README

TenBruggencateNewsletterLite

Lightweight GDPR-safe newsletter signup for Shopware 6. Standalone subscriber table, opaque-token unsubscribe with one-click email erasure. No third-party dependencies. No double-opt-in fight with Shopware's built-in module.

License: MIT · Shopware: 6.7.x · PHP: 8.1 / 8.2

🇬🇧 English · 🇳🇱 Nederlands · 🇩🇪 Deutsch

📖 More context: Why we built this · How it compares

What it does

Shopware ships a newsletter module, but customising its UX fights the built-in flow. This plugin is deliberately smaller:

tenbruggencate_nl_subscriber table — plain id, email, source, brand_name (server-derived — see below), consent_given + audit trail, unsubscribe_token, locale, subscribed_at, unsubscribed_at
Signup form partial — drop-in Twig include with compact (footer) and full (landing) variants
Landing page at /newsletter — SEO-safe, standalone, no theme dependency
Opaque-token unsubscribe — URL carries a CSPRNG token, not the email address. One click: email gets scrubbed to erased-<id>@newsletter.invalid, the row stays for stats
Three locales out of the box — nl-NL, en-GB, de-DE
No double-opt-in by default (v1). consent_given column is ready for the flip once SMTP is wired up

Install

composer require tenbruggencate/newsletter-lite
bin/console plugin:refresh
bin/console plugin:install --activate TenBruggencateNewsletterLite
bin/console database:migrate --all TenBruggencateNewsletterLite
bin/console cache:clear

Configuration

Configurable per sales channel from Extensions → TenBruggencateNewsletterLite.

Field	Default	Purpose
`enabled`	`true`	Kill switch — signup form renders nothing when off
`brandName`	(empty)	Shown in headings (e.g. "Schatkistjes Club"); leave blank for generic wording
`consentText`	(snippet)	Checkbox label; HTML allowed
`privacyPageUrl`	`/about/privacy`	Link target in the fineprint
`landingPageEnabled`	`true`	Toggle the `/newsletter` landing page route

Routes

Route	Method	Purpose
`/newsletter`	GET	Landing page with signup form
`/newsletter/subscribe`	POST	Handles the signup form submit
`/newsletter/unsubscribe/{token}`	GET	Opaque-token unsubscribe + email scrub

Usage

Embed the signup form anywhere via Twig:

{# Compact variant — for footers #}
{% include '@TenBruggencateNewsletterLite/storefront/newsletter/_signup.html.twig' with { variant: 'compact' } %}

{# Default variant — for landing pages #}
{% include '@TenBruggencateNewsletterLite/storefront/newsletter/_signup.html.twig' %}

Standards

Performance — no JS dependency; plain POST with a 302 redirect on success. Async submission via fetch() is a ~20-line enhancement you ship in your theme if desired.
SEO — add /newsletter/unsubscribe/* to your theme's robots.txt disallow list (the landing page is indexable, the unsubscribe endpoint should not be).
GDPR — the opaque-token pattern means the unsubscribe URL leaks nothing. One click also erases the email address from storage; the row stays for stats, PII is gone. Satisfies right-to-erasure without a manual request. Every signup writes a consent audit trail (consent_given_at, consent_text_version, consent_ip_hash) for Article-7 supervisory audits. Full data-flow + subject-rights documentation in GDPR.md.
WCAG 2.2 AA — semantic <form>, <label for>, <input type=email required>, keyboard-accessible by construction. Focus state inherited from your theme. Live axe-core audit output + desktop + mobile screenshots + localised-copy evidence: docs/ACCESSIBILITY.md.
Security — CSRF-protected via Shopware's default handler; unsubscribe_token is 32 bytes random_bytes(). No user-controllable input in the unsubscribe SQL (token is looked up with a prepared statement).
Uninstall — plugin:uninstall --keep-user-data preserves the tenbruggencate_nl_subscriber table AND every TenBruggencateNewsletterLite.config.* row (default, recommended path when you might reinstall). plugin:uninstall without the flag drops the subscriber table entirely + clears config — use this only when you genuinely want to discard all subscribers. There is no middle ground; exports happen before, not during, uninstall.

Compatibility

Core platform

Shopware	PHP	Status
6.7.x — tested against 6.7.8, 6.7.9	8.1, 8.2	Stable
6.6.x	—	Not supported
6.5.x and earlier	—	Not supported

Database

Engine	Version	Notes
MySQL	8.0+	Primary target; JSON functions used for config-row manipulation in migrations
MariaDB	10.11+	Tested end-to-end; earlier versions lack some JSON operator support

Browsers (storefront)

Evergreen browsers only — the two most recent stable releases of each:

Browser	Desktop	Mobile
Chrome / Chromium	✅	✅
Firefox	✅	✅
Safari	✅ (macOS)	✅ (iOS 16+)
Edge	✅	—

Internet Explorer and legacy Edge are not supported. The plugin emits no runtime JS (where applicable) so graceful degradation on older browsers usually still renders content, just without progressive enhancements.

Admin browsers

Same evergreen matrix — the Shopware admin is Vue-based and has its own compatibility baseline that this plugin doesn't extend or narrow.

Development

Tool	Version	Scope
PHP	≥ 8.1	Runtime + test suite
Composer	2.x	Dependency management
Node.js	≥ 18	Only needed if you edit SCSS and re-run the theme compile
Python	≥ 3.9	Only needed for the repo's asset-pipeline scripts (`scripts/*.py`)

Accessibility

WCAG 2.2 level A + AA — see docs/ACCESSIBILITY.md for axe-core audit output and per-page violations.

What we test before each release

Full PHPUnit unit suite against PHP 8.1 + 8.2 (source-inspection tests don't need a kernel)
PHPStan level 8 + PHP-CS-Fixer (@PSR12 + @Symfony)
Composer validate on every plugin
Live-DB smoke tests (plugin install → activate → route render → uninstall cycle)
axe-core audit on the primary storefront surfaces (see ACCESSIBILITY.md)

Related plugins

Part of the TenBruggencate Suite — small, focused plugins that play well together:

MultiBrand — recommended: when MultiBrand is active, brand_name is populated automatically from the resolved brand (priority: MultiBrand resolver → SalesChannelContext → configured brandName → empty). Never read from the form, so tampering is impossible. Per-SC segmentation without separate sales channels.
Analytics — signup conversions tracked automatically when Analytics is active and consent is given.
LegalPages — provides the /legal/privacy page that privacyPageUrl typically points at.
Maintenance — branded maintenance page that cooperates with this plugin's privacy / consent posture.

Support

Email: guy@tenbruggencatedevelopment.nl
Docs & news: tenbruggencatedevelopment.nl
Source / issues: Bitbucket repo
Security vulnerabilities: see SECURITY.md — email first, no public issues, 72-hour acknowledgement SLA

tenbruggencate / newsletter-lite

Maintainers

Package info

Statistics

Security