Weave Code
Accent Bundle Laravel Package
theodo/accent-bundle
A small Symfony bundle from Theodo for handling accented characters in PHP applications. It provides utilities to strip or convert diacritics, useful for generating clean slugs, URLs, and search-friendly text.
Access Control Checker Easy Neat Thorough
Frequently asked questions about Accent Bundle
- Does theodo/accent-bundle work with Laravel?
- No. theodo/accent-bundle is a Symfony bundle built specifically around API Platform's resource and operation metadata, and Laravel has no bundle contract, no compiler pass registration, and no API Platform resource graph. Nothing in the package executes inside a Laravel application, so there is no Laravel version constraint to evaluate: the framework is simply not supported. Treat it as a design reference rather than a dependency.
- What does theodo/accent-bundle actually check?
- It is a static access-control coverage checker. It enumerates API Platform operations across your resources and verifies that each operation is covered by an access-control rule, so gaps surface in CI instead of in production. It is not a runtime firewall and it does not enforce anything at request time. Its unit of analysis is the API Platform operation, not the Symfony router, so routes defined outside API Platform are out of scope.
- Does it work on Symfony projects that don't use API Platform?
- As of v3.1.0 it fails fast by design. The bundle detects which API Platform package is installed, refuses to run when none is present, and errors early instead of producing a green run that inspected nothing. That is a genuine developer-experience improvement because it removes a whole class of silent no-op results. It also hard-excludes the tool from any Symfony service that does not use API Platform.
- Should my tree have api-platform/core or api-platform/symfony, and why does Composer conflict?
- The release supports two API Platform packages, each with its own compatibility envelope, and the one already in your tree decides whether the bundle installs cleanly or hits a conflict. v3.1.0 adds Composer-level conflict behavior around api-platform/core, so a monorepo or a service with transitive API Platform dependencies can see composer update break even though the change shipped as a minor version. Inspect your lock file before adding the bundle, and pin the exact version.
- Which Symfony, PHP, and API Platform versions are supported?
- The package carries a Symfony and PHP version matrix plus, since v3.1.0, an API Platform version matrix covering two supported packages. The published technical evaluation does not enumerate exact constraint numbers, so read composer.json in the specific tagged release you intend to install rather than relying on a generic support table. Because the tool is a static checker, a version drift that quietly changes how operations are enumerated is the failure mode to watch for.
- How do I wire theodo/accent-bundle into a CI pipeline?
- Register the bundle, confirm which API Platform package your service uses, then run the console command after the container compiles so the resource graph is fully populated. Emit the report as a CI artifact and fail the build on uncovered operations, otherwise the gate is decorative. Pin the package to an exact version and test the Composer resolver on a branch first, since the new conflict rules can alter install outcomes.
- How do I test the checker itself before trusting its output?
- Point it at a fixture project that deliberately contains an unprotected operation and confirm that operation is flagged. Repeat that on every version bump, especially minor bumps, because enumeration semantics are the part most likely to shift between releases. A false positive only costs a developer an afternoon; a false negative is the one that creates false confidence in your auth coverage.
- Is a green result safe to cite as SOC 2 or pentest-remediation evidence?
- Only with independent confirmation. The risk profile is asymmetric: a false negative, where an operation is reported as protected but is not, produces false confidence in an access-control audit and becomes a compliance liability if you cite the tool as audit evidence. A false positive is merely annoying. Use it as a developer guardrail that catches regressions, and pair it with runtime tests plus manual review of the access-control rules when you need audit-grade proof.
- How much work is it to port theodo/accent-bundle to Laravel, and what should we build instead?
- Budget roughly five to ten developer days and plan to design the enumeration from scratch, because the borrowable surface is the finding taxonomy and the shape of the CI gate, not the PHP. In Laravel, route:list, Gate and Policy registration, and a small Artisan command cover the enumeration, while Larastan and PHPUnit cover the static and behavioral halves. Leave extra time for vendor-injected or dynamically registered routes, which are the usual blind spots in any coverage checker.
- Is theodo/accent-bundle actively maintained, and what is the bus factor?
- It is a single-vendor project owned by Theodo with minimal dependents and a bus factor of roughly one or two people, so assume you may eventually be on your own with it. The v3.0.0 to v3.1.0 releases show the project is alive, which modestly improves the dormancy concern but does nothing for the validation concern, since there is no broad third-party usage to lean on. Pin the version, wrap it in your own CI gate, and keep a replacement path in mind.
Weaver
How can I help you explore Laravel packages today?