ecourty/token-bundle
Symfony bundle to manage secure, typed, revocable tokens for any Doctrine entity (password resets, email verification, share links). Supports expiry, single-use/max-uses, JSON payloads, events, subject resolution, and a purge command.
#[RequiresToken] attributes, Symfony events, and dependency injection). Laravel’s middleware and service container would require significant adaptation.Illuminate\Auth\Passwords\PasswordBroker, Laravel\Sanctum for tokens, or custom token services) that align better with its ecosystem.doctrine/orm (compatibility issues with Laravel’s database layer).TokenSubjectInterface).#[RequiresToken] attributes → Laravel uses middleware or route filters.Illuminate\Events\Dispatcher).Artisan is compatible, but the token:purge command would need adaptation.tokens table with specific columns (e.g., token, type, subject_id, expires_at). Laravel’s Eloquent would need a custom model to map this structure.| Risk Area | Severity | Mitigation Strategy |
|---|---|---|
| Doctrine vs. Eloquent | High | Avoid Doctrine; build a Laravel-compatible token service from scratch or adapt the bundle’s logic. |
| Symfony Dependency Injection | High | Replace Symfony services (TokenManager) with Laravel service providers or facades. |
| Attribute-Based Routing | Medium | Replace #[RequiresToken] with Laravel middleware. |
| Event System | Low | Laravel’s event system is compatible; minor adjustments needed. |
| Migration Complexity | Medium | Create a custom migration for the tokens table using Laravel’s schema builder. |
Why Laravel?
Token Use Cases
Performance Requirements
token:purge command critical for cleanup, or can Laravel’s queue-based job handling suffice?Security Review
Random component—Laravel’s Str::random() is equivalent.Long-Term Maintenance
Illuminate\Auth\Passwords\PasswordBroker (built-in).Laravel\Fortify or Illuminate\Auth\Events\Verified.token column + middleware.spatie/laravel-activitylog (for auditing) + custom token service.If proceeding with integration (not recommended), the path would be:
symfony/bridge and doctrine/orm.tokens table via Laravel migration:
Schema::create('tokens', function (Blueprint $table) {
$table->id();
$table->string('token')->unique();
$table->string('type');
$table->foreignId('subject_id')->constrained()->cascadeOnDelete();
$table->string('subject_type'); // e.g., "App\Models\User"
$table->timestamp('expires_at');
$table->boolean('single_use')->default(false);
$table->integer('max_uses')->nullable();
$table->integer('uses_count')->default(0);
$table->boolean('revoked')->default(false);
$table->json('payload')->nullable();
$table->timestamps();
});
TokenManager with a Laravel service provider:
class TokenServiceProvider extends ServiceProvider {
public function register() {
$this->app->singleton(TokenManager::class, function ($app) {
return new TokenManager(
new EntityManager($app['db']),
new TokenRepository(),
// ...
);
});
}
}
#[RequiresToken] with middleware:
class VerifyTokenMiddleware {
public function handle(Request $request, Closure $next) {
$token = $request->header('X-Token');
if (!$this->tokenManager->validate($token, 'share')) {
abort(403);
}
return $next($request);
}
}
Event system:
Event::listen(TokenCreatedEvent::class, function ($event) {
// Custom logic
});
tokens table with Eloquent models.Random, EventDispatcher can be swapped for Laravel equivalents).Artisan command structure).tokens table could grow large with high-volume tokens. Consider:
expires_at or type.Str::random() is sufficient).uses_count increments are race-safe, but Laravel’s EloquentHow can I help you explore Laravel packages today?