- Can I install canaltp/sam-ecore-security-manager-bundle in a Laravel application?
- No, this is a Symfony bundle for CanalTP's SAM/Ecore stack, not a Laravel package. It plugs into Symfony's kernel, dependency injection container, and firewall rather than Laravel's service providers and auth guards. For Laravel you should treat it as a reference implementation and rebuild the authorization intent with native policies or a maintained Laravel permission package.
- What does this package actually provide for authentication and authorization?
- It wires security manager services into SAM/Ecore applications and exposes configuration for authentication and access-control rules. Its real product value is authorization over e-core domain entities such as lines, networks, stop areas, and journeys, including entity-scoped roles, ownership, and hierarchical referential permissions. The bundle itself is thin glue over Symfony Security and security-acl rather than a full authorization product.
- Which Laravel versions are supported?
- None. The package is built for Symfony and has no Laravel service provider, guards, middleware, or Laravel-version support matrix. If your target is Laravel, this package is out of scope for Composer installation and should only inform a spec-extraction exercise.
- How do I install and configure it in a Symfony SAM/Ecore application?
- You would normally require canaltp/sam-ecore-security-manager-bundle with Composer inside a Symfony SAM/Ecore service, enable the bundle, and declare security configuration so the bundled services are wired into the container and firewall. However, the provided context gives no README details, config keys, or documented install steps. Confirm the actual PHP and Symfony version matrix and inspect the bundle extension before committing to adoption.
- Does it work with Symfony 4, 5, 6, or 7?
- It is likely pinned to Symfony 2.x or 3.x and symfony/security-acl, which was deprecated in Symfony 3.4 and removed in 4.0. Composer resolution against PHP 8.2 and Symfony 6 or 7 will almost certainly fail without a fork you own. Treat Symfony 4+ as not viable unless you accept full maintenance of the fork.
- What are the main risks of using this bundle in production?
- Abandonment risk is critical because nothing upstream will patch the auth path, and security risk is high because ACL and voter logic can drift silently and fail open. The transitive dependency tree, including old Doctrine ORM and ACL schema, is likely the real cost rather than the bundle's own files. The licence is unverified and Navitia lineage may include AGPL-family licensing, so confirm legal clearance before vendoring or forking.
- Is there a Laravel alternative for entity-scoped roles and access policies?
- For Laravel, use native Gate and Policy classes for entity-scoped authorization, optionally with a maintained permission package such as spatie/laravel-permission. Entity roles, ownership checks, and referential hierarchies map cleanly onto policies and are cheaper to own than a Symfony bridge. This should be the default roadmap approach for a Laravel target.
- How should I test the security behavior if I adopt it?
- There are no tests in evidence and no dependents to rely on, so you must reverse-engineer the permission semantics and write characterization tests around the expected allow and deny cases. Include negative tests for entity ownership, hierarchy traversal, and token or credential handling to prove the system fails closed. Run these tests against the exact pinned dependency set before any production use.
- Is the package actively maintained, and who owns it?
- The context shows zero stars, zero dependents, and no visible release cadence, which makes it effectively private vendor code. There is no named owner or review cadence in evidence, and no owner should mean no adoption for an authentication path. Before committing a milestone, identify who owns the code internally and how security patches will be handled.
- What is the recommended migration path from this bundle to Laravel?
- Treat the repository as a reference implementation, not a dependency. Extract the permission model, including roles, ownership, hierarchy, and credential semantics, into a written spec, then rebuild it on Laravel Gate and Policy primitives with tests. If a hard dependency is unavoidable in a legacy Symfony service, vendor the code into your own VCS, pin the SHA, and record ownership in the risk register.