- Is superadmin/auth-bundle compatible with Laravel?
- There is no evidence that it is Laravel-native. The package name uses Symfony's bundle idiom, and the description references ApiPlatform and JWT, both of which point to a Symfony-first architecture. Laravel has service providers and facades rather than bundles, so even a wrapper would likely inherit Symfony-shaped internals that surface problems at upgrade time.
- How do I install superadmin/auth-bundle in a Laravel application?
- No Laravel installation guide is available, so the only safe approach is a timeboxed sandbox spike in a fresh Laravel app. Run composer require, inspect what the dependency tree pulls in, then smoke test login, token issue, refresh, and revoke. Do not sequence it into delivery until that spike passes and the composer.json constraints are confirmed.
- Which Laravel and PHP versions does it support?
- Supported PHP and Laravel versions are not documented, and there is no visible release history or CI signal to infer them from. Read composer.json directly to confirm framework and PHP constraints before assuming compatibility. Unverified constraints are a planning blocker, not a detail to resolve later.
- Which JWT library underpins it, and is that library patched?
- The underlying JWT library and its version are not disclosed in the available material. This matters because abandoned transitive JWT dependencies are a common supply-chain risk in auth packages. Ask the maintainer directly and confirm the library receives security patches before considering adoption.
- Does it integrate with Laravel's guards and authorization, or replace them?
- This is unconfirmed, and it is one of the most important questions to answer. The package appears to center on Symfony's security model with configurable guards, user providers, and session handling, which could create a parallel auth pipeline alongside Laravel's own. Super-admin and multi-tenant semantics are also undocumented and would need a source audit, including how user and token schemas are structured.
- How does token refresh, revocation, and session handling work?
- The material does not state whether tokens are stateless or stateful, or what the revocation model is. For admin panels, revocation and session invalidation behavior is a core security requirement, not an optional feature. Audit the source or ask the maintainer to document the token lifecycle before relying on it for protected routes.
- Is superadmin/auth-bundle safe to use in production?
- Treat it as high risk. An authentication package covering JWT issuance, refresh, revocation, and admin authorization is the highest-severity security surface in any stack, and this one shows zero stars, zero dependents, and no community scrutiny. Cryptographic correctness, algorithm confusion, key handling, and weak default secrets are all unverified. None of those risks are mitigated by the package's current adoption level.
- What are the Laravel alternatives to this package?
- For most Laravel applications, Sanctum, Passport, or Fortify cover the same ground with Eloquent and middleware-native designs. A short purpose-built admin guard is also worth pricing against the integration effort. The overlap with this package is only JWT and auth in the abstract, while the implementation philosophy is incompatible with a standard Laravel auth stack.
- Who maintains superadmin/auth-bundle, and what is the bus factor?
- There is no vendor, SLA, community, or documented escalation path visible. With no issue traffic or pull request pipeline, adopting it effectively makes your team the maintainer, including CVE response and upgrades. If adoption is mandated, fork and own it rather than depending on upstream support.
- Does it have tests, CI, static analysis, or a security policy?
- None of these are visible in the available material, which is a significant gap for an auth package. Request the test suite, CI configuration, static analysis setup, and a disclosed-vulnerability process from the maintainer. If those artifacts do not exist, plan for a full source audit and a build-versus-buy decision gate before committing to integration work.