allow upgrade to lcobucci/jwt for php 8.3 compatibility

[mathroc]

https://github.com/lcobucci/jwt/releases/tag/5.1.0

[SMillerDev]

It seems this needs a complete migration to JWT 5.x, since some methods no longer exist in that version.

[mathroc]

yeah, I'm not using this library myself, just starting on making our project php 8.3 compatible. so I'm not sure how it should be dealt with.

There's at least the Push::getJsonWebToken() method to upgrade.

I read the upgrade documentation about it but I still don't really know what should be done.

If you can tell me, if using forSymmetricSigner() with an in-memory key (which one??) is ok, I can update this merge request

[SMillerDev]

If you can tell me, if using forSymmetricSigner() with an in-memory key (which one??) is ok, I can update this merge request

Yeah, not sure about that either. It was added in f6d5ec5 for p8 keys, but I'm not sure what the exact reason for this algorithm was.

[pprkut]

I think the suggestion from the update docs to use the Blake2b algorithm sounds fair, at least as a first try.

Looking at the apple docs it mentions that apple only supports the ES256 algorithm, which would mean we'd have to use ECDSA though, based on what I found.

[pprkut]

If I understood correctly, we should use it like this now:

$key = InMemory::file($this->providerCertFile);
return Configuration::forSymmetricSigner(
    new Signer\Ecdsa(),
    $key,
)->builder()
 ->issuedBy($this->providerTeamId)
 ->issuedAt(new DateTimeImmutable())
 ->withHeader('kid', $this->providerKeyId)
 ->getToken(new Sha256(), $key)
 ->toString();

Looking at https://github.com/lcobucci/jwt/blob/5.3.x/src/Configuration.php though, none of the options passed to forSymmetricSigner are used for anything though. Really wondering what the value of those is, unless I'm missing something 😕

[brianstoop]

If the none of the options really matter and we only use the Configuration method to get a builder, why initiate the builder ourselves? The documentation about issues a token has an example of this already: https://lcobucci-jwt.readthedocs.io/en/latest/issuing-tokens/.

It would be something like:

$key          = InMemory::file($this->providerCertFile);
$tokenBuilder = (new Builder(new JoseEncoder(), ChainedFormatter::default()));
return $tokenBuilder->issuedBy($this->providerTeamId)
                    ->issuedAt(new DateTimeImmutable())
                    ->withHeader('kid', $this->providerKeyId)
                    ->getToken(new Sha256(), $key)
                    ->toString();

[pprkut]

This is implemented by #79 now