Refresh Token Manager Bundle Laravel Package

Getting Started

The first thing to know: this is a Symfony bundle (*-bundle is the Symfony naming convention), not a Laravel package. There is no Laravel service provider, no package auto-discovery entry, no publishable config/refresh-token-manager.php, and no facade. So "getting started" in a Laravel app really means deciding whether to port the concepts or the code.

If you're determined to try:

1. composer require praetoriantechnology/refresh-token-manager-bundle — and expect to lose an afternoon to dependency resolution. Laravel ships a pinned subset of symfony/* components; a bundle declaring its own range usually conflicts.
2. Read, in order: src/DependencyInjection/ (the extension class reveals the full config tree and every knob), then src/Service/ (the issuing/validating/revoking services), then wherever tokens are persisted (src/Entity/ or src/Model/, almost certainly Doctrine).
3. First use case: wire the token service into a controller that issues a refresh token on login and validates/rotates it on a POST /token/refresh endpoint.

The realistic getting-started is different: extract the token lifecycle from the source — issue → store → validate → rotate on use → revoke family on reuse — and reimplement it against the Laravel container and Eloquent. Treat the bundle as a reference implementation, not a dependency.

Implementation Patterns

Since cleanly installing it into Laravel is unlikely, the patterns worth lifting are:

• Bind the manager as a singleton. Refresh-token managers are stateless services with injected repositories and a clock; singleton lifetime is correct. Register in a service provider via $this->app->singleton(...).
• Issuance as a discrete action. The bundle exposes an issue method returning a token object. Mirror this with a RefreshTokenService or an action class, and fire a RefreshTokenIssued event for audit logging.
• Rotation on use. Validate: lookup → verify not expired → verify not revoked → revoke the presented token → mint a new pair. Preserve this. Rotation-on-use is the entire security value of a refresh token flow.
• Storage abstraction. Replace Doctrine entities with an Eloquent model and define a RefreshTokenRepository contract bound to that model. Keeps the port swappable if you later adopt Sanctum.
• Middleware/guard integration. Symfony's version hooks into security.yaml firewalls. In Laravel, a guard or middleware that resolves the access token and returns a hint to /token/refresh on 401 is the equivalent shape.
• Config parity. Map the bundle's extension parameters (TTL, rotation flag, token length, storage backend) into config/refresh-tokens.php, then inject via typed config rather than reading env() at call sites.

Gotchas and Tips

• No auto-registration. Laravel's package discovery won't find this. The Symfony Bundle base class and KernelInterface registration won't load either — it isn't a matter of writing a shim.
• Dependency conflicts are the likely blocker. Laravel pins symfony/* to its own minor version (Symfony 7 components on Laravel 11). A bundle requiring ^5.x or ^6.x components will fail composer update.
• Doctrine assumptions run deep. EntityManagerInterface, entities, mapped superclasses, repository classes — none of this translates to Eloquent without a rewrite of the persistence layer.
• Peripheral Symfony services. Bundles in this space often pull symfony/clock (ClockInterface) and a UUID factory. Swap for Carbon\CarbonImmutable and Str::uuid() if porting.
• Check token hashing. Read whether the bundle stores hashed or raw refresh tokens. If it hashes, keep hashing — do not "simplify" during a port.
• Look specifically for family revocation. The subtle bit most homegrown implementations miss is revoking an entire token family when a used token is presented again (reuse detection). If the bundle implements it, that's the single best reason to read its source.
• Config validation lives in Symfony's Configuration tree. Error messages won't resemble Laravel's Validator, and php artisan config:cache has no bearing on it.
• Events port cleanly. If it dispatches via EventDispatcherInterface, the event/ listener concept maps 1:1 onto Laravel's Event and Listen — the one genuinely reusable seam.
• Debugging tools don't transfer. bin/console debug:container and debug:config are Symfony-only; in a Laravel context you'll be reading services.yaml by hand.

Bottom line: zero dependents and no stars means no community-tested Laravel path exists, and the framework mismatch is structural. For a Laravel codebase needing refresh tokens, the pragmatic move is to study this bundle's rotation and reuse-detection logic, then build on laravel/sanctum or tymondesigns/jwt-auth — both will cost substantially less than fighting a Symfony bundle's assumptions.