Merge branch 'main' into feat/oauth-installer

Author: brendt

.github/workflows/create-gh-release.yml

@@ -44,6 +44,7 @@ jobs:
           RELEASE_TAG: ${{ github.ref_name }}
         run: |
           processed_body=$(cat release_notes.txt | perl -0777 -pe 's/\n*### (\S+) (.+?)\n+/\n### `\1`  \2\n/g')
+          processed_body="${processed_body#$'\n'}"
           final_content=$(printf "%s\n%s" "-# Read the [GitHub release](<${RELEASE_URL}>)." "$processed_body")
           jq -n \
             --arg content "$final_content" \

CHANGELOG.md

@@ -2,7 +2,32 @@
 
 All notable changes to this project will be documented in this file.
 
-## [2.7.0](https://github.com/tempestphp/tempest-framework/compare/v2.6.3..2.7.0)  —  2025-11-07
+## [2.8.0](https://github.com/tempestphp/tempest-framework/compare/v2.7.2..2.8.0)  —  2025-11-10
+
+### 🚨 Breaking changes
+
+- **router**: [**breaking**] add route decorators (#1695) ([c901dfe](https://github.com/tempestphp/tempest-framework/commit/c901dfeec7c01394a4481a08ca8381988a0b03ad))
+
+
+## [2.7.2](https://github.com/tempestphp/tempest-framework/compare/v2.7.1..v2.7.2)  —  2025-11-10
+
+### 🐛 Bug fixes
+
+- **console**: respect default value in confirm when forced (#1698) ([708c8f9](https://github.com/tempestphp/tempest-framework/commit/708c8f9ee5cef6c19d26e8ebcb069633341413ce))
+
+
+## [2.7.1](https://github.com/tempestphp/tempest-framework/compare/v2.7.0..v2.7.1)  —  2025-11-09
+
+### 🚀 Features
+
+- **auth**: mark password property with `#[SensitiveParameter]` (#1693) ([129fdd5](https://github.com/tempestphp/tempest-framework/commit/129fdd54cd989203508b461bbbbddf85448aabb7))
+
+### 🐛 Bug fixes
+
+- **view**: discovery locations for view compiler (#1701) ([8604b86](https://github.com/tempestphp/tempest-framework/commit/8604b86e3118a79f8813df5a6f2315a802368a5c))
+
+
+## [2.7.0](https://github.com/tempestphp/tempest-framework/compare/v2.6.3..v2.7.0)  —  2025-11-07
 
