Weave Code
Hidden Entity Bundle Laravel Package
gibilogic/hidden-entity-bundle
A Symfony bundle for flagging Doctrine entities as hidden so they are excluded from default queries, listings and search results, with filters and annotations to control when hidden records are revealed.
GiBiLogic Hidden Entity Bundle
Frequently asked questions about Hidden Entity Bundle
- Is gibilogic/hidden-entity-bundle compatible with Laravel?
- No. It is a Symfony 2 bundle that registers a form type, a DI extension, and a Doctrine ORM data transformer, and Laravel has no Symfony Form component or bundle container for it to attach to. The form type also targets the pre-3.0 Symfony API with setDefaultOptions, so it would fatal against current Symfony as well. Treat it as a design reference rather than an install target.
- How do I install gibilogic/hidden-entity-bundle in a Laravel application?
- You should not. Its Composer constraints target PHP 5.x-era and Symfony 2, so they will not resolve against PHP 8.1+ and a current Laravel composer.json. There is no service provider, facade, or config file to register. If you need the behaviour, implement roughly 50 to 100 lines natively in your Laravel application.
- What does the HiddenEntityType form field actually do?
- It renders a hidden input carrying only an entity identifier and uses a data transformer to resolve that ID back to a managed Doctrine entity on submit. This lets associations survive form handling without exposing a selectable list or leaking entity data to the user. It works with any entity and a configurable object manager inside Symfony Forms.
- How do I replace HiddenEntityType with native Laravel code?
- Render a hidden Blade input containing the ID, then resolve it server-side with findOrFail or route model binding. Validate the scalar with Rule::exists('posts', 'id')->where('tenant_id', $tenantId) and authorize the resolved model with a Policy or Gate. Prefer route model binding when the identifier can live in the URL, because it centralizes both resolution and authorization. Map the hidden render to a Blade input, the transformer to a validation rule or prepareForValidation, and the Doctrine hydration to exists plus an authorization check.
- Is a hidden input containing an entity ID safe from tampering?
- No, not by itself. A hidden field is fully user-controlled, so hiding the input provides no protection; the server must resolve the entity and verify ownership and tenant scope on every submit. The name hidden entity invites exactly that misconception, so call it out explicitly in code review and security audits. Pair the exists rule with an authorization check on the resolved model.
- Which Laravel and PHP versions does this package support?
- None officially. The bundle is built for Symfony 2 and PHP 5.x-era constraints and does not support Laravel or PHP 8.1+. It will not install cleanly against a modern Laravel composer.json. There is no maintained branch for current frameworks.
- Can I use this bundle with Doctrine ORM inside Laravel?
- Doctrine is not a first-class citizen in Laravel, and this bundle expects the Symfony bundle container plus the Symfony Form data-transformer pipeline. Even with a Doctrine integration package, there is no form factory for the type to attach to. The practical path is to reimplement the semantics with Eloquent or your existing repository layer.
- How should I authorize the entity ID submitted in a hidden field?
- Resolve the ID to a model first, then authorize the model rather than the raw value. Use a Policy or Gate::authorize call, and scope the lookup with Rule::exists(...)->where('tenant_id', ...) or a global scope. Never trust the hidden value for ownership, because a user can post any ID. For wizard or multi-step state, consider signed identifiers or server-side session carry-over instead.
- Does this package work with Symfony 6 or other current Symfony versions?
- No. The form type uses setDefaultOptions, which was replaced by configureOptions in Symfony 3.0, and the bundle's Composer constraints will not resolve on supported Symfony versions. It has been effectively end-of-life since Symfony 2 reached end of life. There are no security backports.
- Is gibilogic/hidden-entity-bundle actively maintained and monitored for security issues?
- There is no evidence of production use: zero stars, zero dependents, and no release cadence or CVE monitoring. Symfony 2 is long end-of-life with no security backports, so any vulnerability would go unnoticed. There is also no maintainer SLA. Do not add it to a production dependency tree.
Weaver
How can I help you explore Laravel packages today?