Oauth Server Bundle Laravel Package

Product Decisions This Supports

• Enterprise / SSO roadmap: This release moves the package from "mostly OIDC" to spec-faithful OIDC id_token issuance. If your roadmap includes "Sign in with [Our Product]" for third-party clients, healthcare/education/government buyers, or customers running their own IdPs, the nonce claim is table stakes — without it, conformant relying parties will reject your id_tokens or fail their security review.
• Security posture and audit response: Binding the nonce to the authorization code closes a token-replay/injection gap between the authorization request and the token endpoint. This is a defensible answer in a SOC 2 / pen-test finding rather than a "we'll fix it next quarter" item.
• Step-up and re-authentication features: auth_time is the primitive that makes max_age and prompt=login enforceable — i.e. "require password again before a payout / admin action / PHI view." That's a product capability (sensitive-action gating, session freshness policies), not just a protocol checkbox.
• Build vs. buy: The alternative is hand-rolling nonce persistence across the consent round-trip plus schema changes in your auth-code store. That's undifferentiated, security-sensitive plumbing across three storage backends — a poor use of a sprint.
• Client onboarding decisions: Because the nonce now survives the consent round-trip via a hidden form field, you can onboard clients that use nonce strictly without writing custom glue in your consent UI. Fewer integration exceptions per customer.

When to Consider This Package

Consider adopting or upgrading when:

• You operate an authorization server and issue id_tokens to clients you don't fully control (third-party apps, partner integrations, customer-deployed clients).
• A prospect or existing customer has an OIDC conformance requirement, or their IdP/RP library validates nonce and auth_time.
• You need max_age / prompt=login semantics for sensitive flows, and are currently faking freshness with custom session timestamps.
• You already use the Doctrine-backed auth code storage (ORM, MongoDB, or CouchDB) and want the schema change handled rather than invented.

Look elsewhere, or scope down, when:

• You're doing plain OAuth 2.0 (scopes and access tokens) and no id_tokens — the nonce/auth_time work is inert for you.
• Identity is outsourced to a hosted IdP (Auth0, Okta, Cognito, Entra) and this package would only be a middle layer.
• You need SAML or WS-Federation for a specific buyer — that's a separate track, not solved here.
• Your team has forked the auth code storage or implements AuthCodeInterface directly with no capacity for a maintenance touch this cycle — the interface change lands on you (see below).

Upgrade caveats to price in (v6.0.0):

• AuthCodeInterface gains setNonce() / setAuthTime(). Any in-house implementation of that interface breaks at the type level — mechanical to fix, but it is a breaking surface for custom storage.
• Nullable nonce and auth_time columns mean a database migration on your auth code table(s), across whichever Doctrine mapping you use. Schedule it; don't let it ride in a Friday deploy.
• auth_time is deliberately not stamped by the package — your application must set it at the point of real user authentication. That's a small but genuine integration task in your login/token controller, and it's easy to silently ship nulls if nobody owns it.
• Treat this as a minor upgrade effort with a compatibility review, not a drop-in patch bump.

How to Pitch It (Stakeholders)

For executives: This release removes a blocker on enterprise and partner sign-in. It brings our OIDC implementation in line with what buyer security teams and third-party client libraries expect, and it gives us the technical hook for "prove you re-authenticated recently" policies on sensitive actions. The cost is a small, well-understood upgrade: a schema migration and a few lines in our login flow. The alternative — building this ourselves — is security-sensitive work in the hardest part of the auth flow, and we'd own it forever.

For engineering: v6.0.0 carries nonce and auth_time on the authorization code, so we can emit correct nonce and auth_time claims in the id_token at the token endpoint. Practical impact: AuthCodeInterface has two new setters (breaks any in-house implementation), the three Doctrine mappings need a migration for nullable nonce / auth_time columns, the nonce is preserved across the consent screen for us, and we must stamp auth_time ourselves at real authentication time. Recommended sequencing: migration → interface fix-ups → token controller change → verify with a conformance client.