Iptraceable Listener Bundle Laravel Package

Product Decisions This Supports

• Audit-trail and provenance requirements. This package automatically stamps the originating client IP onto Doctrine entities when they are created or updated (via Gedmo's IpTraceable). That directly supports compliance-driven features: GDPR Article 32 processing records and proof of consent capture, SOC 2 / ISO 27001 access-and-change logging, and dispute resolution ("this order, consent, or admin change came from this address").
• Build vs. buy for a small capability. The alternative is a ~30-line Doctrine event subscriber you own. The decision is less "buy vs. build" and more "wire this in this sprint or defer" — it is cheap either way, so treat it as a low-risk enabler rather than a strategic dependency.
• Roadmap scoping for an audit/forensics epic. This package records only the IP. It does not capture user agent, geo, session ID, request ID, actor identity, or field-level diffs. If the product requirement is "full audit trail," this covers perhaps 20% of it; if the requirement is narrowly "record origin address," it covers 100%.
• Feature use cases to size against: consent and ToS acceptance records, order/booking origin, admin and back-office action logging, multi-tenant abuse and fraud triage, and support debugging ("which IP hit this account").
• Policy decisions it forces (valuable in themselves): IP addresses are personal data under GDPR — adopting this requires deciding retention windows, whether to hash/truncate the last octet, and whether the field is exposed in admin UIs or exports. Behind a CDN or load balancer it also requires a trusted-proxy configuration decision, or every record will show the edge node's address.

When to Consider This Package

Adopt when:

• You are on Symfony with Doctrine ORM and already depend on gedmo/doctrine-extensions. Note the correction to the brief: this is a Symfony bundle, not a Laravel package — there is no service provider, facade, or Eloquent integration.
• You want entity-level IP stamping without standing up an audit-log service, and you accept its narrow scope.
• You are willing to vendor the listener source into your codebase rather than take a Composer dependency. With 0 stars, 0 dependents, a single maintainer, and a last release of 2021-07-16, the maintenance signal is the dominant risk — the code is small and MIT-licensed, so copying it removes the risk entirely at near-zero cost. Release v1.0.4 (adding Symfony 5 support) does not change this verdict: it confirms the project targets a generation of Symfony that is now itself end-of-life, and the release cadence remains effectively dormant.

Look elsewhere (or replicate the pattern) when:

• Your stack is Laravel. This will not install or function meaningfully, and v1.0.4 does nothing to change that — the release is a Symfony 5 compatibility bump, not a framework-agnostic rewrite or an Eloquent integration. The native equivalent is a model observer plus a trait writing request()->ip() to a column — roughly the same effort, fully owned by you.
• You need supported-framework certainty. v1.0.4 raises the ceiling to Symfony 5 only; it does not add Symfony 6 or 7 support, and Symfony 5 has been end-of-life since November 2023. On a current Symfony codebase, still expect to fork and patch. Treat the version bump as evidence the package lags the ecosystem by roughly two major versions, not as a sign of renewed maintenance.
• You need a real audit log. Reach for Gedmo's Loggable, owen-it/laravel-auditing on the Laravel side, or a dedicated append-only audit service. DB columns can be edited by anyone with database access, so this is not tamper-evident.
• Schema hygiene is unresolved. The column must accommodate IPv6 (VARCHAR(45)), be indexed if you query by it, and sit inside a defined PII retention policy.

How to Pitch It (Stakeholders)

To executives: This is a small, MIT-licensed component that lets us answer "where did this record come from?" — the kind of question that shows up in audits, chargeback disputes, and abuse investigations. It is inexpensive and narrow, and it does not commit us to a vendor. The latest release only adds Symfony 5 compatibility, which tells us the project is being kept barely alive for older applications rather than actively developed; there is still no release since 2021 and no visible adoption. My recommendation is unchanged: absorb the roughly one-file implementation into our own codebase rather than depend on it. That gives us the capability with none of the supply-chain risk.

To engineering: It is a thin Doctrine event listener that writes the request's client IP into annotated entity fields on persist and update, built on Gedmo's IpTraceable. Scope is deliberately minimal: IP only, no user agent, geo, actor, or diff. Release v1.0.4 adds Symfony 5 support — useful only if you are on Symfony 4/5, and irrelevant if you are on Symfony 6/7 or Laravel, so plan to patch or reimplement rather than assume compatibility. Two things to settle before we wire it in — trusted-proxy handling so we capture the real client address behind our CDN, and a decision on retention/hashing since IP is PII. If we are not on Symfony + Doctrine + Gedmo, we should skip the package and implement the same observer pattern natively; it is comparable effort and we keep ownership.