Weave Code
Oauth2 Server Client Manager Supervisor Laravel Package
spomky-labs/oauth2-server-client-manager-supervisor
Integrates a client manager supervisor with spomky-labs/oauth2-server, helping PHP OAuth2 servers coordinate client management and validation through a configurable supervisor layer. Useful for wiring client storage and lookup into OAuth2 authorization flows.
OAuth2 Server Client Manager Supervisor library
Frequently asked questions about Oauth2 Server Client Manager Supervisor
- What is spomky-labs/oauth2-server-client-manager-supervisor used for?
- It is a small decorator library that wraps a ClientManagerInterface implementation and enforces validation rules on OAuth2 client records at the boundary. It checks client ID and secret shape, redirect URI format, grant type constraints, and scope constraints before records are persisted or handed to authorization and token endpoints. It helps coordinate client storage and lookup in OAuth2 server flows. There is no framework coupling, so you must write any Laravel glue yourself.
- How do I install spomky-labs/oauth2-server-client-manager-supervisor in Laravel?
- Composer install is nominally the entire integration, but the package provides no Laravel service provider, publishable config, or facade. You must bind the supervisor and inject the raw client manager as the inner service in your container. Expect dependency resolution problems on PHP 8.x with Laravel 10 or 11 because the package is from the PHP 5.6 and 7.x era; using --ignore-platform-reqs is a signal to stop, not a workaround.
- Does this package support Laravel 10 or Laravel 11?
- There is no official Laravel support because the package is framework-agnostic and predates modern Laravel versions. It almost certainly pins old PHP constraints and deprecated psr/* and sibling spomky-labs/oauth2-server-* packages. On PHP 8.x with Laravel 10 or 11 you should expect Composer dependency resolution failure. The recommendation from the technical assessment is to port the validation rules rather than install the package.
- What validation rules does the client manager supervisor enforce?
- The supervisor validates OAuth2 client ID and secret shape, redirect URI format, grant type constraints, and scope constraints. These checks are applied on the way through, before client records are persisted or passed to authorization and token endpoints. Because it implements the same interface as the wrapped manager, it is transparent to consumers. Confirm the exact rules against the source because the package is old and unmaintained.
- Is spomky-labs/oauth2-server-client-manager-supervisor maintained or abandoned?
- The assessment describes it as unmaintained with zero stars, zero dependents, and no issue traffic. That means no downstream users exercising the code, no patches, and no third-party security review. You should check whether the repository is explicitly archived and whether a named successor exists in the maintained oauth2-server package. Treat it as high risk for a security-sensitive OAuth2 client validation surface.
- Is this package safe for production OAuth2 client validation?
- The technical risk is high. OAuth2 client validation, especially redirect URI matching and grant-type handling, is exactly where sloppy implementations become vulnerabilities. An unmaintained library on that surface is a liability independent of code quality. The recommendation is not to take a runtime dependency and instead reimplement the validation rules under your team's ownership.
- How does it integrate with spomky-labs/oauth2-server?
- It is a decorator in the Spomky-Labs OAuth2 server family that wraps a ClientManagerInterface implementation and applies validation on the way through. Consumers see the same interface, so you can swap the binding without changing other code. In Laravel that means binding the interface to the supervisor and injecting the raw manager as the inner service. No service provider, config, migrations, or client store are provided.
- What are alternatives to spomky-labs/oauth2-server-client-manager-supervisor?
- Port the validation rules into a domain-level ClientValidator plus FormRequest rules in front of whatever client repository you already run. Keep the concept of a validating decorator around the client manager, but reimplement it so your team owns the code. If you need a maintained OAuth2 server, evaluate league/oauth2-server and whether the supervisor pattern can be lifted onto it. The assessment estimates the reimplementation at one to two engineer-days.
- Can I use this package with league/oauth2-server?
- Not directly, because it is written for the Spomky-Labs ClientManagerInterface family. The pattern, a validating decorator around the client manager, could be adapted to league/oauth2-server, but that requires your own adapter. The assessment lists this as an open question rather than a supported integration. You would need to reimplement or port the validation logic instead of installing the package.
- How should I test or spike this package before deciding to use it?
- First confirm your target PHP and Laravel versions, then run composer why-not against the package to see the blocking constraints. Spike in a throwaway Laravel app by binding the decorator and exercising client creation and token issuance end to end. If you decide to port, write characterization tests against the original rules first so behavior is pinned before any rewrite. The default position from the assessment is port, not install.
Weaver
How can I help you explore Laravel packages today?