Validate attribute manipulation PHP syntax on metadata push

[kayjoosten]

When entities are pushed to /api/connections, any manipulation_code is now syntax-checked using token_get_all() with TOKEN_PARSE before being stored. This catches PHP parse errors at push time instead of at login time.

If a syntax error is found, a RuntimeException is thrown with the entity ID, which the controller returns as a 400 Bad Request. The entire push is rejected if any entity has invalid manipulation code.

Resolves: #1778

[kayjoosten]

Validation approach: findings & performance

Approaches considered

Approach	Executes code?	External process?	Verdict
token_get_all($code, TOKEN_PARSE)	❌ No	❌ No	✅ Chosen
eval()	✅ Yes	❌ No	❌ Rejected — executes valid code, causing side-effects
php -l via exec()/proc_open()	❌ No	✅ Yes	❌ Rejected — spawns a process per service, very slow
PhpParser (nikic/php-parser)	❌ No	❌ No	❌ Rejected — adds an external dependency
phpstan	❌ No	✅ Yes	❌ Rejected — not suited for runtime use, spawns process

Why token_get_all with TOKEN_PARSE:

• Built into PHP, zero dependencies.
• The TOKEN_PARSE flag makes PHP run a real parse pass (same parser used at compile time) and throw a ParseError on any syntax error — without executing the code.
• eval() would also surface syntax errors, but it executes the code body in the current context, which causes unpredictable side-effects even for syntactically valid code.
• A subprocess approach (php -l) is the most isolated but adds significant overhead per service and requires exec/proc_open permissions.

---

Performance impact

Benchmark run locally (PHP 8.2, 1000 iterations, warmed up):

Scenario	No validation	token_get_all + TOKEN_PARSE	Overhead/call
Simple one-liner	~0.000 ms	~0.001 ms	+0.001 ms
Realistic ~15-line manipulation	~0.000 ms	~0.006 ms	+0.006 ms

Simulated metadata push of 500 services (all with manipulation code):

• Simple code: ~0.28 ms total
• Realistic multi-line code: ~3.25 ms total

In practice, not all services have manipulation code, so the real-world overhead will be even lower. The added validation cost during a metadata push is negligible.

[johanib]

Thanks for the explanation.

Maybe add an entry to the changelog? "Metadata push will now reject all metadata if any service contains invalid attribute manipulations."

Two small comments, but no blockers 👍