Yopass Bundle Laravel Package

Getting Started

This release (v1.5.4) is a Symfony bundle, not a Laravel package — expect Twig templates, Symfony Forms, DI config and Stimulus controllers rather than a service provider, Blade and php artisan vendor:publish. Treat it as something you consume from a Laravel app only if you already run Symfony Forms/Twig, otherwise read it as a reference implementation and talk to Yopass via HTTP/JS directly.

• Install with Composer, enable the bundle in config/bundles.php, and make sure symfony/form, symfony/twig-bundle and the Stimulus bridge are present.
• Look first at three files: Resources/views/manage/index.html.twig (the create form), Form/ShareCreateType.php (field definitions and now the styling attributes), and the bundle's config tree / routing.
• Read UPGRADING.md#to-154 before upgrading — 1.5.4 changes template markup and moves CSS classes out of the view and into the form type.
• First use case: a controller that builds ShareCreateType, renders manage/index.html.twig, and lets the Stimulus controller encrypt in the browser before submitting. Verify with bin/console debug:router, debug:config <bundle-alias> and a quick dump(form) in the template.

Implementation Patterns

Let the child loop do the work. Since 1.5.4 the bundle template renders ciphertext and payloadKind explicitly (they are Stimulus targets, rule 3), then walks the remaining children:

{% for child in form %}
    {% if not child.rendered %}
        {{ form_row(child) }}
    {% endif %}
{% endfor %}
{{ form_end(create_form) }}

The practical payoff: adding a field to ShareCreateType (or a subclass/FormTypeExtension) now renders automatically — expiry, max reads and the CSRF token already flow through it. Stop forking the template just to add a field.

Extend the type, not the view. Add options in PHP:

$builder->add('expiresIn', ChoiceType::class, [
    'row_attr'   => ['class' => 'mb-3'],
    'label_attr' => ['class' => 'form-label'],
]);

That is exactly the shape 1.5.4 moved to, so your overrides stay aligned with upstream.

Keep the hidden widgets under your control. If your Stimulus controller needs more hidden targets, render them manually before the loop — the not child.rendered guard will skip them afterwards. Never render the same field with both form_widget and form_row; form_widget marks it rendered and you silently lose the label and error block.

Override via bundle path, then diff. Symfony resolves templates/bundles/YopassBundle/manage/index.html.twig ahead of the bundle copy. If you must override, vendor the upstream template into version control and diff on every bump rather than hand-editing a stale copy.

Use a form theme for markup. If the goal is different markup (Bootstrap vs Tailwind vs plain), override the form_row / form_label blocks in a theme instead of editing the bundle view — that survives releases.

Client-side flow stays the same. Encrypt in JS, set the ciphertext and payloadKind targets, submit. Plaintext never leaves the browser; the server only stores the blob.

Gotchas and Tips

• The 1.5.4 change is a styling change, not just a markup change. mb-3 and form-label for expiresIn / maxReads moved from the template into ShareCreateType (row_attr / label_attr). Any template override or CSS selector that relied on the old hard-coded classes will regress visually — do a quick screenshot diff of the create page after upgrading.
• Stale overrides cause double rendering. If you overrode manage/index.html.twig pre-1.5.4 and now also inherit the new loop, you can end up rendering fields twice. Clear var/cache and confirm the override is actually the file being used (bin/console debug:twig).
• form_end() renders leftovers by default. Because the loop already covers every child, form_end(create_form) is effectively a no-op here — but if you ever drop the loop, add render_rest: false or you get duplicated widgets in a different position.
• child.rendered is easy to trip. A conditional form_widget(child) that runs on one code path and not another produces inconsistent labels/errors between renders. Prefer always rendering with form_row.
• CSRF is now inside the loop. Disabling csrf_protection or setting a custom csrf_token_id needs no template change in 1.5.4 — but if you had patched the token out of a template override, re-check it isn't leaking back in.
• Debugging tools: {{ dump(form) }} with the profiler, bin/console debug:config for the bundle alias, bin/console lint:twig templates/ before deploying, and cache:clear after any template move.
• Pin the version. "nowo-tech/yopass-bundle": "~1.5.4" plus a review of UPGRADING.md on each bump — this release shows the project will restructure templates in patch versions.
• Extension points to prefer: FormTypeExtension, subclassing ShareCreateType, a custom form theme, and Symfony event subscribers on the underlying share manager. Avoid editing bundle files in vendor/.