Toolforge Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy for Wikimedia Toolforge-hosted tools. The bundle packages the boilerplate every community tool re-implements — Wikimedia/MediaWiki OAuth login, user identity and session handling, i18n, base Twig layouts, logging/error conventions, and replica-DB access. The PM decision it enables is "do we spend two to four engineer-weeks rebuilding auth and scaffolding, or inherit it?"
• Time-to-first-release for a Toolforge tool. It compresses the "plumbing sprint" before any tool-specific feature ships. That directly affects launch dates for hackathon dashboards, edit-a-thon trackers, wiki-stat viewers, and OAuth-gated community utilities.
• Framework selection (Symfony vs. Laravel). This is a Symfony bundle, not a Laravel package. If a Toolforge deployment is on the roadmap, its existence is a mild argument for Symfony and a clear argument against Laravel for that specific tool.
• Ecosystem/credibility signal. Maintained by the Wikimedia Foundation's Community Tech team, so citing it in grant applications, community proposals, or WMF-internal reviews reads as "follows standard practice" rather than "bespoke snowflake."
• Dependency risk posture. With ~15 stars, zero recorded dependents, and a single maintaining team, the real PM decision is adopt, vendor/fork, or treat as reference implementation. That's a resourcing call, not just a technical one.

When to Consider This Package

Adopt (conditionally) when:

• You are actually deploying to Toolforge (*.toolforge.org) — the bundle assumes that runtime, its conventions, and its infrastructure.
• The app is Symfony 4 or 5 — and you have explicitly accepted that both lines are end-of-life. Confirm current framework support before scoping; an EOL-only dependency is a security-review finding, not a convenience.
• Wikimedia OAuth login and standard user identity are genuine requirements, not "nice to have."
• GPL-3.0 is acceptable. It's copyleft: fine for community tools and WMF-adjacent projects, a hard blocker for anything proprietary or embedded in a closed product.
• The team is small or volunteer-run, and saved boilerplate outweighs the cost of carrying a niche dependency.

Look elsewhere when:

• You're on Laravel. There is no Laravel integration here; you'd fight the framework. Use Socialite with a MediaWiki OAuth2 provider plus a narrow OAuth library instead.
• You're hosting on Wikimedia Cloud VPS or your own infrastructure rather than Toolforge — the bundle's assumptions don't hold.
• You need vendor support, an SLA, or a broad contributor base. One team, low adoption.
• You need Symfony 6/7 only, or a maintained-support-window guarantee.
• You only need one slice (e.g., just OAuth). Pulling the whole bundle for a single concern inverts the build-vs-buy math.
• Licensing is constrained.

How to Pitch It (Stakeholders)

Executives. This is a small, GPL-licensed Symfony add-on from the Wikimedia Foundation's Community Tech team. It removes repetitive plumbing (login, sessions, layouts) from community tools hosted on Toolforge. It is not a platform bet: roughly 15 stars, no recorded dependents, one maintaining team, and it targets Symfony 4/5, which are past end-of-life. Recommendation: do not adopt organization-wide. Use it only if we ship a Symfony-based tool on Toolforge, in which case it saves meaningful setup time; otherwise treat it as a reference implementation we can borrow patterns from at near-zero cost. Upside is faster time-to-first-release on Toolforge tools; risk is a single-maintainer dependency under a copyleft license on an aging framework.

Engineering. It's a Symfony bundle, not Laravel — flag that immediately if the team is Laravel-based. It standardizes Wikimedia OAuth, identity/session handling, and common view scaffolding for Toolforge-hosted tools and appears actively released (most recent release dated 2026-09-03). If we proceed: pin the version, wrap it behind a thin internal adapter so it can be swapped, and verify Symfony 6/7 support and release cadence before committing. Budget a small contingency for forking if maintenance lapses. If we're on Laravel, skip it and replicate the pattern with Socialite plus a MediaWiki OAuth2 provider — the concepts transfer, the code does not.