How to Contract Test a Symfony API Against an OpenAPI Spec Using Gesso

·1 views

A technical guide explains how to perform provider-side contract testing on a Symfony API using an OpenAPI specification as the source of truth. The approach uses four components: an OpenAPI spec document, a WebTestCase or plain Request/Response pair, a PHP trait, and its assertion methods. The open-source library Gesso (studio-design/gesso) serves as the testing framework, supporting OpenAPI versions 3.0 through 3.2 and Symfony versions 6.4 and above. Developers install Gesso as a dev dependency, register a PHPUnit extension to locate spec files, and use the OpenApiAssertions trait to verify that live requests and responses conform to the published schema. This provider-side approach differs from consumer-driven contract testing tools like Pact and is best suited for teams that already maintain an OpenAPI document and want fast, per-endpoint drift detection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Safely Give Local AI Agents Filesystem Access Using Sandboxing Patterns

A developer shares practical security patterns after a local AI agent unexpectedly rewrote a config file it was never instructed to touch, highlighting how even small language models can cause damage through confident errors rather than malice. The core strategy involves allowlisting only specific directories — typically the active project folder and a disposable scratch space — rather than trying to block dangerous paths, which tends to fail due to overlooked edge cases. Paths must be canonicalized before any permission check, since relative traversal sequences and symlinks can bypass naive prefix matching. Sensitive files such as .env, .git contents, and credential files are hidden from the agent by default, with read access also restricted to prevent accidental exposure of secrets. Every write operation is first run in dry-run mode, displaying a full unified diff of proposed changes, so the developer can verify behavior before granting the agent broader trust.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Dev Builds Free Toolbox for Developers, Gets Flagged as Spammer on Reddit

A solo developer spent two weeks building YoBox, a free browser-based toolbox offering utilities such as disposable email, webhook capture, regex testing, and Docker Compose scaffolding — all without requiring user signups. The project was designed to consolidate everyday tools used by developers and QA engineers into a single, no-friction platform. Key technical challenges included DNS configuration, setting up a monorepo backend on Render, and handling the complexity of temporary email inboxes including token refresh and HTML rendering. After successfully testing the tool — confirming live OTP email delivery and real-time webhook capture — the developer launched it on Reddit, where automated filters flagged the posts as spam. The experience prompted the developer to reflect publicly on the infrastructure hurdles of indie development and the unexpected difficulty of promoting legitimate tools online.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Secure Multi-Tenant AI Agent Platform Using Docker and Traefik

As AI teams grow, managing isolated development environments becomes critical to prevent dependency conflicts and resource contention between projects. A container-native approach using Docker Compose allows each team or agent to run in its own isolated environment with defined CPU, memory, and network limits. TormentNexus serves as the orchestration layer, providing a standardized interface for launching and managing these containerized agent instances. Traefik acts as a dynamic reverse proxy that integrates with the Docker API to automatically discover and route traffic to newly deployed services, eliminating the need for manual configuration. Together, these tools form a scalable infrastructure where multiple teams can concurrently develop, test, and deploy AI agents without interfering with one another.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agentic AI Coding Boom Creates Review Bottleneck and Reliability Concerns

The rise of agentic AI coding tools, which operate on high-level goals rather than simple line completion, has pushed code production to machine speed but introduced what researchers term the Productivity-Reliability Paradox. While individual developer productivity has risen by over 50%, organisations are reporting a 98% surge in merged pull requests alongside a 91% increase in review time, straining system-level reliability. Traditional line-by-line code review has become unsustainable, prompting a shift from humans being directly involved in every review cycle to overseeing the process at a higher, supervisory level. Engineers are responding by designing automated workflows that let AI agents find, implement, and verify work independently, supplemented by automated verification gates for logic and edge-case checks. A key hidden cost, dubbed the Verification Tax, is that senior developers often spend more time auditing AI-generated code than they would have spent writing it themselves, a burden that grows with codebase complexity.

0 comments Read more at DEV Community