Easy Security Bundle Laravel Package

Getting Started

Minimal Steps

1. Installation:

   composer require easycorp/easy-security-bundle
   

   (Note: While this package is for Symfony, Laravel developers can adapt its core security logic for similar use cases.)

2. Register the Service: In Laravel, manually register the Security service in config/app.php under providers:

   'providers' => [
       // ...
       EasyCorp\Bundle\EasySecurityBundle\Security\SecurityServiceProvider::class,
   ],
   

   (Since Laravel doesn’t natively support Symfony bundles, this requires a custom wrapper or service class.)

3. First Use Case: Inject the security service into a controller or service to simplify user checks:

   use EasyCorp\Bundle\EasySecurityBundle\Security\Security;
   
   class UserController extends Controller
   {
       public function __construct(private Security $security) {}
   
       public function dashboard()
       {
           if ($this->security->isFullyAuthenticated()) {
               return view('dashboard');
           }
           return redirect()->route('login');
       }
   }
   

Implementation Patterns

Core Workflows

1. User Authentication Shortcuts: Replace verbose Symfony checks with concise methods:

   // Instead of:
   $user = auth()->user();
   $isAdmin = $user && $user->hasRole('ROLE_ADMIN');
   
   // Use:
   if ($this->security->isGranted('ROLE_ADMIN')) {
       // Admin logic
   }
   

2. Programmatic Login: Simplify manual token creation for API/auth flows:

   $user = User::find(1);
   $this->security->login($user); // Auto-handles token generation
   

3. Password Handling: Encode and validate passwords without manual hashing:

   $encoded = $this->security->encodePassword('plaintext');
   $isValid = $this->security->isPasswordValid('user_input', $user);
   

Integration Tips

• Laravel-Specific Adaptation: Create a facade or helper class to bridge Symfony’s Security with Laravel’s Auth:

  class LaravelSecurityFacade
  {
      public function isGranted($role)
      {
          return auth()->check() && auth()->user()->hasRole($role);
      }
  }
  

  (Use this to avoid direct Symfony dependency.)

• Event Listeners: Hook into Laravel’s auth.attempting or auth.login events to extend the bundle’s logic:

  Event::listen('auth.login', function ($user) {
      $this->security->login($user); // Custom post-login logic
  });
  

• Testing: Mock the Security service in PHPUnit:

  $mockSecurity = Mockery::mock(EasyCorp\Bundle\EasySecurityBundle\Security\Security::class);
  $mockSecurity->shouldReceive('isGranted')->andReturn(true);
  $this->app->instance('security', $mockSecurity);
  

Gotchas and Tips

Pitfalls

1. Symfony Dependency:

   • The package is Symfony-specific. To use it in Laravel, you’ll need to:
     • Create a wrapper class (e.g., LaravelSecurityAdapter).
     • Manually implement missing Symfony services (e.g., TokenStorage, AuthorizationChecker).
   • Workaround: Use Laravel’s built-in Auth methods for core logic and only adopt specific shortcuts (e.g., isFullyAuthenticated).

2. Deprecated Methods:

   • The bundle removed addClassesToCompile (v1.0.4), which may break older Symfony integrations.
   • Tip: If extending, avoid relying on deprecated Symfony components.

3. Authentication State Confusion:

   • The bundle’s isAnonymous()/isRemembered() differ from Symfony’s defaults.
   • Debugging: Verify behavior with:

     dd($this->security->isAuthenticated(), auth()->check());
     

Debugging Tips

• Login Errors: Check failed attempts with:

  $error = $this->security->getLoginError();
  logger($error); // Log to Laravel’s log channel
  

• Role Hierarchy Issues: Use hasRole() with explicit user objects to debug:

  $user = User::find(1);
  if (!$this->security->hasRole('ROLE_ADMIN', $user)) {
      logger("User lacks role: " . json_encode($user->roles));
  }
  

Extension Points

1. Custom Authentication Logic: Extend the Security class to add Laravel-specific methods:

   class ExtendedSecurity extends \EasyCorp\Bundle\EasySecurityBundle\Security\Security
   {
       public function checkApiToken($token)
       {
           return Hash::check($token, config('api.token'));
       }
   }
   

2. Override User Checks: Replace isFullyAuthenticated() with Laravel’s auth()->viaRemember():

   public function isFullyAuthenticated()
   {
       return auth()->check() && !auth()->viaRemember();
   }
   

3. Password Encoding: Use Laravel’s Hash facade instead of the bundle’s encoder:

   $encoded = Hash::make('plaintext');