br-install-and-migrate

better-route: install and migrate to 1.1

Install

Require the stable 1.1 line directly from Packagist:

composer require better-route/better-route:^1.1
composer show better-route/better-route

Use PHP 8.1 or newer. Do not add a VCS repository unless intentionally consuming a fork or unreleased branch.

Register routes during rest_api_init:

use BetterRoute\Router\Router;

add_action('rest_api_init', static function (): void {
    $router = Router::make('myapp', 'v1');
    $router->get('/ping', static fn (): array => ['pong' => true])
        ->publicRoute();
    $router->register();
});

1.1 migration checklist

Treat these as consumer-visible changes when moving from ^1.0 to ^1.1.

Routing

• Add permission(), protectedByMiddleware(), or publicRoute() to every raw Router route. In 1.1 omitted intent denies GET and OPTIONS too, not only writes.
• Register only during rest_api_init. Registration outside the hook or a false result from WordPress now throws clearly.
• Use WordPress route regex such as /(?P<id>\d+), not {id}.
• Review one-parameter handlers: an untyped parameter receives the WP request; a RequestContext-compatible type receives the context.
• Keep route args validation cheap and side-effect free because WordPress performs it before permission_callback.

Identity, cache, and throttling

• Expect default cache, idempotency, and rate-limit keys to use a native logged-in WordPress user even when no auth middleware populated attributes['auth'].
• Expect structured, recursively canonicalized keys and fingerprints. Do not depend on old delimiter-concatenated key strings.
• Use WpObjectCacheRateLimiter only with a persistent external object cache that supports atomic wp_cache_incr().
• Use the default TransientRateLimiter only where MySQL named locks are available; it now serializes the transient read/modify/write instead of racing.
• Read Retry-After as well as X-RateLimit-* on 429 responses.