<?php

// dipatch an update from Symfony (for instance in a POST controller)
namespace App\Controller;

use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Messenger\MessageBusInterface;
use Symfony\Component\Mercure\Update;

class Publish
{
    public function __invoke(MessageBusInterface $bus)
    {
        // use doctrine to save an event
        $bus->dispatch(new Update(
            'http://example.com/foo/bar',
            'New content of the resource'
        ));

        return new Response('OK');
    }
}

<?php

namespace App\Controller;

use Fig\Link\Link;
use Lcobucci\JWT\Builder;
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;

class Discover extends AbstractController
{
    public function __invoke(Request $request)
    {
        $this->addLink($request, new Link('mercure', 'https://demo.mercure.rocks'));

        return $this->json(['@id' => 'http://example.com/foo/bar', 'availability' => 'https://schema.org/InStock']);
    }
}

<?php

namespace App\Controller;

use Fig\Link\Link;
use Lcobucci\JWT\Builder;
use Lcobucci\JWT\Signer\Hmac\Sha256;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;

class Discover extends AbstractController
{
    public function __invoke(Request $request)
    {
        // ...
        $username = $this->getUser()->getUsername();
        $token = (new Builder())
            // set other JWT appropriate JWT claims, such as an expiration date
            ->set('mercure', ['subscribe' => [$username, 'another-target']]) // could also include the security roles
            ->sign(new Sha256(), '!UnsecureChangeMe!') // store the key in a parameter instead
            ->getToken();

        $response = new JsonResponse(['@id' => '/demo/books/1.jsonld','availability' => 'https://schema.org/InStock']);
        $response->headers->set('set-cookie', sprintf('mercureAuthorization=%s; path=/subscribe; secure; httponly; SameSite=strict', $token));

        return $response;
    }
}

<?php

namespace App\Controller;

use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Messenger\MessageBusInterface;
use Symfony\Component\Mercure\Update;

class Publish
{
    public function __invoke(MessageBusInterface $bus)
    {
        // use doctrine to save an event
        $id = $bus->dispatch(new Update(
            'http://example.com/foo/bar',
            'New content of the resource',
            ['a-username', 'a-group', 'anything-else'] // the targets authorized to receive this update
        ));

        return new Response($id, 200, ['Content-Type' => 'text/plain']);
    }
}