Dark Portal Bundle Laravel Package

Product Decisions This Supports

• Multi-domain OAuth2.0 integration: Enables seamless authentication across multiple subdomains (e.g., wechat.xxx.com, weixin.xxx.com) using a single OAuth provider (e.g., WeChat) that restricts redirect_uri to one host.
• Decoupled OAuth flow: Splits the OAuth2.0 process into two phases (code acquisition → token exchange), allowing flexibility in domain handling without violating provider constraints.
• Cost-efficient scaling: Avoids the need for multiple OAuth app registrations or complex proxy setups by centralizing code acquisition on a single "dark portal" host.
• Roadmap alignment: Supports future plans for:
  • Expanding to additional OAuth providers with similar restrictions (e.g., enterprise SSO platforms).
  • Integrating with microservices architectures where authentication must span multiple domains.
• Build vs. buy: Justifies buying this lightweight bundle over custom development for teams lacking OAuth2.0 expertise or time to build a compliant solution.

When to Consider This Package

• OAuth provider constraints: Use when the provider (e.g., WeChat, Workplace) enforces a single redirect_uri host but your app requires authentication across multiple domains/subdomains.
• Legacy system integration: Ideal for modernizing older Laravel apps where OAuth2.0 was previously unsupported due to domain limitations.
• Low-risk prototyping: Suitable for MVP phases where quick, compliant OAuth integration is needed without over-engineering.
• Avoid if:
  • Your OAuth provider allows multiple redirect_uri hosts (no need for workarounds).
  • You require high-security compliance (e.g., SOC2) without additional validation layers.
  • Your team prefers full control over the OAuth flow (e.g., custom PKCE implementation).

How to Pitch It (Stakeholders)

For Executives: "This Laravel bundle solves a critical bottleneck for scaling our OAuth2.0 logins across multiple domains—like WeChat or Workplace—without needing separate provider accounts. By centralizing the ‘code acquisition’ step on a single ‘dark portal’ server, we comply with provider rules while enabling seamless user flows across all our apps. It’s a low-code, high-impact fix for a common pain point, with minimal operational overhead."

For Engineering: *"This package abstracts the OAuth2.0 domain restriction problem by splitting the flow into two phases:

1. Code acquisition: Handled by a dedicated oauth-code.xxx.com endpoint (compliant with provider rules).
2. Token exchange: Executed freely on any domain. It’s a drop-in Symfony/Laravel bundle with clear config (e.g., security.yml) and minimal runtime impact. Tradeoff: Adds a single dependency but eliminates custom proxy logic or provider workarounds."*