Release 1.1.0: comment protection, object access, and demo admin chrome.

Author: HecFranco

.symfony/recipe/nowo-tech/blog-kit-bundle/1.0/config/packages/nowo_blog_kit.yaml

@@ -8,11 +8,33 @@ nowo_blog_kit:
         moderate_roles: [ROLE_MODERATOR]
         configure_roles: [ROLE_ADMIN]
         allow_unauthenticated: false
+        object_access:
+            strategy: none
+            # strategy: owner
+            # strategy: service
+            # service: App\Security\BlogPublicationAccessChecker
     web_ui:
         layout_template: 'admin/layout.html.twig'
         public_layout_template: 'base.html.twig'
         css_framework: bootstrap5
         icon_set: bootstrap-icons
         row_actions_display: icon
+    listing:
+        mode: paginated
+        masonry:
+            strategy: masonry
+            columns_mobile: 1
+            columns_tablet: 2
+            columns_desktop: 2
+    comments:
+        rate_limit:
+            strategy: fixed_window
+            limit: 5
+            interval_seconds: 60
+        captcha:
+            strategy: honeypot
+    html:
+        sanitize:
+            strategy: none
     doctrine:
         table_prefix: ''

.symfony/recipe/nowo-tech/blog-kit-bundle/1.0/config/packages/nowo_form_kit.yaml

@@ -1,6 +1,9 @@
 # GET list filters (AbstractGetFilterType) require profile `filter`.
+# `entity` is required by BlogArticleType (tags). BlogKit also prepends this type_map.
 nowo_form_kit:
     default_profile: default
+    type_map:
+        entity: Symfony\Bridge\Doctrine\Form\Type\EntityType
     profiles:
         filter:
             alias: filter

README.md

@@ -20,12 +20,13 @@ Blog Kit Bundle gives Symfony applications a reusable blog domain backed by Doct
 
 - Multilingual articles and tags with locale fallback (`es`, `en` by default)
 - Public index and article routes at `/blog` and `/blog/{slug}`
-- Moderated comments with staff replies
+- Moderated comments with staff replies, configurable rate limits, and CAPTCHA strategies
+- Optional article HTML sanitizer (`none`, `strip`, `allowlist`, or a host service)
 - Admin CRUD for articles, tags, comments, and singleton blog settings
 - Paginated or infinite-scroll listing, configurable asides, and card options
 - LinkedIn hashtag formatting command `nowo:blog:sync-hashtags`
 - `BlogArticlePublishedEvent` after an article becomes published
-- Configurable access: `access_roles`, manage / moderate / configure roles, custom checker, or demo-only unauthenticated mode
+- Configurable access: `access_roles`, manage / moderate / configure roles, custom `access_checker`, and object-level publication rules (`security.object_access`: `none` / `owner` / host `service`) via `BlogKitAccessDenied`
 - Host CSS stack via `web_ui.css_framework` (`bootstrap5`, `tailwind`, `foundation`, `custom`), `icon_set`, and `row_actions_display` without forking page templates
 - Twig namespace `NowoBlogKitBundle` with host override precedence
 - Symfony Flex recipe and FrankenPHP demo in `demo/symfony8`
@@ -49,6 +50,8 @@ nowo_blog_kit:
         moderate_roles: [ROLE_MODERATOR]
         configure_roles: [ROLE_ADMIN]
         allow_unauthenticated: false
+        # object_access:
+        #     strategy: owner
     web_ui:
         layout_template: admin/layout.html.twig
         public_layout_template: base.html.twig

demo/symfony8/README.md

@@ -15,8 +15,8 @@ Default URL: **http://localhost:8105** (override with `PORT` in `.env`).
 ## What to try
 
 1. Open `/` — landing page with links to the public blog and admin.
-2. Open `/blog` — 32 published lorem ipsum articles with 12 distinct tags (paginated), wrapped in the demo layout (`css_framework: bootstrap5`).
-3. Open `/admin/blog` — admin UI (HTTP Basic: `admin` / `admin`).
+2. Open `/blog` — 32 published lorem ipsum articles with 12 distinct tags (infinite scroll, masonry), wrapped in the demo layout (`css_framework: bootstrap5`). Switch `listing.mode` to `paginated` or `listing.masonry.strategy` to `grid` / `list` in `config/packages/nowo_blog_kit.yaml`.
+3. Open `/admin/blog` — admin UI in the demo masthead (HTTP Basic: `admin` / `admin`). Bootstrap 5 + Icons, FormKit `blog_kit` / `filter` profiles, and `bootstrap_5_layout`. Optional `security.object_access.strategy: owner` in `nowo_blog_kit.yaml`.
 
