Switch User Stateless Bundle Laravel Package

Product Decisions This Supports

• Support-tooling feature decision: "log in as user" (impersonation). This package exists to let an operator act as an end user — the classic CS/QA capability that shortens time-to-resolution on account-specific bugs. If impersonation is on your roadmap, this is the problem space it addresses.
• Stateless vs. sessionful auth architecture. Symfony's built-in switch_user firewall listener assumes session state. This bundle is aimed at stateless, token-based APIs (JWT/OAuth), where "become this user" means minting or exchanging a token rather than mutating a session. That distinction is itself a product/architecture decision worth naming explicitly in a design doc.
• Build vs. buy for internal admin tooling. The functional surface is small (an admin-authenticated request yields a user-scoped credential). That makes "buy" attractive only if the package is maintained; otherwise this is a days-not-weeks in-house build, and the package is better treated as a reference implementation than a dependency.
• Security and compliance roadmap. Impersonation is a privileged capability: it needs audit logging (who impersonated whom, when, from where), short token TTLs, scoped permissions, and a consent/policy stance for regulated environments. Adopting any impersonation mechanism forces those decisions, and they belong in the roadmap regardless of vendor.
• Use cases it unlocks: CS reproducing customer-reported issues against real data, QA validating role/permission variants, internal ops unblocking stuck accounts, partner/vendor support sessions, and demos — each with different risk profiles.

When to Consider This Package

• Only if you are on Symfony. This is a Symfony bundle; the brief frames it as a Laravel/PHP package, but the integration path is Symfony's security/firewall layer. In a Laravel codebase it is not directly usable — the equivalent is Auth::loginUsingId() behind a guarded route, or an existing impersonation package. Treat the mismatch as a hard stop, not a detail.
• Only if your API is genuinely stateless. If you have sessions, Symfony's native switch_user covers this with zero new dependencies.
• Only after verifying version compatibility. Given zero stars, zero dependents, and no visible traction, expect stale composer.json constraints (Symfony 2/3/4-era). Confirm it installs against your Symfony and PHP versions before it appears in any plan.
• Vendor-risk threshold applies. Zero dependents means no observable production usage to learn from, no community CVE coverage, and no one to ask when it breaks. If your bar for third-party dependencies includes active maintenance or a security response path, this fails it.
• Look elsewhere when: you're on Laravel; you're on a modern Symfony version where a custom authenticator/listener is straightforward; you want standards-based delegation (OAuth 2.0 token exchange, RFC 8693); or you need a vendor-supported admin console rather than a library.

How to Pitch It (Stakeholders)

To executives: Impersonation is a support-efficiency lever — agents resolving issues in minutes instead of round-tripping with the customer, plus faster QA coverage of role-based flows. The risk is that it is a privileged backdoor into customer accounts, so any implementation must ship with audit trails, short-lived scoped credentials, and a documented policy. The specific package in front of us is a small, unmaintained open-source bundle with no visible adoption; we should not take a dependency on it. We should adopt the pattern, which is a small, well-understood piece of engineering, and own it.

To engineering: This bundle is a reference design for stateless impersonation on Symfony — an admin-authenticated request produces a user-scoped token instead of a session swap. Two caveats: it's Symfony-only (not applicable if the service in question is Laravel), and it has zero stars, zero dependents, and no maintenance signal, so it is a specification, not a dependency. Recommend we implement an equivalent authenticator in-house — mint a short-TTL token carrying both the acting admin and the subject user, enforce scope checks at the firewall, and emit an audit event on issuance and use. Budget is small; the security review is the long pole, not the code.