Ccdn User Security Bundle Laravel Package

Getting Started

Minimal Setup

1. Installation Add the bundle via Composer (if still needed for legacy projects):

   composer require codeconsortium/ccdn-user-security-bundle
   

   Register the bundle in config/bundles.php:

   return [
       // ...
       CodeConsortium\CCDNUserSecurityBundle\CCDNUserSecurityBundle::class => ['all' => true],
   ];
   

2. Configuration Override default settings in config/packages/ccdn_user_security.yaml (if the file exists). Example:

   ccdn_user_security:
       security_level: 'high'  # or 'medium', 'low'
       password_policy:
           min_length: 12
           require_uppercase: true
   

3. First Use Case Use the bundle’s security listener to enforce password policies during registration/login:

   use CodeConsortium\CCDNUserSecurityBundle\EventListener\SecurityListener;
   
   // Triggered automatically if configured in services.yaml:
   // services:
   //     CodeConsortium\CCDNUserSecurityBundle\EventListener\SecurityListener:
   //         tags: ['kernel.event_listener', { event: 'security.user.register', method: 'onRegister' }]
   

Implementation Patterns

Core Workflows

1. Password Validation Integrate with Symfony’s form validation by extending the PasswordConstraint:

   use CodeConsortium\CCDNUserSecurityBundle\Validator\Constraints\Password as CCDNPassword;
   
   $builder->add('plainPassword', CCDNPassword::class, [
       'security_level' => 'high',
   ]);
   

2. Event-Driven Security Listen to built-in events (e.g., security.user.login.failed) to log or block suspicious activity:

   // services.yaml
   App\EventListener\SecurityEventListener:
       tags:
           - { name: 'kernel.event_listener', event: 'security.user.login.failed', method: 'onLoginFailed' }
   

3. Custom Security Levels Extend the SecurityLevel enum (if the bundle exposes it) to add project-specific rules:

   namespace App\Security;
   
   use CodeConsortium\CCDNUserSecurityBundle\Model\SecurityLevel as BaseSecurityLevel;
   
   class CustomSecurityLevel extends BaseSecurityLevel {
       public const EXTRA_STRICT = 'extra_strict';
       // ...
   }
   

Integration Tips

• Symfony Forms: Use the bundle’s CCDNUserType for user registration forms.
• APIs: Combine with Symfony’s Security component to validate tokens/passwords via SecurityListener.
• Doctrine: Ensure your User entity implements CodeConsortium\CCDNUserSecurityBundle\Model\UserInterface.

Gotchas and Tips

Pitfalls

1. No Longer Supported

   • Risk: No updates for vulnerabilities or Symfony 6+ compatibility.
   • Workaround: Fork the repo and maintain it locally, or replace with alternatives like:
     • symfony/security-bundle (built-in)
     • friendsofsymfony/user-bundle

2. Configuration Overrides

   • The bundle may not respect Symfony’s autowiring for services. Manually define services in services.yaml:

     services:
         CodeConsortium\CCDNUserSecurityBundle\:
             resource: '../vendor/codeconsortium/ccdn-user-security-bundle/*'
             exclude: '../vendor/codeconsortium/ccdn-user-security-bundle/{Tests,DependencyInjection,Resources}/*'
     

3. Event Naming Conflicts

   • Events like security.user.register might clash with other bundles. Prefix custom listeners:

     // Use 'app.security.user.register' instead of 'security.user.register'
     

Debugging

• Enable Debug Mode: Add to config/packages/dev/ccdn_user_security.yaml:

  ccdn_user_security:
      debug: true
  

• Check Logs: Errors may appear in var/log/dev.log (Symfony’s default).

Extension Points

1. Custom Validators Extend CodeConsortium\CCDNUserSecurityBundle\Validator\Constraints\PasswordValidator:

   namespace App\Validator;
   
   use CodeConsortium\CCDNUserSecurityBundle\Validator\Constraints\PasswordValidator as BaseValidator;
   
   class CustomPasswordValidator extends BaseValidator {
       public function isValid($value, Constraint $constraint) {
           // Add custom logic
           return parent::isValid($value, $constraint);
       }
   }
   

2. Override Templates Copy templates from vendor/codeconsortium/ccdn-user-security-bundle/Resources/views/ to templates/bundles/ccdnusersecurity/ to customize error messages.

3. Database Schema If the bundle adds fields (e.g., failed_login_attempts), ensure your migrations include them:

   // Example migration
   $table->integer('failed_login_attempts')->default(0);
   

Pro Tips

• Test Locally: Use Docker or a VM to isolate the bundle’s behavior.
• Document Assumptions: Since the bundle is abandoned, document why it’s used and its limitations in your project’s README.
• Fallback Plan: Prepare to migrate to a maintained alternative (e.g., FOSUserBundle) if critical issues arise.