Weave Code
Enterprise Security Bundle Laravel Package
3brs/enterprise-security-bundle
Standalone Symfony bundle with reusable security primitives: 2FA, passkeys/WebAuthn, magic-link and OAuth login, account lockout, session tracking, IP allow/deny lists, password policy, GDPR account deletion, and runtime settings. Contracts only—wire into your app.
3brs/enterprise-security-bundle is a standalone Symfony 6.4 / 7.4 bundle supplying reusable security primitives: two-factor authentication, passkeys (WebAuthn/FIDO2), magic-link login, OAuth providers, account lockout, session tracking, password policy, and GDPR self-service deletion. It ships contracts and abstract flows rather than a wired-up UI, so you bind it to your own entities, routes, and templates.
- Passkey & magic-link authentication ceremonies
- OAuth login for Google, Apple, and Microsoft
- 2FA with TOTP, QR codes, and recovery codes
- Password policy, history, expiration, and scope-wide login control
- Session tracking, IP lists, lockout, and runtime settings store
Frequently asked questions about Enterprise Security Bundle
- Is 3brs/enterprise-security-bundle compatible with Laravel?
- It is not a Laravel package; it is a standalone Symfony bundle built around Symfony contracts and services. The v2.5.0 assessment says it targets Symfony 8 and PHP 8.4, while the README excerpt references Symfony 6.4 and 7.4, so verify the exact Composer constraints on Packagist before adopting. Laravel 11 and 12 pin several Symfony components at ^7.x, so in-process compatibility is likely to require forced resolutions, which is risky. Treat it as a standalone service or a substantial adapter project rather than a drop-in Laravel dependency.
- Can I install 3brs/enterprise-security-bundle in a Laravel 11 or 12 app?
- Composer resolution is the critical gate: the bundle's v2.5.0 constraints move to Symfony ^8.0, while laravel/framework pins components such as symfony/http-foundation, console, and http-kernel at ^7.x. Both packages load Symfony symbols into the same process, so forcing constraints can result in two Symfony major versions loading Request, Response, or EventDispatcher classes together. Test the install in a throwaway Laravel 11 or 12 skeleton first, and do not force resolution in a production application. If it cannot resolve cleanly, deploy the bundle outside the Laravel process.
- What security features does 3brs/enterprise-security-bundle provide?
- The bundle provides reusable security primitives for two-factor authentication, passkeys and WebAuthn, magic-link login, OAuth with Google, Apple, and Microsoft, account lockout with rate limiting, session tracking, IP allow and deny lists, password policy with history and expiration, GDPR self-service account deletion, and a runtime-configurable settings store. It ships contracts, services, validators, event listeners, and abstract base controllers rather than a wired-up UI. You bind it to your own entities, routes, and templates, which in Laravel means writing guards, middleware, and adapter classes.
- What PHP version does the Symfony 8 release of this bundle require?
- The assessment states that v2.5.0 raises the PHP floor to 8.4 because Symfony 8 uses PHP 8.4 as its baseline. That narrows the runtime matrix compared with earlier versions and may affect Docker base images, Laravel Vapor or Lambda runtimes, Forge or Envoyer servers, and CI pipelines. Audit every runtime target before committing to the upgrade, not just your local development environment.
- How do I integrate passkeys or WebAuthn from this bundle into a Laravel application?
- The bundle supplies WebAuthn ceremony contracts and service logic, but Laravel integration requires adapters written against Symfony 8 interfaces rather than the older 6.4 or 7.x interfaces assumed by earlier assessments. You would map the bundle's flows into Laravel guards, middleware, routes, and your user model, and you must account for removed deprecations that fail at runtime rather than install time. For an in-process Laravel app, prefer a Laravel-native WebAuthn package. If you need the bundle's broader feature set, run it as a standalone Symfony 8 service and call it over HTTP or OIDC.
- Is Symfony 8 a long-term-support release I can safely build on?
- Symfony 8.0 is a standard, non-LTS major release, so you should expect a rapid consolidation around the next LTS version. The assessment recommends requiring a maintainer statement on the 8.x support track before committing. Check the package's release history, CI status, and issue activity rather than assuming long-term maintenance.
- What are the main technical risks of using this bundle with Laravel?
- The highest risk is a Composer constraint conflict with laravel/framework, followed by the PHP 8.4 runtime requirement and dual-Symfony-major symbol collisions in one process. Symfony 8 also removes code deprecated across 6.4 through 7.4, so adapters written against legacy aliases can fail hard at runtime. Mitigate with interface-based bindings, thin adapter code, integration tests, and preferably the standalone-service topology. Avoid class_alias hacks that try to mask two Symfony majors in one autoloader.
- Can I run this bundle as a standalone service instead of installing it inside Laravel?
- Yes, that is the recommended fallback if in-process Composer resolution fails. Deploy the bundle as a standalone Symfony 8 service that exposes an OIDC or HTTP API, then have the Laravel application call that service for authentication, passkeys, OAuth, lockout, or account deletion flows. This avoids loading two Symfony major versions in one process and keeps the Laravel side limited to HTTP clients and middleware. It also gives you a clearer path to replace the service with Laravel-native packages later if needed.
- How should I test a Laravel integration with 3brs/enterprise-security-bundle?
- Start with a throwaway Laravel 11 or 12 skeleton and attempt a real Composer install before writing application code. Then add integration tests around the adapter layer for login, WebAuthn ceremonies, OAuth callbacks, lockout, rate limiting, session tracking, and configuration loading. Test on the actual PHP 8.4 runtime you plan to deploy, including queue workers and scheduled jobs if they touch security services. Because removed Symfony deprecations fail at runtime, exercise every code path rather than relying only on static analysis.
- How does configuration work with this bundle, and how should it map to Laravel config and .env?
- The bundle uses Symfony's configuration component, and Symfony 8 drops legacy YAML and XML aliases, so any adapter must target the current configuration interfaces. In Laravel, map static policy values to config/*.php files backed by .env, and use the bundle's runtime settings store only for values that genuinely need to change without deployment. Document which system is the source of truth for each policy to avoid configuration drift. Keep the mapping layer small and covered by tests so future Symfony or Laravel upgrades are easier to absorb.
Weaver
How can I help you explore Laravel packages today?