Manual Auth Bundle Laravel Package

Product Decisions This Supports

• Support & admin impersonation ("login as user"): the package's core capability — authenticating a session as an arbitrary user without credentials — maps directly to customer-support workflows, admin dashboards, and staging/debugging tooling. It is a convenience primitive, not a product feature in itself.
• Build vs. buy on auth tooling: because the surface area is small and the package is archived, this is a signal to build the capability natively (or lean on framework primitives) rather than take a dependency. Relevant to any roadmap item framed as "agents can act on behalf of customers."
• Internal-tooling vs. customer-facing scoping: this belongs in the internal/back-office lane. It should inform decisions about which environments and roles get impersonation, and what audit trail surrounds it.
• Framework direction check: despite the "Laravel/PHP" framing, this is a Symfony bundle, not Laravel. It is only actionable if the platform decision is Symfony — and even then, only as a reference implementation.
• Risk register input: 0 stars, 0 dependents, last release 2018, archived. This is a data point for supply-chain/dependency policy, not a feature bet.

When to Consider This Package

Consider it only when all of the following hold:

• The stack is Symfony, on a PHP version contemporary with 2018 (or you are willing to verify compatibility against a modern runtime).
• The need is internal, non-customer-facing — support consoles, QA, staging — and impersonation is gated behind role checks and logging.
• You are prepared to vendor or fork the code, own it, and treat it as unmaintained. There will be no upstream security patches.
• You want a reference for how manual/impersonation auth was wired in Symfony at that time, rather than a runtime dependency.

Look elsewhere when:

• You are on Laravel — use a maintained impersonation package (e.g. Laravel Impersonate) or Nova's built-in impersonation; this bundle is not applicable.
• You are on modern Symfony — security.firewalls.*.switch_user is a first-class, maintained, audited replacement. Adopting an archived bundle here is strictly worse.
• The capability is customer-facing or touches production auth paths; an unmaintained auth package is an unacceptable risk surface.
• You need maintenance commitments, CVE response, or vendor support — none exist here.
• You need anything beyond a trivial "authenticate as user" primitive; the package is narrow and frozen.

How to Pitch It (Stakeholders)

To executives: This is a small, abandoned 2018 Symfony utility that lets an operator log in as another user — useful for support and debugging. It is not a strategic component and I do not recommend adopting it as a dependency: zero stars, zero downstream users, no releases in seven years, archived upstream. If "agents can act on behalf of customers" is on the roadmap, we should build that capability ourselves on top of our framework's native impersonation support, with the audit logging and access controls our customers will expect. Cost to build is low; cost of inheriting an unmaintained auth library is not.

To engineering: Treat ruwork/manual-auth-bundle as a design reference, not a dependency. It is a Symfony bundle (not Laravel), last released May 2018, archived, no maintainers. The functionality is largely subsumed by Symfony's switch_user firewall listener. Recommend we implement impersonation natively — session swap, role gate, mandatory audit event, and environment guard — and explicitly decline this package in dependency review on maintenance and security grounds.