koh / sylius-auth-md

v1.1.35 2026-10-14 02:37 UTC

Requires

• php: ^8.5.11
• koh/sylius-agent-contracts: ^1.1
• sylius/sylius: ^2.2.9 || ^2.3.0
• symfony/config: ^7.4 || ^8.0
• symfony/dependency-injection: ^7.4 || ^8.0
• symfony/http-foundation: ^7.4 || ^8.0
• symfony/http-kernel: ^7.4 || ^8.0
• symfony/routing: ^7.4 || ^8.0
• twig/twig: ^3.30.0

Requires (Dev)

• koh/dev-sylius: ^1.0
• phpstan/extension-installer: ^1.4.3
• phpstan/phpstan: ^2.3.1
• phpunit/phpunit: ^11.5.57

MIT

• Kai Ole Hartwig

• oauth
• sylius
• Agent
• discovery
• auth.md

Published on Packagist.org on 2026-10-14 02:49 UTC

README

koh/sylius-auth-md

Serves /auth.md — how an agent registers with and authenticates against your Sylius shop, in prose an agent can read.

Install

composer require koh/sylius-auth-md

// config/bundles.php
Koh\SyliusAuthMd\KohSyliusAuthMdBundle::class => ['all' => true],

# config/routes/koh_agent.yaml
koh_auth_md:
    resource: '@KohSyliusAuthMdBundle/config/routes.php'

Configure

# config/packages/koh_auth_md.yaml
koh_auth_md:
    contact_email: '[e-mail]'   # optional

The document writes itself

Sections come from the installed authentication methods — every service implementing AuthMethodDescriptorInterface from koh/sylius-agent-contracts. Install koh/sylius-mcp-oauth and the OAuth flow appears; add koh/sylius-web-bot-auth and its section appears too.

That is the point rather than a convenience: the same descriptors feed the agent_auth block of the OAuth metadata. A hand-written /auth.md drifts from the machine-readable version the moment either changes, and an agent that believes the wrong one fails in a way nobody notices.

With no method registered the route returns 404. A document listing no way in reads as this shop refuses agents — a stronger and different claim than nothing published yet.

The H1 contains auth.md, which is how scanners recognise the document.

Override the template

templates/bundles/KohSyliusAuthMdBundle/auth.md.twig

The default renders the heading, links to the machine-readable metadata, one section per method, a note on rate limits and a pointer at /robots.txt for the Content Signal.

Decommission

Remove the composer require, the bundle entry, the route import and config/packages/koh_auth_md.yaml. No table, no cache pool. The agent_auth metadata is unaffected — it lives in koh/sylius-mcp-oauth.

Security

Report vulnerabilities privately — see SECURITY.md. Advisories are published as CSAF 2.0 at https://ole-hartwig.eu/.well-known/csaf/.

Licence

MIT — see LICENSE.