how use use guard to dump in 'dev' but ignored in 'prod'

[tacman]

I use this to make sure dumps don't happen in production. symfony/debug-bundle is not installed on production, symfony/twig-bundle is. Everything's updated to the latest code

    {% guard function dump %}
        {{ dump(article) }}
    {% endguard %}

When I run it in production, it fails, I see this message in the logs:

me":"2025-01-02T12:36:52.973795+00:00","extra":{}}
[PHP        ] {"message":"Authenticator does not support the request.","context":{"firewall_name":"main","authenticator":"Symfony\\Component\\Security\\Http\\Authenticator\\FormLoginAuthenticator"},"level":100,"level_name":"DEBUG","channel":"security","datetime":"2025-01-02T12:36:52.973798+00:00","extra":{}}
[PHP        ] {"message":"Uncaught PHP Exception Twig\\Error\\SyntaxError: \"Did you forget to run \"composer require symfony/twig-bundle\"? Unknown function \"dump\" in \"app/article.html.twig\".\" at UndefinedCallableHandler.php line 112","context":{"exception":{"class":"Twig\\Error\\SyntaxError","message":"Did you forget to run \"composer require symfony/twig-bundle\"? Unknown function \"dump\" in \"app/article.html.twig\".","code":0,"file":"/home/tac/g/sites/magazine/vendor/symfony/twig-bridge/UndefinedCallableHandler.php:112"}},"level":500,"level_name":"CRITICAL","channel":"request","datetime":"2025-01-02T12:36:53.615001+00:00","extra":{}}

Of course, symfony/twig-bundle is installed. And this works fine in dev. And I think this used to work before the latest 7.2.2.

composer outdated
Activating installation...
Color legend:
- patch or minor release available - update recommended
- major release available - update possible

Direct dependencies required in composer.json:
doctrine/dbal                      3.9.3  4.2.1  Powerful PHP database abstraction layer (DBAL) with many features for database schema introspection and management.
phpunit/phpunit                    9.6.22 11.5.2 The PHP Unit Testing framework.

[fabpot]

Can you confirm that the templates are compiled without symfony/debug-bundle installed?

[tacman]

How can I tell that?

composer.json:

    "require-dev": {
        "symfony/debug-bundle": "^7.2",

bundles.php

return [
    Symfony\Bundle\DebugBundle\DebugBundle::class => ['dev' => true],
    Symfony\Bundle\TwigBundle\TwigBundle::class => ['all' => true],

    Symfony\Bundle\FrameworkBundle\FrameworkBundle::class => ['all' => true],
    Doctrine\Bundle\DoctrineBundle\DoctrineBundle::class => ['all' => true],
    Doctrine\Bundle\MigrationsBundle\DoctrineMigrationsBundle::class => ['all' => true],
    Symfony\Bundle\WebProfilerBundle\WebProfilerBundle::class => ['dev' => true, 'test' => true],
    Symfony\UX\StimulusBundle\StimulusBundle::class => ['all' => true],
    Symfony\UX\Turbo\TurboBundle::class => ['all' => true],
    Twig\Extra\TwigExtraBundle\TwigExtraBundle::class => ['all' => true],
    Symfony\Bundle\SecurityBundle\SecurityBundle::class => ['all' => true],

[fabpot]

So, the bundle is available during template compilation, so the compiled template contains the dump call.

[tacman]

Should I be doing something differently? My idea was do avoid inadvertently allowing a dump() call in production, which has burned me, especially when I do something like

    {{ app.request.get('debug') ? dump(article) }}

I thought the better way to do it would be

    {% guard function dump  %}
        {{ app.request.get('debug') ? dump(article) }}
    {% endguard %}

Am I misunderstanding something about guard?

[fabpot]

The guard tag does its magic at compilation time, not at runtime. So you need to make sure the bundle is not available when the production template are compiled.

[tacman]

I always assumed that happened during cache:clear and debug-bundle isn't available then. Is there a way to explicitly compile the templates? Or when are the production templates compiled?

[fabpot]

That should work then but again only if you have dev deps installed, which doesn’t seem to be the case.

[tacman]

Where are the twig templates compiled during production? Indeed, dev dependencies aren't available, so shouldn't guard return false when checking for dump, and ignore the code block?

[fabpot]

I assume you're using Symfony. The templates are compiled during a cache:clear or cache:warmup.
If you're able to share a reproducible app with me, I can probably investigate more.

[tacman]

Create a new symfony app:

symfony new ignore-dump-in-production --webapp && cd ignore-dump-in-production
bin/console make:controller AppController
sed -i "s|/app|/|" src/Controller/AppController.php

cat <<'EOF' > templates/app/index.html.twig
{% extends 'base.html.twig' %}
{% block body %}
    {% guard function dump  %}
       {{ dump() }}
    {% else %}
        dump cannot be used in production
    {% endguard %}
{% endblock %}
EOF

symfony server:start -d
symfony open:local

Now run in production

sed -i "s|APP_ENV=dev|APP_ENV=prod|" .env
bin/console cache:clear
symfony open:local

Logs show

[Web Server ] Jan 3 05:17:23 |ERROR | SERVER GET (500) / ip="127.0.0.1"
[PHP ] er":"App\Controller\AppController::index"},"request_uri":"https://127.0.0.1:8000/","method":"GET"},"level":200,"level_name":"INFO","channel":"request","datetime":"2025-01-03T10:17:23.904024+00:00","extra":{}}
[PHP ] {"message":"Checking for authenticator support.","context":{"firewall_name":"main","authenticators":0},"level":100,"level_name":"DEBUG","channel":"security","datetime":"2025-01-03T10:17:23.910638+00:00","extra":{}}
[PHP ] **{"message":"Uncaught PHP Exception Twig\Error\SyntaxError: "Did you forget to run "composer require symfony/twig-bundle"? Unknown function "dump" in "app/index.html.twig"." at UndefinedCallableHandler.php line 112","context":{"exception":{"class":"Twig\Error\SyntaxError","message":"Did you forget to run "composer require symfony/twig-bundle"? Unknown function "dump" in "app/index.html.twig".","code":0,"file":"/home/tac/g/sites/ignore-dump-in-production/vendor/symfony/twig-**bridge/UndefinedCallableHandler.php:112"}},"level":500,"level_name":"CRITICAL","channel":"request","datetime":"2025-01-03T10:17:23.940879+00:00","extra":{}}
[PHP ] [Fri Jan 3 05:17:23 2025] 127.0.0.1:43726 [500]: GET /
[PHP ] [Fri Jan 3 05:17:23 2025] 127.0.0.1:43726 Closing

[xabbuh]

I think I found the reason for this (no idea though yet how to fix it): #4511 (comment)

[tacman]

This feature would be really cool, to have dump() available only in dev and not break prod. I keep getting burned by leaving dumps in production, where they throw an error just being there, even if surrounded by an if statement so they're not exposed. Is this something that might be fixed in twig 4?

[stof]

This is something that we tried to fix in 3.18.0, but the implementation is incomplete. Once the implementation is fixed, you will be able to do that (you need to suround it with a {% guard %} tag though, not a {% if %} tag)