Auth Bundle Laravel Package

Product Decisions This Supports

• Single Sign-On (SSO) Integration: Accelerates integration with AppShed’s authentication system, reducing friction for users already authenticated via AppShed cookies. Enables seamless cross-platform logins (e.g., web + mobile apps) without requiring password resets or OAuth flows.
• Roadmap for Unified Identity: Aligns with a strategy to centralize authentication under a single provider (AppShed), simplifying user management and reducing support overhead for password recovery/resets.
• Build vs. Buy: Buy—avoids reinventing cookie-based auth logic, leveraging AppShed’s existing infrastructure. Lowers dev effort for a niche but critical feature (auth).
• Use Cases:
  • Legacy System Modernization: Migrate older apps to use AppShed’s auth without rewriting core auth logic.
  • Embedded Apps: For apps embedded in AppShed’s ecosystem (e.g., SaaS tools, dashboards) where users expect SSO.
  • Reduced Friction: Eliminate "login walls" for users who already have AppShed cookies (e.g., internal tools, partner portals).

When to Consider This Package

• Adopt if:
  • Your product relies on AppShed’s ecosystem (e.g., shared user base, embedded workflows).
  • You need cookie-based auth (not OAuth/OpenID) and want to avoid building from scratch.
  • Your stack uses Symfony 2.6 (compatibility constraint; may require polyfills for newer versions).
  • You prioritize speed over customization (package is lightweight but lacks active maintenance or community).
• Look Elsewhere if:
  • You require modern auth standards (OAuth 2.0, OpenID Connect) or multi-provider support.
  • Your PHP/Symfony version is newer than 5.4/Symfony 2.6 (package is outdated).
  • You need auditability or compliance (package has no stars, minimal documentation, or unclear security practices).
  • Your users don’t use AppShed cookies (e.g., standalone B2C apps).
  • You require active maintenance (last commit/activity unknown; MIT license but no community).

How to Pitch It (Stakeholders)

For Executives: "This package lets us leverage AppShed’s existing authentication system to log users in instantly—no passwords, no OAuth hassles. It’s a 2-week integration (vs. months to build) that unlocks seamless SSO for our embedded apps and internal tools. Low risk (MIT license), high reward for user experience and support costs. Tradeoff: Limited to AppShed’s ecosystem and older Symfony versions."

For Engineering: *"The appshed/auth-bundle handles cookie-based auth via AppShed’s API with minimal code. Key pros:

• Symfony 2.6 bundle: Plugs into existing Symfony apps with minimal config.
• API-driven: Uses Guzzle for HTTP calls to AppShed’s auth service.
• Lightweight: ~50 LOC (per composer.json deps), no heavy dependencies. Cons: Outdated (Symfony 2.6), no tests/docs, and unclear long-term support. Recommend wrapping it in a service layer to isolate changes. Prioritize security review of cookie handling."*