Runet Id Bundle Laravel Package

Product Decisions This Supports

• Russian-market onboarding / SSO: RUNET-ID is a Russian national single-sign-on identity provider used by media and content sites. If a market-entry or localization roadmap includes RU/CIS, offering RUNET-ID login is a concrete signup-friction and trust lever — this package maps the integration surface (OAuth-style authorization flow, provider config, user profile mapping) so you can scope it.
• Build vs. buy for identity: The honest answer here is neither buy nor adopt. The package is a thin Symfony bundle, archived since 2018, with zero stars and zero dependents. Its real product value is as a reference specification: it tells you the shape of the RUNET-ID handshake, the endpoints, and the user-attribute mapping you'll need, which de-risks a 1–2 week in-house OAuth2 client.
• Reducing dependency on foreign IdPs: For products where Google/Facebook login is a regulatory or reputational liability in Russia, a RUNET-ID option in the auth matrix is a defensible roadmap item. This assessment surfaces it; the package itself is not the delivery vehicle.
• Prioritization against alternatives: Compare RUNET-ID against VK ID, Yandex ID, and Sber ID. VK/Yandex have far larger consumer reach and actively maintained SDKs; RUNET-ID's base skews toward publishing/media audiences. That comparison, not the package, is the actual roadmap decision.
• Not a Laravel decision: Despite the framing, this is Symfony-specific (ruwork/* namespace, bundle service config). For a Laravel codebase it would be stripped for parts. Any decision to use it as a dependency would be a technical-debt entry, not a feature decision.

When to Consider This Package

Consider the problem it solves when:

• You are shipping to Russian users and want an additional, locally credible login option alongside email/password.
• Your audience overlaps Russian media/publishing, where RUNET-ID accounts are already common.
• You have a Symfony codebase and need a starting point to read the protocol (endpoint URLs, scopes, token exchange, profile fields) rather than a runtime dependency.

Look elsewhere — and you almost certainly should — when:

• Any production use is intended. The repository is archived, the last release is August 2018, there is one maintainer and no dependents. No security patches, no PHP 8.x compatibility guarantee, no support path. An auth component is exactly where you cannot accept an unmaintained dependency.
• You are on Laravel. The bundle's value is Symfony DI wiring you would discard. Install the official RUNET-ID documentation and write ~200 lines against an OAuth2 client library (e.g., league/oauth2-client) instead.
• Scale or reach is the driver. If the goal is "more Russian logins," VK ID and Yandex ID dominate consumer share; RUNET-ID is a narrower, publisher-oriented identity.
• Compliance is the driver. Neither this package nor RUNET-ID itself resolves 152-FZ data-localization obligations, consent capture, or token-storage requirements. Those are your responsibilities regardless of library.
• You need SLAs or vendor accountability. There is no vendor behind the bundle; RUNET-ID's operator is a separate relationship you must establish directly (registration, client credentials, terms).

Recommended disposition: treat as archived reference material, pin the commit for reading only, and budget 1–2 engineering weeks for a first-party client with tests.

How to Pitch It (Stakeholders)

For executives (one paragraph): We evaluated a community plugin for RUNET-ID, Russia's national sign-in system for internet resources. The plugin is abandoned — last updated in 2018, unmaintained, and built for a different PHP framework — so we should not depend on it. However, it confirms the integration is small and well-understood: a standard OAuth-style login that our team can implement directly in roughly one to two weeks, with no licensing cost. The strategic question is not the plugin but whether RUNET-ID belongs in our login options for Russian users; if it does, we can ship it cheaply and safely on our own code, and we should decide that alongside VK ID and Yandex ID, which have larger consumer reach.

For engineering (summary):

• Do not add as a dependency. Archived, single-maintainer, zero dependents, pre-PHP-8, Symfony-only. No security response path for an auth-critical component.
• Do use as a spec. Extract the provider endpoints, scopes, token flow, and user-attribute mapping; discard the bundle wiring.
• Build: a first-party OAuth2 client on league/oauth2-client (or Socialite for Laravel) with a dedicated provider class, plus tests against a mocked token endpoint.
• Own the hard parts explicitly: state/nonce handling, token encryption at rest, account-linking and de-duplication against existing email accounts, consent text, and 152-FZ data-residency review of where profile data lands.
• Operational prerequisites: register the application with RUNET-ID's operator for client credentials and terms — this, not the code, is the long-lead item.
• Effort: ~1–2 weeks including tests and review; ~1 day to read and document the archived bundle's protocol assumptions.