 Demo content is seeded on `make up` (`app:load-demo-blog`). Recreate with:
 

demo/symfony8/composer.lock

@@ -8,10 +8,30 @@ nowo_blog_kit:
         moderate_roles: [ROLE_ADMIN]
         configure_roles: [ROLE_ADMIN]
         allow_unauthenticated: false
+        # object_access:
+        #     strategy: owner
     web_ui:
+        layout_template: admin/layout.html.twig
         public_layout_template: base.html.twig
         css_framework: bootstrap5
         icon_set: bootstrap-icons
         row_actions_display: icon
+    listing:
+        mode: infinite
+        masonry:
+            strategy: masonry
+            columns_mobile: 1
+            columns_tablet: 2
+            columns_desktop: 2
+    comments:
+        rate_limit:
+            strategy: fixed_window
+            limit: 5
+            interval_seconds: 60
+        captcha:
+            strategy: honeypot
+    html:
+        sanitize:
+            strategy: allowlist
     doctrine:
         table_prefix: ''

demo/symfony8/config/packages/nowo_blog_kit.yaml

@@ -1,8 +1,11 @@
-# FormKit profiles used by BlogKit admin (GET list filters use profile `filter`).
-# `blog_kit` is also prepended by NowoBlogKitExtension; this file keeps `filter` in the host app.
+# FormKit: css_framework is bootstrap|tailwind|foundation|none (no bootstrap5).
+# UiKit / BlogKit use bootstrap5. Pair this with twig.form_themes → bootstrap_5_layout.
+# Profiles `blog_kit` (CRUD) and `filter` (GET lists) skip NowoBlogKitExtension prepends when defined here.
 nowo_form_kit:
     default_profile: default
     css_framework: bootstrap
+    type_map:
+        entity: Symfony\Bridge\Doctrine\Form\Type\EntityType
     profiles:
         default:
             alias: default
@@ -12,6 +15,39 @@ nowo_form_kit:
                     class: form-control
                 row_attr:
                     class: mb-3
+            field_types:
+                checkbox:
+                    attr:
+                        class: form-check-input
+                    row_attr:
+                        class: form-check mb-3
+                choice:
+                    attr:
+                        class: form-select
+        blog_kit:
+            alias: blog_kit
+            translation_domain: NowoBlogKitBundle
+            defaults:
+                attr:
+                    class: nowo-ui-input form-control
+                row_attr:
+                    class: mb-3
+            field_types:
+                checkbox:
+                    attr:
+                        class: form-check-input
+                    row_attr:
+                        class: form-check mb-3
+                choice:
+                    attr:
+                        class: form-select
+                entity:
+                    attr:
+                        class: form-select
+                textarea:
+                    attr:
+                        class: nowo-ui-input form-control
+                        rows: '6'
         filter:
             alias: filter
             translation_domain: NowoBlogKitBundle
@@ -20,3 +56,16 @@ nowo_form_kit:
             defaults:
                 label: false
                 required: false
+                attr:
+                    class: form-control form-control-sm
+                row_attr:
+                    class: mb-0
+            field_types:
+                checkbox:
+                    attr:
+                        class: form-check-input
+                    row_attr:
+                        class: form-check mb-0
+                choice:
+                    attr:
+                        class: form-select form-select-sm

demo/symfony8/config/packages/nowo_form_kit.yaml

@@ -1,3 +1,4 @@
 nowo_ui_kit:
     css_framework: bootstrap5
     icon_set: bootstrap-icons
+    row_actions_display: icon

