kowada-gmbh / auth-bundle

1.0.2 2026-09-22 21:14 UTC

Requires

• php: >=8.3
• doctrine/doctrine-bundle: ^2.18 || ^3.0
• doctrine/orm: ^3.3
• symfony/config: ^7.4 || ^8.0
• symfony/dependency-injection: ^7.4 || ^8.0
• symfony/framework-bundle: ^7.4 || ^8.0
• symfony/http-foundation: ^7.4 || ^8.0
• symfony/http-kernel: ^7.4 || ^8.0
• symfony/security-bundle: ^7.4 || ^8.0
• symfony/translation: ^7.4 || ^8.0
• symfony/yaml: ^7.4 || ^8.0

Requires (Dev)

• phpstan/extension-installer: ^1.4.3
• phpstan/phpstan: ^2.0
• phpstan/phpstan-doctrine: ^2.0
• phpstan/phpstan-symfony: ^2.0
• phpunit/phpunit: ^12.0
• symfony/phpunit-bridge: ^8.1

proprietary

• symfony
• security
• auth
• symfony-bundle

Published on Packagist.org on 2026-09-22 21:14 UTC

README

Shared Symfony bundle that adds account-status gating, login tracking, and login/logout flash messages to your own User entity.

The bundle is maintained here as a versioned Composer dependency and pulled into individual Symfony projects via composer update kowada-gmbh/auth-bundle.

Installation

The package is public on Packagist (the source itself stays proprietary, only the distribution is public) and can be required as a regular dependency:

composer require kowada-gmbh/auth-bundle ^1.0

Features

All classes under Kowada\AuthBundle\ are automatically registered as services via autowiring/autoconfiguration (see config/services.yaml).

Login/logout behavior is wired to your own User entity via interfaces, instead of requiring a bundle-owned User class.

• Security\AccountStatusInterface + Security\UserChecker: blocks login when isEmailVerified() or isApproved() return false.
• Security\LoginTrackingInterface + EventListener\LoginSuccessSubscriber: records the first/latest login timestamp and shows a welcome flash message.
• EventListener\LogoutSubscriber: shows a goodbye flash message.

Configuration in the consuming project:

1. Your own User entity must implement the interfaces you want to use. Both are independent of each other — an interface that isn't implemented is simply skipped via an instanceof check, nothing happens in that case:

   class User implements UserInterface, AccountStatusInterface, LoginTrackingInterface {
       public function isEmailVerified(): bool { /* ... */ }
       public function isApproved(): bool { /* ... */ }
   
       public function getFirstname(): string { /* ... */ }
       public function getDateTimeLoggedInInitial(): ?DateTimeInterface { /* ... */ }
       public function setDateTimeLoggedInInitial(DateTimeImmutable $dateTime) { /* ... */ }
       public function setDateTimeLoggedInLatest(DateTimeImmutable $dateTime) { /* ... */ }
   }

2. Register UserChecker on the relevant firewall in security.yaml:

   security:
       firewalls:
           main:
               user_checker: Kowada\AuthBundle\Security\UserChecker

3. LoginSuccessSubscriber/LogoutSubscriber are event subscribers and become active without further configuration. A session-based firewall (FlashBagAwareSessionInterface) is assumed — with stateless APIs the flash messages simply have no effect, but no error occurs either.

Translations

All text goes through the Symfony translator, domain kowada_auth (de / en). Translations are loaded automatically — symfony/translation is required by this bundle, which makes FrameworkBundle enable its translator (framework.translator) by default, so no further configuration is needed. Individual keys can be overridden in the consuming project by creating a same-named translations/kowada_auth.<locale>.yaml file there.

Development

composer install
vendor/bin/phpunit
vendor/bin/phpstan analyse