>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3617866. --> Reported by: [e0ipso](https://www.drupal.org/user/550110) Related to !7 >>> <h3>Problem/Motivation</h3> <p><code>media_mpx</code> requires <code>lullabot/mpx-php:^3.1.1</code>, so<br> sites cannot move to <a href="https://www.drupal.org"></a> href="<a href="https://github.com/Lullabot/mpx-php/releases/tag/4.0.0">https://github.com/Lullabot/mpx-php/releases/tag/4.0.0</a>"&gt;mpx-php<br> 4.0.0.</p> <p>4.0.0 makes the authentication method an explicit, required constructor<br> argument on <code>UserSession</code>, so a session states how it authenticates<br> instead of assuming the identity management service:</p> <pre><pre>// 3.x<br>&nbsp; public function __construct(UserInterface $user, Client $client,<br>&nbsp; ?PersistingStoreInterface $store = null, ?TokenCachePool $tokenCachePool =<br>&nbsp; null)<br><br>&nbsp; // 4.0<br>&nbsp; public function __construct(UserInterface $user, Client $client,<br>&nbsp; AuthenticationFlowInterface $flow, ?PersistingStoreInterface $store = null,<br>&nbsp; ?TokenCachePool $tokenCachePool = null)</pre></pre><p><code>UserSessionFactory::fromUser()</code> is the only place in this<br> module that constructs a session, so that single call is all the compatibility<br> work required.</p> <p>Separately, mpx supports a second way to authenticate. CTS/CVP service<br> users exchange an OAuth client ID and secret for a JWT at<br> <code>fedauth.theplatform.com/v1/service/token</code> and send it in an<br> <code>Authorization: Basic</code> header, where the username half carries the<br> account context. mpx-php 4.0 models this as a <code>ServiceTokenFlow</code>,<br> but <code>media_mpx</code> currently has no way for a site to select it.</p> <h3>Proposed resolution</h3> <p>Two commits, so the compatibility fix can land on its own if the feature<br> needs more review.</p> <ol> <li><strong>Support lullabot/mpx-php 4.0.</strong> Raise the constraint to<br> <code>^4.0</code> and pass a <code>SignInFlow</code> from<br> <code>UserSessionFactory::fromUser()</code>. Behaviour is unchanged.</li> <li><strong>Allow authenticating with a CTS/CVP service token.</strong> Add<br> an <code>auth_flow</code> property to the mpx User entity, expose it on the<br> user form, and map it to the matching flow object in the factory.</li> </ol> <p>The constraint moves to <code>^4.0</code> rather than widening to<br> <code>^3.1.1 || ^4.0</code> because the constructor signature differs between<br> the two majors and a single call cannot satisfy both without a runtime version<br> check.</p> <p>Signing in stays the default and is <strong>not</strong> deprecated.<br> Service credentials reuse the existing <code>username</code> and<br> <code>password</code> fields through <code>getMpxClientId()</code> and<br> <code>getMpxClientSecret()</code>, so switching a user over needs no<br> credential migration.</p> <h3>Remaining tasks</h3> <ul> <li>Review.</li> <li>Decide whether the service token support belongs in this issue or a<br> follow-up.</li> <li>Test coverage for the flow selection in<br> <code>UserSessionFactory</code>.</li> <li>Confirm the intended release: this requires a new major of<br> <code>media_mpx</code>, since the mpx-php requirement is a breaking change for<br> sites.</li> </ul> <h3>User interface changes</h3> <ul> <li>New required <strong>Authentication flow</strong> select on the mpx User<br> add and edit forms, defaulting to <em>mpx sign-in (username and<br> password)</em>.</li> <li>For a service user, the existing user name and password fields hold the<br> OAuth client ID and client secret.</li> <li>The form no longer prepends the <code>mpx/</code> directory when the<br> selected flow is the service token. An OAuth client ID is an opaque string<br> such as <code>0oazmvvnwr8dxUG9J417</code>, and prefixing it would corrupt the<br> credential.</li> </ul> <h3>API changes</h3> <ul> <li>The minimum <code>lullabot/mpx-php</code> is now <code>^4.0</code>.</li> <li><code>Drupal\media_mpx\Entity\UserInterface</code> now extends<br> <pre>Lul<br>&nbsp; labot\Mpx\Service\IdentityManagement\ServiceCredentialsInterface</pre><p> instead of <code>UserInterface</code>, adding <code>getMpxClientId()</code><br> and <code>getMpxClientSecret()</code>, and declares <code>getAuthFlow()</code><br> plus the <code>AUTH_FLOW_SIGNIN</code> and<br> <code>AUTH_FLOW_SERVICE_TOKEN</code> constants. Any other implementation of<br> that interface must add the three methods.</p></li> <li>No other consumer-facing signature changes. Nothing in this module<br> extends a class from mpx-php, so the <code>: void</code> return types added<br> throughout 4.0 do not affect it.</li> </ul> <h3>Data model changes</h3> <ul> <li>New <code>auth_flow</code> key on<br> <code>media_mpx.media_mpx_user.*</code> configuration, added to<br> <code>config_export</code> and to the config schema.</li> <li>No update hook. The entity property defaults to <code>signin</code> and<br> <code>getAuthFlow()</code> falls back to it, so existing configuration with no<br> stored value keeps working and exported configuration is left untouched until<br> a user is deliberately switched over.</li> </ul>