 ### 🚀 Features
 

docs/1-essentials/01-routing.md

@@ -440,26 +440,120 @@ final readonly class ReceiveInteractionController
 }
 ```
 
-### Group middleware
+## Route decorators (route groups)
 
-While Tempest does not provide a way to group middleware, you can easily create your own route attribute that applies or excludes a set of middleware to a route.
+Route decorators are Tempest's way to manage routes in bulk; it's a feature similar to route groups in other frameworks. Route decorators are attributes that implement the {b`\Tempest\Router\RouteDecorator`} interface. A route decorator's task is to make changes or add functionality to whether route it's associated with. Tempest comes with a few built-in route decorators, and you can make your own as well.
 
-```php Api.php
-#[Attribute(Attribute::IS_REPEATABLE | Attribute::TARGET_METHOD)]
-final readonly class Api implements Route
+In most cases, you'll want to add route decorators to a controller class, so that they are applied to all actions of that class:
+
+```php
+use Tempest\Router\Prefix;
+use Tempest\Router\Get;
+
+#[Prefix('/api')]
+final readonly class ApiController
 {
-    public function __construct(
-        public Method $method,
-        public string $uri,
-        public array $middleware = [],
-        public array $without = [],
-    ) {
-        $this->uri = "/api/{$uri}";
-        $this->without[] = [
-            ...$without,
-            VerifyCsrfMiddleware::class,
-            SetCookieMiddleware::class
-        ];
+    #[Get('/books')]
+    public function books(): Response { /* … */ }
+    
+    #[Get('/authors')]
+    public function authors(): Response { /* … */ }
+}
+```
+
+However, route decorators may also be applied to individual controller actions:
+
+```php
+use Tempest\Router\Stateless;
+use Tempest\Router\Get;
+
+final readonly class BlogPostController
+{
+    #[Stateless]
+    #[Get('/rss')]
+    public function rss(): Response { /* … */ }
+}
+```
+
+### Built-in route decorators
+
+These route decorators are provided by Tempest:
+
+#### `#[Stateless]`
+
+When you're building API endpoints, RSS feeds, or any other kind of page that does not require any cookie or session data, you may use the {b`#[Tempest\Router\Stateless]`} attribute, which will remove all state-related logic:
+
+```php
+use Tempest\Router\Stateless;
+use Tempest\Router\Get;
+
+final readonly class BlogPostController
+{
+    #[Stateless]
+    #[Get('/rss')]
+    public function rss(): Response { /* … */ }
+}
+```
+
+#### `#[Prefix]`
+
+Adds a prefix to all associated routes.
+
+```php
+use Tempest\Router\Prefix;
+use Tempest\Router\Get;
+
+#[Prefix('/api')]
+final readonly class ApiController
+{
+    #[Get('/books')]
+    public function books(): Response { /* … */ }
+    
+    #[Get('/authors')]
+    public function authors(): Response { /* … */ }
+}
+```
+
+#### `#[WithMiddleware]`
+
+Adds middleware to all associated routes.
+
+```php
+use Tempest\Router\WithMiddleware;
+use Tempest\Router\Get;
+
+#[Middleware(AuthMiddleware::class, AdminMiddleware::class)]
+final readonly class AdminController { /* … */ }
+```
+
+#### `#[WithoutMiddleware]`
+
+Explicitly removes middleware to all associated routes.
+
+```php
+use Tempest\Router\WithoutMiddleware;
+use Tempest\Router\Get;
+
+#[WithoutMiddleware(VerifyCsrfMiddleware::class, SetCookieMiddleware::class)]
+final readonly class StatelessController { /* … */ }
+```
+
+### Custom route decorators
+
+Building your own route decorators is done by implementing the {b`\Tempest\Router\RouteDecorator`} interface and marking your decorator as an attribute.
+
+```php
+use Attribute;
+use Tempest\Router\RouteDecorator;
+
+#[Attribute(Attribute::TARGET_METHOD | Attribute::TARGET_CLASS)]
+final readonly class Auth implements RouteDecorator
+{
+    public function decorate(Route $route): Route
+    {
+        $route->middleare[] = AuthMiddleware::class;
+
+        return $route;
     }
 }
 ```
@@ -631,23 +725,6 @@ final class ErrorResponseProcessor implements ResponseProcessor
 }
 ```
 
-## Stateless routes
-
-When you're building API endpoints, RSS pages, or any other kind of page that does not require any cookie or session data, you may use the `{#[Tempest\Router\Stateless]}` attribute, which will remove all state-related logic:
-
-```php
-use Tempest\Router\Stateless;
-use Tempest\Router\Get;
-
-final readonly class JsonController
-{
-    #[Stateless]
-    #[Get('/json')]
-    public function json(string $path): Response
-    { /* … */ }
-}
-```
-
 ## Custom route attributes
 
 It is often a requirement to have a bunch of routes following the same specifications—for instance, using the same middleware, or the same URI prefix.

packages/console/src/Actions/RenderConsoleCommand.php

@@ -63,13 +63,7 @@ private function renderArgument(ConsoleArgumentDefinition $argument): string
             return $formattedArgumentName->wrap('<style="fg-gray dim"><</style>', '<style="fg-gray dim">></style>')->toString();
         }
 
-        $defaultValue = match (true) {
-            $argument->default === true => 'true',
-            $argument->default === false => 'false',
-            is_null($argument->default) => 'null',
-            is_array($argument->default) => 'array',
-            default => "{$argument->default}",
-        };
+        $defaultValue = $this->getArgumentDefaultValue($argument);
 
         return str()
             ->append(str('[')->wrap('<style="fg-gray dim">', '</style>'))
@@ -89,11 +83,24 @@ private function renderEnumArgument(ConsoleArgumentDefinition $argument): string
 
         $partsAsString = ' {<style="fg-blue">' . implode('|', $parts) . '</style>}';
         $line = "<style=\"fg-blue\">{$argument->name}</style>";
+        $defaultValue = $this->getArgumentDefaultValue($argument);
 
         if ($argument->hasDefault) {
-            return "[{$line}={$argument->default->value}{$partsAsString}]";
+            return "[{$line}={$defaultValue}{$partsAsString}]";
         }
 
         return "<{$line}{$partsAsString}>";
     }
+
+    private function getArgumentDefaultValue(ConsoleArgumentDefinition $argument): string
+    {
+        return match (true) {
+            $argument->default === true => 'true',
+            $argument->default === false => 'false',
+            is_null($argument->default) => 'null',
+            is_array($argument->default) => 'array',
+            $argument->default instanceof BackedEnum => $argument->default->value,
+            default => "{$argument->default}",
+        };
+    }
 }

packages/console/src/GenericConsole.php

@@ -262,7 +262,7 @@ public function ask(
     public function confirm(string $question, bool $default = false, ?string $yes = null, ?string $no = null): bool
     {
         if ($this->isForced) {
-            return true;
+            return $default;
         }
 
         return $this->component(new ConfirmComponent($question, $default, $yes, $no));

packages/core/src/Kernel.php

@@ -8,7 +8,7 @@
 
 interface Kernel
 {
-    public const string VERSION = '2.7.0';
+    public const string VERSION = '2.8.0';
 
     public string $root {
         get;

packages/event-bus/src/Testing/EventBusTester.php

@@ -38,7 +38,7 @@ public function assertDispatched(string|object $event, ?Closure $callback = null
     {
         $this->assertFaked();
 
-        Assert::assertNotNull(
+        Assert::assertNotEmpty(
             actual: $dispatches = $this->findDispatches($event),
             message: 'The event was not dispatched.',
         );

packages/mail/src/Testing/TestingMailer.php

@@ -7,11 +7,13 @@
 use Tempest\Mail\EmailWasSent;
 use Tempest\Mail\Mailer;
 
+use function Tempest\get;
+
 final class TestingMailer implements Mailer
 {
-    public function __construct(
-        private readonly ?EventBus $eventBus = null,
-    ) {}
+    private ?EventBus $eventBus {
+        get => get(className: EventBus::class);
+    }
 
     /**
      * List of emails that would have been sent.

packages/router/src/Connect.php

@@ -8,7 +8,7 @@
 use Tempest\Http\Method;
 
 #[Attribute(Attribute::IS_REPEATABLE | Attribute::TARGET_METHOD)]
-final readonly class Connect implements Route
+final class Connect implements Route
 {
     public Method $method;
 

packages/router/src/Delete.php

@@ -8,7 +8,7 @@
 use Tempest\Http\Method;
 
 #[Attribute(Attribute::IS_REPEATABLE | Attribute::TARGET_METHOD)]
-final readonly class Delete implements Route
+final class Delete implements Route
 {
     public Method $method;