- Can I use spipu/api-partner-bundle in a Laravel application?
- No. spipu/api-partner-bundle is a Symfony bundle built on Symfony's bundle registration, DependencyInjection configuration trees, EventDispatcher, Doctrine ORM, and the Security firewall and authenticator stack. Laravel's service providers, Illuminate container, middleware, and Eloquent are not compatible with any of those. A composer require will not give you a usable integration in a Laravel app. The practical approach is to read the bundle as a specification and rebuild the feature with Laravel-native tools.
- What does Spipu ApiPartnerBundle actually do?
- It registers third-party partner applications, stores per-client credentials, authenticates incoming partner requests, and exposes dedicated partner API routes and controllers. It also logs requests per partner for auditing and access tracking. It is intended for Symfony applications that need to keep partner traffic separate from their public API. The package ships Doctrine entities, Symfony configuration, and security integration.
- Which Laravel or PHP versions are supported?
- There is no Laravel version support because the package targets Symfony, not Laravel. For Symfony, check the bundle's composer.json constraints against your Symfony and Doctrine versions before installing. The current release line is 5.1.1, which is a maintenance patch rather than a feature release. Pin exact versions because the repository history and provenance are not fully verified.
- How do I build the equivalent partner API in Laravel?
- Use Laravel Sanctum or Passport to issue partner tokens, and create a Partner model that holds the client identity and credentials. Add custom middleware that authenticates the token, resolves the partner, and applies Laravel's RateLimiter per partner. Put partner-only routes in a dedicated route file or route group so partner traffic stays isolated from your public API. Add a request-log table keyed by partner and a scheduled prune command for retention.
- How do I install and configure the bundle in a Symfony app?
- In a Symfony app, register the bundle in Kernel::registerBundles, import its configuration, and run Doctrine migrations for its entities. Wire its authenticator or firewall into security.yaml so partner requests are validated. Set the log retention value for the CleanLogs process and schedule it with cron or the Symfony scheduler. This is roughly half a day of setup for an experienced Symfony developer.
- How does the bundle handle API request logging and log retention?
- Yes, the bundle persists a row per API partner request to a Doctrine table, which is how it tracks access per partner. Until version 5.1.1 that growth was unbounded; 5.1.1 adds a CleanLogs process step that purges logs after a configurable retention window. You must schedule that process yourself via cron or a scheduler. For high-traffic partners, consider asynchronous logging to avoid synchronous write overhead.
- Is this package production-ready and secure for partner authentication?
- Treat it with caution. Adoption signals are weak: zero stars, zero dependents, a single maintainer, and only one recorded pull request in a 5.x repository, which suggests a reset, import, or migrated history. Because this is security-adjacent code that authenticates external partners, do a full source review and confirm author identity, prior repository, and tag signing before use. Pin exact versions in production.
- What Laravel alternatives exist for managing third-party API partners?
- In Laravel, the idiomatic stack is Sanctum for partner API tokens or Passport for full OAuth2, a Partner model, custom authentication middleware, and the built-in RateLimiter. Combine that with a partner_requests log table and a scheduled prune command to match the bundle's auditing behavior. If you need scoped permissions, Sanctum token abilities or Gate policies cover it. This avoids owning unfamiliar third-party security code.
- How is the package maintained and should I pin versions?
- The project is at 5.1.1 and follows major-version semver, so backward-compatibility pressure exists in principle. However, a 5.x repository whose only pull request is PR #1 points to a reset, import, or relocation, so the v5 lineage should be treated as unverified until provenance is established. A single-maintainer pattern and zero dependents mean no third-party production feedback or CVE watching. Pin exact versions and review changelogs manually.
- How do I test partner API authentication in Laravel?
- Since the bundle cannot run in Laravel, test your reimplementation rather than the bundle. Create a Partner factory, issue a Sanctum or Passport token, and use Laravel's HTTP test helpers to assert that valid tokens succeed, missing or revoked tokens get 401, and rate limits apply per partner. Assert that a request-log row is written and that the prune command removes only expired rows. For Symfony usage, use the test client with the partner headers against the firewall.