Workos Php Laravel Package

Product Decisions This Supports

• Enhanced User Management & Role-Based Access Control (RBAC) Roadmap:

  • Leverage UserRoleAssignmentSource and UserRoleAssignment to implement dynamic role assignment (e.g., syncing roles from HR systems or third-party identity providers).
  • Use UserManagementAuthentication.authorize.max_age to enforce short-lived session tokens for sensitive operations (e.g., admin dashboards).
  • Enable CORS and redirect URI management (GET /user_management/cors_origins, GET /user_management/redirect_uris) for secure embeddable auth flows (e.g., iframe-based SSO or OAuth callbacks).

• Build vs. Buy (Expanded Use Cases):

  • Buy: Replace custom role/permission logic with WorkOS’s managed RBAC (e.g., UserRoleAssignmentSourceType for external sync).
  • Build: Use the SDK for granular control over auth flows (e.g., customizing max_age for session security) while offloading core logic to WorkOS.

• Use Cases (New/Updated):

  • Dynamic Role Provisioning: Auto-assign roles based on external systems (e.g., UserRoleAssignmentSource::EXTERNAL_SYSTEM).
  • Security Hardening: Enforce short-lived auth tokens (max_age) for high-risk endpoints.
  • Embedded Auth Flows: Configure CORS origins and redirect URIs for seamless SSO in SPAs or iframe-embedded apps.
  • Magic Links Recovery: Restored CreateMagicAuth logic for passwordless authentication (e.g., "login with email" flows).

When to Consider This Package

Adopt This Package If:

• You need advanced user management (e.g., role assignment sources, CORS/redirect URI control) beyond basic auth.
• Your app requires dynamic RBAC (e.g., roles synced from external systems like HR tools or customer portals).
• You want to enforce stricter session security (e.g., max_age for short-lived tokens).
• You’re building embedded auth flows (e.g., iframe-based SSO) and need CORS/redirect URI management.
• You rely on passwordless authentication (e.g., magic links) and need the restored CreateMagicAuth logic.

Look Elsewhere If:

• You’re not using PHP 8.2+ (v8.1.0 enforces modern PHP features).
• Your use case doesn’t require role assignment sources, CORS management, or short-lived tokens.
• You’re not using WorkOS’s User Management API (this SDK is tightly coupled to WorkOS’s backend).
• You need static auth methods (v8.1.0 enforces instantiated clients; no static call support).

How to Pitch It (Stakeholders)

For Executives:

"WorkOS’s v8.1.0 PHP SDK lets us scale user management and security without custom engineering. Key upgrades include:

• Dynamic RBAC: Auto-assign roles from external systems (e.g., HR tools) to reduce manual admin work.
• Stricter Sessions: Enforce short-lived tokens (max_age) for admin dashboards, cutting credential exposure risks.
• Embedded Auth: Securely configure CORS and redirect URIs for iframe-based SSO, improving UX for B2B customers.
• Passwordless Auth: Restored magic link logins to simplify onboarding (e.g., for guest users). This saves months of dev time while adding enterprise-grade controls. The SDK’s type safety and modern PHP support also future-proof our stack."

For Engineering:

*"v8.1.0 adds critical tools for user management and security:

1. Role Assignment Sources: Sync roles from external systems (e.g., UserRoleAssignmentSource::EXTERNAL_SYSTEM) for zero-touch provisioning.
2. Session Security: UserManagementAuthentication.authorize.max_age lets us enforce short-lived tokens for sensitive endpoints.
3. Embedded Auth: Manage CORS origins and redirect URIs for iframe-based SSO (e.g., workos->userManagement()->getCorsOrigins()).
4. Magic Links: Restored CreateMagicAuth for passwordless flows (critical for guest users). Migration is smooth if we follow the changelog, and the Guzzle-based HTTP layer remains customizable for edge cases."

For Security/Compliance:

*"v8.1.0 strengthens our identity and session security:

• Short-Lived Tokens: max_age parameter reduces credential exposure for admin sessions.
• Dynamic RBAC: Role assignments from external systems (e.g., HR tools) cut manual errors in permission grants.
• CORS Control: Explicitly whitelist redirect URIs to prevent open redirect vulnerabilities.
• Passwordless Auth: Magic links eliminate phishing risks tied to passwords. The audit logs (workos->auditLogs()) still cover all changes, ensuring SOC2/GDPR compliance."