Weave Code
Tc Lib File Laravel Package
tecnickcom/tc-lib-file
PHP utilities for low-level file access and byte-level reading. Provides local and remote file reads with host/path allowlists, big-endian binary byte readers, a prefixed temp-file cache, and typed exceptions. Part of the TCPDF ecosystem. Requires PHP 8.2+ with curl and pcre.
PHP library for safe low-level file access: byte-level reads, path allowlisting, file caching and directory lookup
Frequently asked questions about Tc Lib File
- Should I use tc-lib-file instead of Laravel's Storage and HTTP client?
- It is not a replacement for either. Storage gives you path abstractions but no byte-level or structured binary readers, and the HTTP client gives you no host allowlist with redirect revalidation and a memory-bounded response cap. tc-lib-file is worth adding when you do PDF manipulation, font subsetting or embedding, image header inspection, TTF/OTF table parsing, or other binary format work. For CRUD and JSON APIs it has essentially zero useful surface area and you should skip it.
- How do I install tc-lib-file and which PHP and Laravel versions does it support?
- Install it with composer require tecnickcom/tc-lib-file. It requires PHP 8.2 or later plus the curl and pcre extensions, which lines up with the runtime expectations of Laravel 11 and 12. The package is framework-agnostic, PSR-4 autoloaded under the Com\Tecnick\File namespace, so it has no Laravel version constraint of its own. On older Laravel releases you only need to confirm your PHP build meets the 8.2+ floor.
- Do I need a service provider, facade, or config file to use tc-lib-file in Laravel?
- No, the package ships none of those. It is a set of four small primitives (File, Byte, Cache, Dir) plus one Exception type, with no global state beyond the K_PATH_CACHE constant. The clean integration is to publish your own config values, bind an instance as a singleton in a service provider, and consume it through a thin internal adapter rather than calling the classes directly from controllers or jobs.
- How do I restrict which local paths and remote hosts tc-lib-file can read?
- The File class enforces host and path allowlists, and both are empty by default, which means strict deny until you configure them. Set allowedHosts and allowedPaths from your Laravel config, review redirect handling so redirected targets are revalidated, and add ext-intl if you want Unicode NFC folding during path matching. On Windows hosts be aware that short names, alternate data streams, trailing dots or spaces, and reserved device names are not expanded before matching.
- What PHP extensions does tc-lib-file need and what breaks without them?
- curl and pcre are required, and intl is optional but improves Unicode path matching. Some hardened container images ship with ext-curl disabled, so verify it at build time or remote reads will fail outright. Separately, the Byte class integer readers assume 64-bit PHP: on a 32-bit build getULong and getLong return wrong values instead of raising an error, so check PHP_INT_SIZE before relying on them.
- Why is the cache path I set being ignored by tc-lib-file?
- The Cache class handles prefixed temporary files with age-based pruning, but setCachePath() falls back silently to K_PATH_CACHE when the path you pass is a stream wrapper or is not writable. It does not throw, so a misconfigured cache directory degrades quietly. Validate the directory with is_writable in your service provider boot and fail fast there, rather than trusting the library to complain.
- Is it safe to fetch remote files with tc-lib-file?
- The allowlist is deny-by-default, which is the right posture, but the default maxRemoteSize is 50 MB and the response is buffered in memory after decompression, so zip-bomb exposure and FPM memory pressure are real. Lower that cap for shared pools. Also note the library overwrites CURLOPT_WRITEFUNCTION, PROGRESSFUNCTION, XFERINFOFUNCTION and NOPROGRESS (and HEADERFUNCTION when following redirects), so platform-wide cURL tracing or egress proxying at that layer will conflict.
- What license is tc-lib-file under and can I use it in commercial or on-prem products?
- The README states GNU LGPL v3, while GitHub and Packagist metadata report NOASSERTION, so the two need to be reconciled before adoption. SaaS use is generally unaffected by LGPL, but distributing it inside an on-prem appliance brings relinking and source-availability obligations that need legal sign-off. Treat this as a counsel decision, not an engineering one.
- How do I test Laravel code that uses tc-lib-file?
- Because there is no Laravel integration to fake, wrap the library behind your own interface and bind a stub implementation in the container during tests. Byte readers are easy to cover deterministically by feeding in-memory binary fixtures and asserting on offsets. For File remote reads, avoid asserting against cURL-level instrumentation since the library claims those callbacks, and instead test your adapter's behaviour around the allowlist and size cap.
- Is tc-lib-file actively maintained and production ready?
- It is a narrow leaf package with a single maintainer, very few stars, and no independent dependents, but it sits inside the well-established tc-lib-pdf and TCPDF ecosystem, which mitigates the bus factor somewhat. Note that published release metadata shows an inconsistent last-release date, so verify real tag cadence on the repository before planning upgrades. Pin the version in composer.json and treat it as infrastructure you own the integration for.
Weaver
How can I help you explore Laravel packages today?