Http Log Bundle Laravel Package

Product Decisions This Supports

• Debuggability of third-party integrations (feature investment). Answers "what exactly did we send to Vendor X, and what did they return?" for webhooks, payment gateways, carriers, and partner APIs. This directly shortens support-ticket triage and incident MTTR, and is the most common reason teams go looking for a bundle like this.
• Compliance and data-minimization posture (compliance/legal roadmap item). Configurable body policies plus redaction mean request/response bodies can be captured without wholesale PII/PCI data landing in logs. Export and purge map to DSAR/right-to-erasure, legal hold, and retention-window policies. If a compliance workstream is on the roadmap ("we can't prove what data left the building, or we keep it forever"), this is a concrete deliverable against it.
• Build vs. buy on observability plumbing. The in-house alternative is a Monolog channel plus an event subscriber plus a bespoke admin screen plus redaction logic plus retention tooling — realistically a multi-sprint build owned forever. This bundle collapses that into configuration, so the PM decision is "integrate and own the risk" vs. "build and own the code."
• Buy-vs-adopt against APM vendors. If Datadog/Sentry/New Relic or an API gateway already captures bodies with redaction and retention, this is redundant spend of engineering attention. If they don't (or the cost is per-GB prohibitive for verbose payloads), a self-hosted DB-backed log is materially cheaper.
• Tooling for non-engineers. The secured admin UI with export/purge is the differentiator over "grep the log file": support and ops can self-serve lookups instead of filing engineering tickets. That is a headcount/throughput argument, not just a technical one.
• Staging/QA reproducibility. Body capture in non-production environments makes integration bugs reproducible without re-running against a live vendor.
• Scope guardrail. This is diagnostic logging, not an audit ledger of record and not a metrics/tracing system. Decisions about SOC 2 evidence, financial audit trails, or SLO monitoring should not be routed here.

When to Consider This Package

Adopt (trial/spike) when:

• The stack is Symfony 7/8 on PHP 8.2+ — the bundle's stated target — and you control the framework version.
• You need bodies, not just status codes and latency, to resolve real support load.
• Redaction and retention are genuine requirements, not nice-to-haves; hand-rolled logging tends to leak PII because nobody budgets time for redaction.
• A human (support/ops/compliance) needs to query and export logs without shell access.
• You can absorb dependency risk: pin an exact version, wrap integration in your own tests, and keep the swap path to a plain Monolog channel open.

Look elsewhere or build thin when:

• An existing APM/log platform already captures payloads with redaction and retention — use it; don't run two body stores.
• Volume is high or payloads are large. Body logging multiplies storage and query cost; gate it per-route and sample, or capture at the gateway instead.
• You are not on Symfony (the description is Symfony-specific; a Laravel app would need a different implementation).
• You require vendor support, an SLA, or a security review trail. Adoption signals here are thin: ~2 stars, 0 dependents, single-maintainer profile. MIT licensing means you can fork, but budget for that: treat it as "source-available dependency you may have to own," not a supported product.
• The admin UI's authz model doesn't match your access-control requirements — it is a high-value target, since it reads request bodies. Review its authentication, authorization, and CSRF story before enabling it in production; consider disabling it and using CLI/export-only access.
• You need immutable/WORM storage for regulatory retention; a purgeable admin-managed store is the wrong primitive.

Adoption gate (PM checklist): security review of redaction defaults and admin surface → confirm per-route opt-in so you don't log auth or payment endpoints → verify purge/retention actually deletes → pin version and record a fork/exit plan → measure support-ticket resolution time before/after to justify keeping it.

How to Pitch It (Stakeholders)

For executives (one paragraph): We currently cannot reliably answer "what did we send to an external provider, and what came back?" when integrations break, so those incidents consume engineering hours and support escalations. This MIT-licensed Symfony bundle captures HTTP request/response traffic with configurable body rules, automatic redaction of sensitive fields, and a permissioned admin screen for search, export, and purge. It closes a compliance gap (we can capture enough to debug without retaining regulated data indefinitely) and replaces an internal build we would otherwise own permanently. Cost is license-free plus a short integration and security-review effort. The main risk is maturity: it is a low-adoption, effectively single-maintainer project, so we adopt it pinned and tested, keep an exit path to plain application logging, and revisit at the next major Symfony upgrade.

For engineering leads (the substance): Standard Symfony bundle wiring — DI extension and configuration rather than custom abstractions — with body-capture policies applied before persistence and a redaction layer ahead of storage. It targets PHP 8.2+/Symfony 7–8, which matches our platform. Integration surface is small and reversible: a config block plus per-route opt-in. Ask: (1) confirm redaction happens pre-write, not at render time; (2) confirm the admin UI is off by default in production or behind our existing firewall/role model; (3) confirm purge is a hard delete with an auditable trigger; (4) add our own smoke tests around the config so a minor upgrade can't silently start logging bodies we didn't intend.

What we are explicitly not claiming: this is not an audit system of record, not a metrics/tracing replacement, and not a substitute for an APM if we buy one later. It is a scoped, cheap fix for integration debuggability plus a retention story we can defend.