Understanding Drupal: A Complete Guide to Caching Layers

simplytest.me had been sitting in the back of my mind for a long time. I knew it was unstable, and that release information kept falling out of date. It was a constant battle that always needed another round of maintenance, and it kept sliding.

The phpstan-drupal playground exists to reproduce bugs. You paste PHP, run PHPStan with phpstan-drupal against a real Drupal core install, and share the result link in an issue.

phpstan-drupal 2.1.0 is out. The theme of this release: rules and behaviors that proved themselves as opt-ins are now the defaults. If you run `composer update` and see new errors, that is the release working as intended — everything below includes the configuration to opt back out.

Drupal's config schema YAML supports dynamic expressions inside square brackets that resolve to values from the surrounding configuration data at runtime. Most developers have seen them — [%parent.type] in field formatter schema is a classic example — but few understand exactly how they work or when to use them.

Drupal's cache.backend.chainedfast makes your site faster without any configuration. All you need is to have APCu on your server. It shows up in the bootstrap, config, and discovery cache bins, and most developers never think about it or even know it is being leveraged.

When making code changes or fixing issues, it's easy to leave @todo comments behind. Sometimes they mark areas waiting on an upstream fix, sometimes they're reminders that never got revisited. Either way, they accumulate — and the ones tied to the specific issue you're working on should be resolved before the MR merges.

After starting in early 2023 and having a long hiatus from writing, my book Understanding Drupal: A Complete Guide to Caching Layers is now published on LeanPub! Three years ago (😱), I started working on this book that I wanted to self-publish.

Drupal's role-based access control is one of its strengths. Permissions and roles are well-understood, and the system is mature. But the moment you step outside the standard cookie-based session — say, into OAuth with the authorization code flow — you hit a wall that the core permission model never anticipated.