nowo-tech/yopass-bundle

Symfony bundle for Yopass-style E2E encrypted secret sharing with configurable routes, table prefix, and access control

v1.3.2 2026-07-29 17:50 UTC

Requires

• php: >=8.2 <8.6
• ext-sodium: *
• doctrine/doctrine-bundle: ^2.10 || ^3.0
• doctrine/orm: ^2.15 || ^3.0
• symfony/clock: ^7.4 || ^8.0
• symfony/config: ^7.4 || ^8.0
• symfony/dependency-injection: ^7.4 || ^8.0
• symfony/form: ^7.4 || ^8.0
• symfony/framework-bundle: ^7.4 || ^8.0
• symfony/http-kernel: ^7.4 || ^8.0
• symfony/routing: ^7.4 || ^8.0
• symfony/security-bundle: ^7.4 || ^8.0
• symfony/translation: ^7.4 || ^8.0
• symfony/twig-bundle: ^7.4 || ^8.0
• symfony/validator: ^7.4 || ^8.0
• symfony/yaml: ^7.4 || ^8.0

Requires (Dev)

• doctrine/mongodb-odm: ^2.6
• doctrine/mongodb-odm-bundle: ^5.0
• friendsofphp/php-cs-fixer: ^3.0
• nowo-tech/phpstan-frankenphp: ^1.0
• phpstan/extension-installer: ^1.0
• phpstan/phpstan: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• phpstan/phpstan-symfony: ^2.0
• phpunit/phpunit: ^10.0
• rector/rector: ^2.0
• symfony/browser-kit: ^7.4 || ^8.0
• symfony/dom-crawler: ^7.4 || ^8.0

Suggests

• doctrine/mongodb-odm-bundle: Required when nowo_yopass.database.platform is mongodb or database.driver is doctrine_mongodb.

MIT

• Héctor Franco Aceituno
• Nowo.tech

• symfony
• php
• security
• encryption
• symfony-bundle
• e2e
• frankenphp
• secret-sharing
• yopass

Published on Packagist.org on 2026-07-29 17:50 UTC

README

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for Yopass-style E2E encrypted secret sharing: client-side libsodium encryption, expiration, read limits, and public reveal pages.

This bundle is FrankenPHP worker mode friendly.

Features

• Browser-side encryption (libsodium secretbox); server stores ciphertext only
• Text and file payloads (max 512 KB files; file tab requires file_handler service)
• Configurable expiration options, max-read limits, list pagination, and retention purge
• Auto-generated decryption key or custom password mode
• One-click links via ?decrypt_key= query parameter; short links with manual key entry
• Authenticated manage UI + anonymous public reveal/consume routes
• Configurable routes, table prefix, templates, and pluggable access control
• Share events — customize list queries and per-share access (teams, grants, roles) without built-in ACL
• Public rate limiting — per-IP limits on anonymous /share/* routes (requires cache.app)

Installation

composer require nowo-tech/yopass-bundle

See Installation for Flex recipe, Doctrine schema, routes, and security firewall setup.

Configuration

# config/packages/nowo_yopass.yaml
nowo_yopass:
    user_class: App\Entity\User
    table_prefix: yopass_
    web_ui:
        layout_template: 'base.html.twig'   # optional: host admin layout
    security:
        # Defaults to ROLE_ADMIN since 1.3.0 — set explicitly if you need ROLE_USER
        access_roles: [ROLE_ADMIN]
        access_checker: App\Security\CustomYopassAccessChecker  # optional

Full reference: Configuration.

Usage

• Manage UI: /tools/yopass (configurable)
• Public reveal: /share/{id} or /share/{id}?decrypt_key=… (configurable)
• Override Twig: templates/bundles/NowoYopassBundle/

See Usage and Access control events.

Demo

make -C demo up-symfony8
# Demo started at: http://localhost:8022  →  Yopass CRUD at /tools/yopass (auto-login)

Documentation

• Installation
• Configuration
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release process
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• GitHub Actions CI requirements
• Share list and access events
• Demo with FrankenPHP
• Local file storage (demo default)
• AWS S3 file shares example (local, gitignored)

Tests and Coverage

Current coverage: PHP 99%+ (statements via make coverage-check); TypeScript ~76% (lines — password-mode paths need browser sodium).

make test              # PHPUnit
make test-coverage     # PHP coverage + percentage script
make coverage-check    # PHP coverage + 99% statements gate
make test-ts           # Vitest (crypto)
make release-check     # Full pre-release chain

Language	Coverage
PHP	99%+ (Statements) — make coverage-check
TypeScript	~76% (Lines) — make test-ts (password-mode paths require browser sodium runtime)

License

MIT — see LICENSE.