Lib Php Eurip Sso Laravel Package

Product Decisions This Supports

• Build vs. buy for authentication: v0.3.0 moves this package from "custom OIDC glue" territory into a feature-complete identity integration. The extraction of JwtVerifier, structured OidcAuthenticationService, and dedicated controllers means the security-sensitive surface (token exchange, signature verification, key rotation) is now a maintained, tested dependency rather than a bespoke implementation your team owns. This is a strong argument for buy/adopt over build.
• Roadmap decisions:
  • B2B / partner APIs: Client Credentials Flow (eurip:sso:client-credentials) and token introspection (RFC 7662) unlock machine-to-machine product lines without a separate auth project.
  • CLI / desktop / headless tooling: Device Code Flow (RFC 8628) enables device-based login UIs as a roadmap item, not a bespoke spike.
  • Session security & enterprise readiness: Back-Channel and Front-Channel Logout endpoints plus OidcSessionChangedEvent and a ready-made SessionMonitor.html.twig component make "single logout" a sellable enterprise feature rather than a compliance gap.
  • Customer-facing auth UX: The sso_has_role / sso_has_permission / sso_has_group Twig helpers and claims DTO let you ship authorization-driven UI (role-gated nav, permission-aware actions) without per-page custom code.
• Operational/SLO decisions: eurip:sso:cache-warmup and eurip:sso:test-connection turn "will login work after deploy?" into a pre-flight check, supporting faster deploy cadence and clearer on-call runbooks. eurip:sso:introspect supports support-engineering triage.
• Platform upgrade planning: This release enforces PHP 8.4+ and Symfony 7.0/8.0+. That is a real infrastructure decision — you cannot adopt without a runtime upgrade plan, and conversely, adopting it can be a forcing function to consolidate on a supported PHP version (security patching, vendor lifecycle).
• Upgrade scope / estimation: The breaking changes list is substantial (removed config keys, controllers, constants, aliases, methods; constructor signature change; OidcConstants interface→final class). This is a major-version-sized change delivered under a 0.x number — a PM should treat it as a scheduled migration workstream with QA on auth flows, not a patch bump.
• Vendor-risk assessment: 60 tests, PHPStan Level 6 clean, PSR-12, real RSA keypair tests, PSR-3/PSR-17/PSR-18 abstractions, and bilingual flow documentation are positive health signals for a continue-investing decision.
• Portability decision: JwtVerifier is deliberately framework-agnostic — that supports reusing the same verification logic in workers, queue consumers, and non-HTTP entry points, and reduces lock-in if you later change front-end framework.

When to Consider This Package

Consider adopting when:

• You are on Symfony 7.0/8.0+ and PHP 8.4+ (or are planning that upgrade within the adoption window).
• You need OpenID Connect (not just SAML) with a mainstream IdP, including discovery, JWKS-based JWT verification, and key rotation.
• Single logout is a requirement — enterprise security reviews, regulated environments, or shared-workstation use cases where orphaned sessions are a risk.
• You need machine-to-machine auth (client credentials + introspection) or device-code login for CLI/headless products.
• You want authorization helpers (roles, permissions, groups, claims) surfaced directly in templates so product teams can ship gated UI without backend changes per feature.
• You value operational tooling: cache warmup, connection testing, and token inspection commands to support deploys and incident response.
• You have (or are willing to adopt) Symfony autowiring/attribute conventions — this release leans heavily on #[Autowire], #[Route], and #[AsEventListener], and removes the manual wiring escape hatches.

Look elsewhere (or defer) when:

• You are on PHP 8.2/8.3 or Symfony < 7.0 — v0.3.0 will not install, and v0.2.x is now effectively legacy. Budget the runtime upgrade before committing.
• You are on Laravel or another non-Symfony framework — despite being a PHP package, this release hardens the Symfony coupling (bundle service scanning, Twig functions, Twig UX components, attribute routing). Only JwtVerifier and the PSR-based internals are portable; the rest is not.
• You need SAML 2.0 or non-OIDC protocols — out of scope.
• You maintain heavy customizations of the previous internals — removed classes (OidcController, OidcRouteLoader, EuripSsoFacade), removed service aliases, removed OidcClient methods, and the changed OidcClient constructor mean forked/overridden code will break.
• You need a stable 1.x API guarantee — the 0.x versioning with breaking changes of this size signals the public surface is still settling. If you cannot absorb periodic migrations, wait or wrap it behind an internal interface.
• You want a minimal surface area with no Twig/UX dependency — several additions (logout component, session monitor template) are opt-in but assume Twig, and the package now bundles a fair amount of UI-adjacent code.
• You require SLA-backed commercial support — nothing here indicates a support contract; do your vendor diligence separately.

How to Pitch It (Stakeholders)

For executives (30 seconds):

The identity library we evaluated just shipped a substantial release. It now covers the full enterprise checklist — single logout, session monitoring, machine-to-machine authentication, and CLI/device login — plus command-line tooling that makes deploys and incident response safer. Two caveats: it now requires PHP 8.4 and Symfony 7/8, so adoption implies a runtime upgrade, and the release contains breaking API changes, so it is a planned migration, not a drop-in. Recommendation: fund the PHP/Symfony upgrade as a dependency, because this replaces custom auth code we would otherwise own — including the security-critical JWT verification we'd rather not hand-roll.

For engineering leadership:

v0.3.0 is effectively a 1.0-shaped release wearing a 0.3 label. The important change for us is architectural: JWT signature verification has been extracted into a dedicated, framework-agnostic JwtVerifier with explicit key-rotation retry behavior and real-keypair tests, and controller logic has been pulled into an OidcAuthenticationService with a typed error enum (OidcErrorCode). That is the difference between code we audit and code we maintain. Quality signals are credible — 60 tests, PHPStan Level 6 at zero errors, PSR-12 — and the new console commands give us a real pre-deploy health check. The costs are real: PHP 8.4+ floor, Symfony 7/8 only, and a long breaking-change list (removed facade, controller, route loader, service aliases, constants, and several OidcClient methods; constructor signature change). Treat this as a two-sprint migration with an auth-flow regression test suite, scoped alongside the runtime upgrade rather than on its own. If we're staying on PHP 8.2/8.3 this quarter, we should defer and pin to v0.2.x with eyes open that we're now on a legacy line.

For the delivery team:

Adopt v0.3.0 as part of the PHP 8.4 / Symfony 7+ upgrade, not before. Migration checklist: (1) delete any code implementing OidcConstants — it is now a final class; (2) swap EuripSsoFacade and the removed service aliases for FQCN constructor injection; (3) update OidcClient construction to pass JwtVerifier as the fifth argument, or go through OidcClientFactory::create(); (4) move any JWKS preloading calls (preloadJwks, fetchAndCacheJwks, invalidateJwksCache) to JwtVerifier; (5) replace event ::NAME constants with class-based dispatch and typed #[AsEventListener]; (6) drop the removed config keys and point routes.* at the new defaults. Then wire eurip:sso:test-connection and eurip:sso:cache-warmup into the deploy pipeline before switching traffic.