- Is ns/security-bundle compatible with Laravel?
- It is packaged as a Symfony bundle, not a Laravel package. The provided context shows no documented Laravel service provider, config publishing, or Gate and Policy integration. Treat it as incompatible without a custom adapter and a timeboxed spike.
- How do I install ns/security-bundle in a Laravel app?
- There is no documented Composer require or Laravel installation path in the provided context. A Symfony bundle typically relies on Symfony dependency injection and config trees that do not map directly onto Laravel. Do not add it blindly; verify Composer constraints and dependency collisions first.
- What Laravel and PHP versions does ns/security-bundle support?
- The technical evaluation says PHP and Laravel version constraints are unverified. No composer constraints for illuminate packages are documented. Pin an exact version only after reading composer.json and testing against your PHP and Laravel baseline.
- Does ns/security-bundle provide row-level ACL like Symfony ACL?
- The assessment questions whether it wraps Symfony security voters or the long-removed Symfony ACL component. If so, it has no natural integration point with Laravel Gates, Policies, middleware, or Eloquent global scopes. A translation layer would be required, and partial enforcement is worse than none.
- Is ns/security-bundle safe for production authorization?
- Technical risk is high because it sits directly on the authorization boundary. The package has zero stars, zero dependents, no visible security disclosure process, and no evidence of a test suite or CI. Supply-chain exposure for this blast radius is not justified by its signal, so the default expectation is reject or reimplement.
- How does ns/security-bundle enforce permissions on database queries?
- The context asks whether enforcement is explicit call-site checks, ORM query scopes, or database-level policy, and warns that call-site checks are the weakest option. Bulk updates, deletes, raw query builders, and queue jobs may bypass enforcement unless every read path is scoped. Require a conformance test suite that includes static checks for raw queries.
- Does ns/security-bundle fail open or fail closed?
- This is listed as an open key question, and the provided context does not document the answer. On an authorization boundary, fail-open behavior on a missed or errored policy lookup can leak rows. Do not adopt it until failure semantics are proven by source review and tests.
- How are permission changes invalidated in ns/security-bundle?
- The assessment asks whether invalidation is cache TTL or event-driven, and the context does not document an answer. Stale permission caches can grant access after revocation. Verify invalidation behavior before relying on the package for sensitive data.
- What are safer Laravel alternatives to ns/security-bundle?
- For row-level ACL, implement natively with Eloquent global scopes plus Laravel Policies, or use Postgres row-level security if you are on Postgres. You can also evaluate Casbin, Oso, or SpiceDB behind an AuthorizationService contract. Keep package APIs out of controllers and models so a later swap is a single-adapter change.
- Is ns/security-bundle maintained and tested?
- The context reports zero stars, zero dependents, a score of zero, no visible test suite or CI, and no last-commit date. There is no public evidence of it running in any production stack. Check for a maintained community fork before committing to fork it yourself.