polaris / core

v0.1.0 2026-09-10 16:46 UTC

Requires

• php: >=8.3
• ext-sodium: *
• endroid/qr-code: ^6.0
• lcobucci/jwt: ^5.6
• psr/clock: ^1.0
• psr/event-dispatcher: ^1.0
• psr/http-client: ^1.0
• psr/http-message: ^1.1 || ^2.0
• psr/log: ^3.0
• psr/simple-cache: ^3.0
• spomky-labs/otphp: ^11.3
• symfony/uid: ^7.0 || ^8.0
• symfony/yaml: ^7.0 || ^8.0

Requires (Dev)

• polaris/cli: ^0.1
• polaris/pdo: ^0.1
• polaris/psr15: ^0.1
• polaris/testing: ^0.1

MIT

• Authentication
• Users
• otp
• totp
• rbac
• jwt
• organizations
• MFA

Published on Packagist.org on 2026-09-10 18:23 UTC

README

The framework-free core of Polaris for PHP: self-hosted authentication, MFA/OTP, sessions with rotating refresh tokens, multi-tenant organizations and RBAC, an audit log and PSR-14 events. Namespace Polaris\. It depends only on PSR interfaces and a few libraries (lcobucci/jwt, spomky-labs/otphp, endroid/qr-code, symfony/uid, symfony/yaml).

Install

composer require polaris/core

You also need an HTTP adapter and a database adapter: polaris/psr15 for any PSR-15 host and polaris/pdo for PostgreSQL, MySQL or SQLite (polaris/testing has an in-memory adapter for tests). polaris/cli adds bin/polaris for schema export and diff, the manifest and doctor.

Use

use Polaris\Config\EnvironmentConfig;
use Polaris\Polaris;
use Polaris\Wiring\Config;

$polaris = Polaris::create(new Config(
    secrets: EnvironmentConfig::secrets(),   // APP_KEY, AUTH_JWT_* from the environment
    auth: EnvironmentConfig::auth(),         // issuer, audience, feature flags
    database: $adapter,                      // Polaris\Contract\DatabaseAdapter
    mailer: $mailer,                         // OtpMailerInterface: verification, reset and OTP emails
    sms: $sms,                               // SmsSenderInterface
    dispatcher: $dispatcher,                 // PSR-14; subscribe $polaris->listeners()
));

$polaris->graph()->login();   // every service, built once, no container
$polaris->manifest();         // the 52 endpoints declared in api/**/*.yaml
$polaris->schema();           // the tables, as data

Every port has a working default (in-memory cache, log mailer and SMS sender, system clock, libsodium encrypter, PSR-3 metrics); pass your own to replace it.

What is in the package

Directory	Contents
api/	The HTTP contract: one YAML spec per endpoint, loaded at runtime as the router
src/Contract	The ports: database adapter, repositories, tokens, encrypter, mailer, SMS, rate store, metrics
src/Identity, src/Mfa, src/Token, src/Authorization	The domain services
src/Http	Input, Result, the Endpoint base, the endpoints, the manifest loader
src/Schema, src/Model, src/Repository	The schema as data, the plain models, the repositories over any DatabaseAdapter
src/Wiring	Config and Graph: the object graph, built explicitly

Documentation

The specification (flows, data model, MFA, RBAC, security, the API reference) lives in the monorepo under docs/auth/; the Slim demo under examples/slim/ is the smallest complete host.

License

MIT. Polaris for PHP is created and maintained by 2am.tech.