Tokenable Symfony Laravel Package

Getting Started

This release (v2.0.3) is a small but meaningful patch for anyone using the package with Doctrine inheritance. Two things changed:

1. The profiler no longer reports false "Triplet collides" / "Prefix … is already used" errors for entities that inherit #[Tokenable] from an abstract base class (JOINED or single-table inheritance). Validation now only runs on classes that actually declare the attribute, matching the Tokenizer's behaviour.
2. The profiler's "Generated URLs" panel is gone, along with the token-generation recording that fed it. The Inbound and Classes panels, URL token encoding, and the |token Twig filter are untouched.

Minimal upgrade path:

composer update <vendor>/<package>
bin/console cache:clear

Then open the profiler on a request that touches a tokenized entity in an inheritance hierarchy and confirm the bogus collision error is gone.

Where to look first:

• The #[Tokenable] attribute and the Tokenizer service — these are the source of truth for how prefixes and triplets are resolved.
• The profiler's Classes panel — it now reflects exactly what the Tokenizer will validate, so it's the fastest way to see which classes are considered "declaring".
• Your abstract base entity, if you have one — that's the scenario this release fixes.

First use case: you have an abstract BaseEntity with #[Tokenable(prefix: 'app')] and concrete subclasses using JOINED inheritance. Before 2.0.3, the profiler flagged collisions that never actually occurred at runtime. After upgrading, the profiler goes quiet and matches production behaviour.

Note for Laravel developers: this is a Symfony-flavoured package (Twig filter, Symfony Profiler data collector, Doctrine inheritance). If you're evaluating it from a Laravel codebase, the reusable core is the Tokenizer plus the attribute; the profiler integration is Symfony-only and won't apply to you. Confirm whether the tokenizer can be wired standalone before committing to it.

Implementation Patterns

Attribute placement is declarative, not inherited. Put #[Tokenable] on the class that owns the prefix. Abstract base classes can declare it; subclasses inherit the behaviour but are not re-validated. This is now consistent between profiler and Tokenizer, so you can stop adding redundant attributes to leaf classes just to appease the profiler.

Single prefix per hierarchy. With the fix in place, one #[Tokenable(prefix: '...')] on the abstract base is the intended pattern for a JOINED/single-table hierarchy. Don't sprinkle different prefixes on subclasses unless you genuinely want distinct token namespaces — and if you do, expect each declaring class to be validated independently.

Token generation in URLs. Unchanged in this release: you generate a token, embed it in a route, and use the |token Twig filter where you need the encoded form rendered. Keep the encode step in your controller/service and the filter in templates — mixing the two makes debugging harder now that the Generated URLs panel is gone.

Profiler-driven debugging. The workflow is now: hit a page, open the Inbound panel to see which tokens came in and how they resolved, and the Classes panel to see which classes were validated. Previously the Generated URLs panel gave you a quick view of outbound tokens; without it, add a temporary dump()/log at the point you build URLs, or assert on generated URLs in a functional test.

Testing with inheritance. Add a test that boots the container with your abstract base + concrete subclasses and asserts no collision exception is thrown. This is exactly the regression 2.0.3 fixes, so it's worth pinning. If you had a test asserting the Generated URLs panel exists in the profiler, delete or update it — that panel is removed.

Custom data collectors. If you extended or decorated the profiler's data collector, check your code against the new collector shape. The recording API that fed the Generated URLs panel no longer exists; anything calling it will break in dev/test environments only.

Gotchas and Tips

• Upgrade is low-risk but not zero-risk. The runtime token behaviour is unchanged; the changes are confined to the profiler and its data collector. The breaking surface is (a) the removed Generated URLs panel and (b) the removed token-generation recording API. If you have custom tooling, CI assertions, or docs screenshots referencing that panel, update them.
• The collision fix only affects the profiler. If you were seeing "Triplet collides" / "Prefix … is already used" at runtime (not in the profiler), this patch will not help — that's a genuine configuration conflict. Distinguish the two before upgrading and being disappointed.
• "Only declaring classes" is now the contract. If you relied on the profiler validating inherited attributes on subclasses, you've lost that signal. Manually verify prefix uniqueness across your declaring classes; nothing will warn you about a subclass that silently inherits a conflicting prefix from two different ancestors.
• Cache clearing matters. Attribute and prefix changes are resolved at container/compile time in Symfony setups. After editing #[Tokenable] attributes, clear the cache before trusting the profiler — stale metadata produces confusing results that look like the bug you just fixed.
• Token-in-URL security is unchanged and still on you. Tokens in URLs leak via referrers, logs, and browser history. If tokens encode database IDs, consider whether they're guessable/enumerable, and whether you need rotation or short-lived variants. This release doesn't touch that surface.
• Extension points to reach for: a custom tokenizer/encoder if you need a different token format, and the data collector if you want to re-add outbound-URL visibility yourself. The removal of Generated URLs is a good prompt to build a small, purpose-fit collector rather than restoring the old one wholesale.
• Watch the changelog for the next patch. Removing a profiler panel in a patch release (2.0.3) suggests the maintainers treat dev-only surfaces as non-breaking. Pin your dev dependencies if you depend on profiler internals.