Enterprise Security Bundle Laravel Package

Product Decisions This Supports

Framework mismatch is the first decision. Despite the request framing ("Laravel/PHP package"), this is a Symfony-only bundle (Symfony 6.4 / 7.4, PHP 8.3+). Any roadmap item that assumes Laravel compatibility is a non-starter. Treat it as a Symfony decision, or as a reference implementation to port from.

• Build vs. buy for the authentication surface. The bundle collapses 16 discrete security features (TOTP 2FA, WebAuthn/passkeys, magic links, Google/Apple/Microsoft OAuth, lockout, rate limiting, session tracking, password policy/history/expiration, IP allow/deny, GDPR account deletion) into one dependency. That's roughly a quarter of engineering work for a mid-size team, and it's all undifferentiated work — none of it is your product's moat. Strong argument for buy.
• Compliance-driven roadmap sequencing. GDPR self-service deletion with grace period + anonymization cron, MFA enforcement, session revocation, password expiration — these are typically pulled forward by a security questionnaire, SOC 2 / ISO 27001 audit, NIS2, or PCI DSS 4.0's MFA requirement rather than by customer demand. Having these as configurable primitives rather than bespoke code shortens the path from "we lost an enterprise deal on the security review" to "we can answer the questionnaire."
• Upmarket readiness gate. The presence of passkeys, scope-wide password-login disable, IP whitelisting, and admin lockout management is the feature set buyers ask about in enterprise procurement. This is a lever for moving from SMB to mid-market without re-platforming.
• Architecture decision: contract-first vs. drop-in. The bundle deliberately ships interfaces and abstract controllers, not a UI. That is a product decision you inherit: you are buying engines, not a login page. Budget for integration work (entities, routes, templates, ~5 record interfaces + user mixins) as part of the adoption cost, and staff it.
• Sylius-specific shortcut. If you're on Sylius, the companion sylius-enterprise-security-plugin supplies the ready-made UI on top of this bundle — a materially different (lower) integration cost than raw Symfony.
• Vendor concentration risk as an explicit accept/decline. 0 stars, 0 dependents, single-vendor (3BRS), no commercial support contract evident. MIT license means you can fork and self-maintain, which is the mitigation — but the decision should be made consciously, not discovered later.
• Security posture signal. The changelog is unusually candid: 2.2.1 retracts an overclaim from 2.2.0 ("block account" doesn't close open sessions without your listener wired up), and 2.2.0 added signed OAuth state expiry and an IP-companion rate-limit counter for password spraying. That behavior — correcting its own docs and closing a real attack class — is a positive maintainer signal, and worth weighting against the adoption numbers.

When to Consider This Package

Adopt when:

• You are on Symfony 6.4 or 7.4 with PHP 8.3+ and have a Doctrine ORM already in place for your user entity.
• You need three or more of the listed features at once. The value is in the bundle; pulling it in for a single feature (e.g. just password policy) is poor leverage against the integration surface.
• You have engineering capacity to implement the contract layer — the persisted-record interfaces (MagicLinkRecordInterface, SessionRecordInterface, PasskeyCredentialRecordInterface, etc.), repositories, UserAnonymizerInterface, and the per-feature user mixins. This is days-to-weeks, not hours.
• You want a UI you control (branded auth flows, custom settings screens). The bundle intentionally doesn't compete with you there.
• You're on Sylius — the companion plugin changes the calculus substantially in favor of adoption.
• You need the security review answers more than you need the code: lockout policy, password history/similarity, timing padding against account enumeration, session fingerprinting.
• Your team can absorb single-vendor risk: either you're comfortable with a small maintainer, or you're prepared to fork under MIT and own it.

Look elsewhere when:

• You're on Laravel. This does not apply. There is no adapter path; the concepts (policy objects, validators, listeners) are portable but the code is not.
• You need a drop-in, batteries-included UI and don't want to write controllers, routes, and templates. Look at a hosted identity provider (Auth0, WorkOS, Clerk, Keycloak) instead — the build-vs-buy comparison there is "buy the whole auth stack," not "buy the primitives."
• You need a vendor with an SLA, certification evidence, or a support contract. 0 stars and 0 dependents means no community to lean on and no commercial backing visible in the repo.
• Compliance requires provenance you can't get. If your auditor wants a maintained dependency with a CVE process and a track record, the adoption numbers here are a real obstacle regardless of code quality.
• You don't have a Doctrine-backed user entity, or you're running a non-standard persistence layer the record contracts don't fit.
• You need only one feature. Integrating a bundle this broad to get, say, magic-link login is over-scoped — and every feature you don't disable is surface area you carry.
• Long-horizon (>2 year) single-team maintenance with no appetite for forking. Small maintainer + broad scope + 16 features is a lot of code to inherit if it goes quiet.

How to Pitch It (Stakeholders)

For executives: This is a mature, MIT-licensed Symfony component that gives us enterprise-grade authentication and compliance features — two-factor, passkeys, social login, account lockout, GDPR self-service deletion, IP restrictions — without building them ourselves. It ships the security engines, not a UI, so we retain full control of the customer experience while skipping roughly a quarter of engineering work that isn't differentiating. Two caveats to price in: it's Symfony-only (irrelevant to a Laravel roadmap), and it's maintained by a single vendor with essentially no external adoption — mitigated by the MIT license, which means we can fork and self-maintain if needed. Recommended next step: a two-week integration spike to quantify the contract-layer work before committing to a roadmap dependency.

For engineering: Contract-first Symfony bundle, PHP 8.3+, Symfony 6.4/7.4, pulls in scheb/2fa-bundle for the 2FA flows. It provides services, validators, event listeners, and abstract base controllers; you supply Doctrine entities/repositories for five record interfaces, user-entity mixins, routes, and templates. Quality signals are good: 384 unit tests, PHPStan level 8 with strict rules, ECS, and a changelog that proactively corrects its own inaccurate claims. Cost is the integration surface, not the code. Key risk to scope: ~0 stars / 0 dependents means we are effectively the largest consumer — plan for forking and owning maintenance, and pin to a reviewed commit rather than tracking dev-main.