demo/symfony8/config/packages/nowo_ui_kit.yaml

@@ -1,2 +1,7 @@
 twig:
     default_path: '%kernel.project_dir%/templates'
+    form_themes:
+        # FormKit static blocks first; Bootstrap 5 must win for checkbox / radio / select.
+        - '@NowoFormKitBundle/form/static_blocks.html.twig'
+        - '@NowoBlogKitBundle/admin/form_theme.html.twig'
+        - bootstrap_5_layout.html.twig

demo/symfony8/config/packages/twig.yaml

@@ -1306,6 +1306,10 @@
  *         configure_roles?: list<scalar|Param|null>,
  *         access_checker?: scalar|Param|null, // Default: null
  *         allow_unauthenticated?: bool|Param, // Default: false
+ *         object_access?: array{ // Object-level checks after roles (e.g. editors only manage their publications).
+ *             strategy?: "none"|"owner"|"service"|Param, // none (roles only), owner (createdBy), or service (host checker). // Default: "none"
+ *             service?: scalar|Param|null, // Service id implementing BlogKitResourceAccessCheckerInterface when strategy=service. // Default: null
+ *         },
  *     },
  *     web_ui?: array{
  *         layout_template?: scalar|Param|null, // Default: "@NowoBlogKitBundle/admin/layout.html.twig"
@@ -1320,6 +1324,37 @@
  *         table_prefix?: scalar|Param|null, // Default: ""
  *         connection?: scalar|Param|null, // Default: "default"
  *     },
+ *     comments?: array{
+ *         rate_limit?: array{ // Public comment POST rate limiting. Requires cache.app except strategy none/service.
+ *             strategy?: "none"|"fixed_window"|"per_ip_article"|"sliding_window"|"service"|Param, // Default: "fixed_window"
+ *             limit?: int|Param, // Max submissions per interval. 0 disables the limiter. // Default: 5
+ *             interval_seconds?: int|Param, // Default: 60
+ *             service?: scalar|Param|null, // Service id implementing BlogCommentRateLimiterInterface when strategy=service. // Default: null
+ *         },
+ *         captcha?: array{ // Public comment bot mitigation. Secrets stay in YAML, not BlogSettings.
+ *             strategy?: "none"|"honeypot"|"recaptcha_v2"|"recaptcha_v3"|"hcaptcha"|"turnstile"|"service"|Param, // Default: "honeypot"
+ *             site_key?: scalar|Param|null, // Default: ""
+ *             secret_key?: scalar|Param|null, // Default: ""
+ *             min_score?: float|Param, // Minimum reCAPTCHA v3 score. // Default: 0.5
+ *             honeypot_field?: scalar|Param|null, // Default: "website"
+ *             service?: scalar|Param|null, // Service id implementing BlogCommentCaptchaStrategyInterface when strategy=service. // Default: null
+ *         },
+ *     },
+ *     listing?: array{ // Public /blog index: numbered pagination or infinite scroll.
+ *         mode?: "paginated"|"infinite"|Param, // paginated (numbered pages) or infinite (IntersectionObserver + ?partial=1). // Default: "paginated"
+ *         masonry?: array{ // Public index card layout. Admin inherit / 0 keeps these YAML values.
+ *             strategy?: "masonry"|"grid"|"list"|Param, // masonry (packed columns), grid (uniform rows), or list (single column). // Default: "masonry"
+ *             columns_mobile?: int|Param, // Default: 1
+ *             columns_tablet?: int|Param, // Default: 2
+ *             columns_desktop?: int|Param, // Default: 2
+ *         },
+ *     },
+ *     html?: array{
+ *         sanitize?: array{ // Sanitize article HTML on persist and public render. Default none keeps trusted-editor |raw.
+ *             strategy?: "none"|"strip"|"allowlist"|"service"|Param, // Default: "none"
+ *             service?: scalar|Param|null, // Service id implementing BlogHtmlSanitizerInterface when strategy=service. // Default: null
+ *         },
+ *     },
  * }
  * @psalm-type NowoUiKitConfig = array{
  *     css_framework?: "bootstrap"|"bootstrap5"|"bootstrap4"|"tailwind"|"foundation"|"custom"|"tabler"|"none"|Param, // Host CSS stack: bootstrap5|bootstrap4|tailwind|foundation|custom|none|tabler (bootstrap alias → bootstrap5). // Default: "bootstrap5"