README

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for a password and secrets vault: logins, secure notes, credit cards, contacts, identity documents, folders, sharing, trash, read-only events, and a built-in password generator.

This bundle is FrankenPHP worker mode friendly.

Vault home	Items list	Password generator

Features

Item types: login, secure note, credit card, contact, ID card, driver's license, passport, document
Folders with share and trash; item soft-delete with restore/purge
Tags — label items, filter and search by tag
VaultGrant for users and teams (read / write / admin) + share UI
VaultTeamMembershipResolverInterface for team-based grants
Scope vaults — items, folders and tags owned by a project or organization of the host (VaultScopeAccessResolverInterface, membership checked on every request)
Catalogue — metadata-only list of a scope's items (no payload loaded) so members can request access
On-demand reveal — Show / Copy per secret field and attachment download, audited and rate limited; no secret in the page
Temporary grants — grantAs() with an expiry enforced on every read, nowo:vault:grants:purge-expired, grant audit events
Password health — weak, reused, old and (optionally) breached passwords per scope, computed on demand without storing fingerprints; password policies enforced on save
Personal data — GDPR exporter (metadata only) and ordered eraser; decrypted personal export behind a fresh, single-use re-authentication (host hook), streamed without temp files
Browser extension — REST API + Chrome/Firefox autofill (optional)
Runtime config — optional DB-backed settings with admin UI
Key rotation — nowo:vault:reencrypt; nowo:vault:extension-tokens:purge for expired browser-extension tokens
Events: list query/result, access check, read-only resolve, extension auth
Server-side libsodium payload encryption; CSRF on manage POST actions
Manage UI on the UiKit page contract (dashboard, list, form and settings scaffolds; one host theme for every Nowo bundle; confirm and generator <dialog>s, no inline JS) — see docs/TEMPLATES.md
Document attachments (encrypted in payload)

Installation

composer require nowo-tech/vault-bundle

php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'

# config/packages/nowo_vault.yaml
nowo_vault:
    user_class: App\Entity\User
    encryption_key: '%env(VAULT_ENCRYPTION_KEY)%'

See Installation.

Demo

make -C demo/symfony8 up
# Demo started at: http://localhost:8023  →  /tools/vault (auto-login)

The screenshot at the top of this README comes from this demo (fixture data only); refresh it with make -C demo/symfony8 demo-screenshots (make -C demo/symfony8 test-e2e runs the Playwright happy path).

Documentation

Additional documentation

Tests and coverage

PHP: 100% lines (3376/3376 of src/, PHPUnit unit + integration + kernel E2E suites; only src/Resources — Twig, translations, config, built assets — is outside the measure). Gate: make test-coverage-100 / CI fail below 100%.
TS/JS: 99.69% lines (326/327; 95.28% branches) over every TypeScript source of src/Resources/assets/src and extension/src (Vitest + jsdom). Gate: thresholds in vitest.config.ts (lines 98%), enforced by pnpm run test:coverage locally and in CI.
Python: N/A (no Python code).

make test              # PHPUnit
make test-coverage     # PHP coverage report (text + clover + HTML)
make test-coverage-100 # Same, failing below 100% lines
make test-ts           # Vitest with coverage thresholds
make release-check     # Full pre-release QA

License

MIT — see LICENSE.

nowo-tech / vault-bundle

Package info

Security

Fund package maintenance!

Statistics