Merge pull request #1001 from lcobucci/use-clock-from-psr

Support other PSR-20 implementations

composer.json

@@ -22,10 +22,11 @@
         "ext-json": "*",
         "ext-openssl": "*",
         "ext-sodium": "*",
-        "lcobucci/clock": "^3.0.0"
+        "psr/clock": "^1.0"
     },
     "require-dev": {
         "infection/infection": "^0.26.19",
+        "lcobucci/clock": "^3.0",
         "lcobucci/coding-standard": "^9.0",
         "phpbench/phpbench": "^1.2.8",
         "phpstan/extension-installer": "^1.2",
@@ -35,6 +36,9 @@
         "phpstan/phpstan-strict-rules": "^1.5.0",
         "phpunit/phpunit": "^10.0.12"
     },
+    "suggest": {
+        "lcobucci/clock": ">= 3.0"
+    },
     "autoload": {
         "psr-4": {
             "Lcobucci\\JWT\\": "src"

docs/configuration.md

@@ -200,7 +200,8 @@ It configures which are the base constraints to be used during validation.
 <?php
 declare(strict_types=1);
 
-use Lcobucci\Clock\SystemClock;
+use Lcobucci\Clock\SystemClock; // If you prefer, other PSR-20 implementations may also be used
+                                // (https://packagist.org/providers/psr/clock-implementation)
 use Lcobucci\JWT\Configuration;
 use Lcobucci\JWT\Signer;
 use Lcobucci\JWT\Signer\Key\InMemory;

docs/quick-start.md

@@ -64,7 +64,8 @@ namespace MyApp;
 require 'vendor/autoload.php';
 
 use DateTimeImmutable;
-use Lcobucci\Clock\FrozenClock;
+use Lcobucci\Clock\FrozenClock; // If you prefer, other PSR-20 implementations may also be used
+                                // (https://packagist.org/providers/psr/clock-implementation)
 use Lcobucci\JWT\Builder;
 use Lcobucci\JWT\JwtFacade;
 use Lcobucci\JWT\Signer\Hmac\Sha256;
@@ -104,7 +105,8 @@ namespace MyApp;
 require 'vendor/autoload.php';
 
 use DateTimeImmutable;
-use Lcobucci\Clock\FrozenClock;
+use Lcobucci\Clock\FrozenClock; // If you prefer, other PSR-20 implementations may also be used
+                                // (https://packagist.org/providers/psr/clock-implementation)
 use Lcobucci\JWT\JwtFacade;
 use Lcobucci\JWT\Signer\Hmac\Sha256;
 use Lcobucci\JWT\Signer\Key\InMemory;

docs/upgrading.md

@@ -121,6 +121,16 @@ Or:
  );
 ```
 
+### `lcobucci/clock` is not installed by default anymore
+
+Thanks to [PSR-20](https://www.php-fig.org/psr/psr-20/), users can more easily plug-in other [clock implementations](https://packagist.org/providers/psr/clock-implementation) if they choose to do so.
+
+If you like and were already using `lcobucci/clock` on your system, you're required to explicitly add it as a production dependency:
+
+```sh
+composer require lcobucci/clock
+```
+
 ## v3.x to v4.x
 
 The `v4.0.0` aggregates about 5 years of work and contains **several BC-breaks**.

src/JwtFacade.php

@@ -5,15 +5,14 @@
 
 use Closure;
 use DateTimeImmutable;
-use Lcobucci\Clock\Clock;
-use Lcobucci\Clock\SystemClock;
 use Lcobucci\JWT\Encoding\ChainedFormatter;
 use Lcobucci\JWT\Encoding\JoseEncoder;
 use Lcobucci\JWT\Signer\Key;
 use Lcobucci\JWT\Validation\Constraint;
 use Lcobucci\JWT\Validation\SignedWith;
 use Lcobucci\JWT\Validation\ValidAt;
 use Lcobucci\JWT\Validation\Validator;
+use Psr\Clock\ClockInterface as Clock;
 
 use function assert;
 
@@ -25,7 +24,12 @@ public function __construct(
         private readonly Parser $parser = new Token\Parser(new JoseEncoder()),
         ?Clock $clock = null,
     ) {
-        $this->clock = $clock ?? SystemClock::fromSystemTimezone();
+        $this->clock = $clock ?? new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable();
+            }
+        };
     }
 
     /** @param Closure(Builder, DateTimeImmutable):Builder $customiseBuilder */

src/Validation/Constraint/LooseValidAt.php

@@ -5,10 +5,10 @@
 
 use DateInterval;
 use DateTimeInterface;
-use Lcobucci\Clock\Clock;
 use Lcobucci\JWT\Token;
 use Lcobucci\JWT\Validation\ConstraintViolation;
 use Lcobucci\JWT\Validation\ValidAt as ValidAtInterface;
+use Psr\Clock\ClockInterface as Clock;
 
 final class LooseValidAt implements ValidAtInterface
 {

src/Validation/Constraint/StrictValidAt.php

@@ -5,11 +5,11 @@
 
 use DateInterval;
 use DateTimeInterface;
-use Lcobucci\Clock\Clock;
 use Lcobucci\JWT\Token;
 use Lcobucci\JWT\UnencryptedToken;
 use Lcobucci\JWT\Validation\ConstraintViolation;
 use Lcobucci\JWT\Validation\ValidAt as ValidAtInterface;
+use Psr\Clock\ClockInterface as Clock;
 
 final class StrictValidAt implements ValidAtInterface
 {

tests/JwtFacadeTest.php

@@ -17,6 +17,7 @@
 use Lcobucci\JWT\Validation\Constraint\StrictValidAt;
 use Lcobucci\JWT\Validation\RequiredConstraintsViolated;
 use PHPUnit\Framework\TestCase;
+use Psr\Clock\ClockInterface;
 
 /**
  * @covers ::__construct
@@ -65,11 +66,9 @@ private function createToken(): string
         return (new JwtFacade(clock: $this->clock))->issue(
             $this->signer,
             $this->key,
-            function (Builder $builder, DateTimeImmutable $issuedAt): Builder {
-                return $builder
+            fn (Builder $builder, DateTimeImmutable $issuedAt): Builder => $builder
                     ->expiresAt($issuedAt->modify('+5 minutes'))
-                    ->issuedBy($this->issuer);
-            },
+                    ->issuedBy($this->issuer),
         )->toString();
     }
 
@@ -258,4 +257,37 @@ public function parserForNonUnencryptedTokens(): void
             new IssuedBy($this->issuer),
         );
     }
+
+    /**
+     * @test
+     *
+     * @covers ::issue
+     * @covers ::parse
+     */
+    public function customPsrClock(): void
+    {
+        $clock = new class () implements ClockInterface {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2021-07-10');
+            }
+        };
+
+        $facade = new JwtFacade(clock: $clock);
+
+        $token = $facade->issue(
+            $this->signer,
+            $this->key,
+            static fn (Builder $builder): Builder => $builder,
+        );
+
+        self::assertEquals(
+            $token,
+            $facade->parse(
+                $token->toString(),
+                new SignedWith($this->signer, $this->key),
+                new StrictValidAt($clock),
+            ),
+        );
+    }
 }