterface" +while building "Yiisoft\Auth\Middleware\Authentication" -> "Yiisoft\Auth\AuthenticatorInterface". +``` + +If HTTP-challenge-style authentication isn't what you need for a given route — session/cookie-based login instead, +for example — don't apply this middleware there at all; binding an authenticator you don't otherwise use just to +satisfy the container isn't the fix. + ### HTTP basic authentication Basic HTTP authentication is typically used for entering login and password in the browser. From 4204dbb738f10d2c04dccfc683a571788a1bba6d Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Fri, 7 Aug 2026 10:16:37 +0100 Subject: [PATCH 2/6] Reference PR #127 in changelog entry --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 743de95..10e0aaf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## 3.3.1 under development -- Enh: Document `AuthenticatorInterface` DI binding requirement for autowired `Authentication` middleware +- Enh #127: Document `AuthenticatorInterface` DI binding requirement for autowired `Authentication` middleware (@rossaddison) ## 3.3.0 August 06, 2026 From b0f568472576de25c1d6248cb76750f7f9d45e51 Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Fri, 7 Aug 2026 14:43:37 +0100 Subject: [PATCH 3/6] Update CHANGELOG.md --- CHANGELOG.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 10e0aaf..6cf0aa6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,6 @@ ## 3.3.1 under development -- Enh #127: Document `AuthenticatorInterface` DI binding requirement for autowired `Authentication` middleware - (@rossaddison) - ## 3.3.0 August 06, 2026 - New #113: Split `AuthenticationMethodInterface` into focused authentication and challenge interfaces (@samdark, @vjik) From 4e1ad220565f685535ddd3a1b973b8a3dfa51aa7 Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Fri, 7 Aug 2026 14:56:53 +0100 Subject: [PATCH 4/6] Update README.md --- README.md | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 3a564de..58299f6 100644 --- a/README.md +++ b/README.md @@ -56,28 +56,19 @@ public function actionIndex(\Psr\Http\Message\ServerRequestInterface $request): ### Using with a DI container -`Authentication`'s constructor requires `\Yiisoft\Auth\AuthenticatorInterface`. If your framework builds the -middleware via autowiring — for example, applying it to a route by class name, as -[yiisoft/router](https://github.com/yiisoft/router) groups commonly do (`->middleware(Authentication::class)`) — -the container needs an explicit binding for `AuthenticatorInterface`, since there is no default implementation to -autowire it to: +e.g. recurring invoice monthly cron ```php -// e.g. in config/web/di/auth.php -AuthenticatorInterface::class => HttpBearer::class, -``` +use App\Invoice\InvRecurring\CronTokenRepository; +use Yiisoft\Auth\AuthenticatorInterface; +use Yiisoft\Auth\Method\HttpBearer; -Without that binding, the container fails with a message that doesn't name the actual gap: +return [ + AuthenticatorInterface::class => static fn (CronTokenRepository $cronTokenRepository): HttpBearer => + new HttpBearer($cronTokenRepository), +]; ``` -No definition or class found for "Yiisoft\Auth\Middleware\Authentication" ID. -No definition or class found or resolvable for "Yiisoft\Auth\AuthenticatorInterface" -while building "Yiisoft\Auth\Middleware\Authentication" -> "Yiisoft\Auth\AuthenticatorInterface". -``` - -If HTTP-challenge-style authentication isn't what you need for a given route — session/cookie-based login instead, -for example — don't apply this middleware there at all; binding an authenticator you don't otherwise use just to -satisfy the container isn't the fix. ### HTTP basic authentication From b8c26a1d63ef09827afa64d0bcf89c7f2db6aa0c Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Fri, 7 Aug 2026 14:58:18 +0100 Subject: [PATCH 5/6] Update CHANGELOG.md --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6cf0aa6..43499db 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## 3.3.1 under development +- no changes in this release. + ## 3.3.0 August 06, 2026 - New #113: Split `AuthenticationMethodInterface` into focused authentication and challenge interfaces (@samdark, @vjik) From cd4f8b033ff8bc7525464645e9c443d22d4e3079 Mon Sep 17 00:00:00 2001 From: Ross Addison Date: Tue, 11 Aug 2026 17:45:00 +0100 Subject: [PATCH 6/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- README.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 58299f6..1e5b9ac 100644 --- a/README.md +++ b/README.md @@ -56,19 +56,20 @@ public function actionIndex(\Psr\Http\Message\ServerRequestInterface $request): ### Using with a DI container -e.g. recurring invoice monthly cron +When the `Yiisoft\Auth\Middleware\Authentication` middleware is created by a DI container (for example, when it is referenced by class name in router configuration), ensure the container can resolve `Yiisoft\Auth\AuthenticatorInterface` by binding it to a concrete authenticator: -```php -use App\Invoice\InvRecurring\CronTokenRepository; +~~~php use Yiisoft\Auth\AuthenticatorInterface; +use Yiisoft\Auth\IdentityWithTokenRepositoryInterface; use Yiisoft\Auth\Method\HttpBearer; return [ - AuthenticatorInterface::class => static fn (CronTokenRepository $cronTokenRepository): HttpBearer => - new HttpBearer($cronTokenRepository), + AuthenticatorInterface::class => static fn (IdentityWithTokenRepositoryInterface $identityRepository): AuthenticatorInterface => + new HttpBearer($identityRepository), ]; +~~~ -``` +If a route does not require HTTP-challenge-style authentication, do not apply the `Authentication` middleware to it. ### HTTP basic authentication