PHPackages                             domainflow/security - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. domainflow/security

ActiveLibrary[Authentication & Authorization](/categories/authentication)

domainflow/security
===================

Framework-neutral authentication and authorization contracts with PSR-compatible HTTP adapters for DomainFlow applications.

v0.1.0(today)03↑2900%MITPHPPHP ^8.4CI passing

Since Aug 25Pushed todayCompare

[ Source](https://github.com/domainflow/security)[ Packagist](https://packagist.org/packages/domainflow/security)[ RSS](/packages/domainflow-security/feed)WikiDiscussions main Synced today

READMEChangelog (1)Dependencies (12)Versions (3)Used By (0)

DomainFlow Security
===================

[](#domainflow-security)

[![Tests](https://github.com/domainflow/security/actions/workflows/tests.yml/badge.svg)](https://github.com/domainflow/security/actions/workflows/tests.yml)[![Packagist Version](https://camo.githubusercontent.com/e0df27db175cc61705d6796602262f443fbb5a1777ee77fc9e2a9eda23d4569b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f646f6d61696e666c6f772f7365637572697479)](https://camo.githubusercontent.com/e0df27db175cc61705d6796602262f443fbb5a1777ee77fc9e2a9eda23d4569b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f646f6d61696e666c6f772f7365637572697479)[![PHP Version](https://camo.githubusercontent.com/192735cbb12870d17b1021bde63c8499f6b1fec5219e8ce640e74c69a32d8f00/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f646f6d61696e666c6f772f7365637572697479)](https://camo.githubusercontent.com/192735cbb12870d17b1021bde63c8499f6b1fec5219e8ce640e74c69a32d8f00/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f646f6d61696e666c6f772f7365637572697479)[![License](https://camo.githubusercontent.com/3659697c6c3f3a1881644f67adcaf83de21807842df1570693e77719b4c7ee9f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f646f6d61696e666c6f772f7365637572697479)](https://camo.githubusercontent.com/3659697c6c3f3a1881644f67adcaf83de21807842df1570693e77719b4c7ee9f/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f646f6d61696e666c6f772f7365637572697479)[![PHPStan](https://camo.githubusercontent.com/a091149e9a56db5b866ba9ab53176a4b9db9ed13c68eb10003839883108e99ba/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d4c6576656c253231302d627269676874677265656e2e737667)](https://camo.githubusercontent.com/a091149e9a56db5b866ba9ab53176a4b9db9ed13c68eb10003839883108e99ba/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d4c6576656c253231302d627269676874677265656e2e737667)

Framework-neutral authentication and authorization contracts for DomainFlow applications, with PSR-compatible HTTP adapters.

`domainflow/security` answers two questions without choosing a framework or identity provider:

- Who is calling? An `Authenticator` turns a credential into an immutable `AuthenticationOutcome` and `Principal`.
- May that caller perform an operation? An `AuthorizationPolicy` evaluates a `SecurityContext` and an `AuthorizationRequirement`.

The package supports application-owned adapters for API keys, OAuth/OIDC, JWT, Keycloak, Symfony Security, Laravel guards, sessions, mTLS, or custom providers. Provider libraries and provider objects stay outside the base package.

Install
-------

[](#install)

```
composer require domainflow/security
```

PHP 8.4+ and the PSR HTTP message/server/factory contracts are required. A concrete PSR-7 implementation, such as Nyholm PSR-7, belongs to the application.

Optional integrations:

- `domainflow/core` registers configured security services during bootstrap.
- `domainflow/http` provides the generic endpoint-context seam and HTTP kernel.
- `domainflow/openapi` can describe operation security requirements.

Authentication and authorization
--------------------------------

[](#authentication-and-authorization)

Implement the stable ports in the application or an adapter package:

```
use DomainFlow\Security\Authentication\AuthenticationFailure;
use DomainFlow\Security\Authentication\AuthenticationOutcome;
use DomainFlow\Security\Authentication\Authenticator;
use DomainFlow\Security\Authentication\Credential;
use DomainFlow\Security\Principal;

final readonly class ApiTokenAuthenticator implements Authenticator
{
    public function authenticate(Credential $credential): AuthenticationOutcome
    {
        $identifier = $this->lookup($credential->value());

        return $identifier === null
            ? AuthenticationOutcome::failed(new AuthenticationFailure('invalid_credentials'))
            : AuthenticationOutcome::authenticated(new Principal($identifier));
    }

    private function lookup(string $token): ?string
    {
        // Delegate token verification to the application/provider adapter.
        return $token === 'example-token' ? 'service-1' : null;
    }
}
```

The raw credential is never placed in the `Principal`. Authorization remains an explicit application policy:

```
use DomainFlow\Security\Authorization\AuthorizationRequirement;

$requirement = new AuthorizationRequirement(
    'orders.read',
    ['scheme' => 'oauth2', 'scopes' => ['orders:read']],
);
$decision = $policy->decide($context, $requirement);
```

Provider examples
-----------------

[](#provider-examples)

The `examples/` directory contains dependency-free seams for custom token stores, Keycloak/OIDC claim verification, Symfony Security identity mapping, and Laravel guard identity mapping. Replace the example verifier/guard ports with the concrete provider package in your application. The base package does not install those providers.

Development
-----------

[](#development)

```
composer test-all
composer phpstan
composer lint
composer quality
```

The package targets PHP 8.4 and 8.5, PHPStan level 10, strict formatting, dependency auditing, and full reachable-source line coverage.

License
-------

[](#license)

MIT license.

###  Health Score

40

—

FairBetter than 86% of packages

Maintenance100

Actively maintained with recent releases

Popularity4

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

0d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/132363982?v=4)[42dknp](/maintainers/42dknp)[@42dknp](https://github.com/42dknp)

---

Top Contributors

[![42dknp](https://avatars.githubusercontent.com/u/132363982?v=4)](https://github.com/42dknp "42dknp (3 commits)")

---

Tags

jwtsecurityAuthenticationoauthpsr-15authorizationdddMicroservicedomainflow

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StylePHP CS Fixer

Type Coverage Yes

### Embed Badge

![Health badge](/badges/domainflow-security/health.svg)

```
[![Health](https://phpackages.com/badges/domainflow-security/health.svg)](https://phpackages.com/packages/domainflow-security)
```

###  Alternatives

[cakephp/cakephp

The CakePHP framework

8.9k20.0M1.9k](/packages/cakephp-cakephp)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[typo3/cms-core

TYPO3 CMS Core

3313.6M5.7k](/packages/typo3-cms-core)[mcp/sdk

Model Context Protocol SDK for Client and Server applications in PHP

1.6k2.2M147](/packages/mcp-sdk)[thecodingmachine/graphqlite

Write your GraphQL queries in simple to write controllers (using webonyx/graphql-php).

5753.4M51](/packages/thecodingmachine-graphqlite)[cakephp/authentication

Authentication plugin for CakePHP

1214.3M120](/packages/cakephp-authentication)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)