Release 4.2.0

[turegjorup]

Summary

Roll up the accumulated [Unreleased] changes since 4.1.0 into a tagged release.

MINOR per SemVer reading: two new optional configuration features are added; existing configs and call sites keep working unchanged. The bundle's composer.json constraint on itk-dev/openid-connect stays at ^4.0; the just-released library 4.1.2 resolves cleanly under it.

What's in 4.2.0

Added

• Per-provider cache_duration option (integer seconds, default 86400) forwarded to the underlying library. Lets consumers tighten or extend the 24-hour default TTL for the cached OIDC discovery document and JWKS.
• Per-provider http_client_options block (timeout, proxy, verify) forwarded to the Guzzle HTTP client used by league/oauth2-client. Closes the long-standing inability to bound HTTP requests to the IdP.

Fixed

• CliLoginHelper (four catch sites in createToken / getUsername) and OpenIdLoginAuthenticator::validateClaims now preserve the originating exception via $previous. Previously the message was copied but the chain to the underlying PSR cache / upstream OIDC failure was lost, making log traversal impossible.

Changed

• LoginController::login now maps unknown-provider failures to NotFoundHttpException (404) and IdP-unreachable / cache failures to ServiceUnavailableHttpException (503), with the cause chained via $previous. Previously these surfaced as a generic 500. Other ItkOpenIdConnectException subtypes (e.g. BadUrlException for a misconfigured metadata_url) intentionally still bubble as 500 — server-side configuration bugs that should fail loudly.
• Expanded README note on Symfony's native OIDC support (7.3 features, comparison table, link to the upstream authorization-code-flow issue).
• Documented architectural decision in docs/adr/001-marker-interface-exception-hierarchy.md: the bundle and library exception hierarchy will converge on a marker-interface contract in coordinated 5.0 majors. Status: Draft. Not a 4.2.0-shipping change in behaviour; the ADR is a forward-looking decision record.

Tooling / CI

• Bumped actions/checkout v5 → v6 across all workflows.
• Renamed PHP_EXEC variable to PHP in Taskfile.yml.
• Added lint:composer task to Taskfile.yml.
• test:coverage now runs via docker-compose with XDEBUG_MODE=coverage and prints text summary.
• Fixed test:matrix:reset to include the ci profile when removing volumes.
• Fixed test:run to remove stale composer.lock before composer update.

Backward compatibility

• New config options are optional with defaults; existing configurations continue to validate and load.
• LoginController HTTP-response status codes for two failure modes change (was 500, now 404 or 503). Consumers that monitor specifically for 500s from those failures will see fewer; those that monitor for 4xx/5xx in general are unaffected. The exception types thrown internally also change, but LoginController is invoked by Symfony's HTTP kernel, not by consumer code.
• $previous chaining is strictly additive: consumers reading getPrevious() now see a non-null cause where they previously saw null.
• Public exception classes, namespaces, and concrete types are unchanged.

Test plan

• task lint:markdown — CHANGELOG.md clean
• task test — 56 tests, 141 assertions pass
• task analyze:php — phpstan max, no errors
• task lint:php — clean
• CI matrix on PR

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (9e60580) to head (e236274).
⚠️ Report is 29 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##                main       #37   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity        56        60    +4     
===========================================
  Files              9         9           
  Lines            248       278   +30     
===========================================
+ Hits             248       278   +30     

Flag	Coverage Δ
unittests	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.