PHPackages                             iseazy/security - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. iseazy/security

ActiveSymfony-bundle[Security](/categories/security)

iseazy/security
===============

2.0.0(2mo ago)01.1k↑82.1%[1 PRs](https://github.com/isEazy-Engage/iseazy-security-bundle/pulls)PHPPHP >=8.3

Since Jul 31Pushed 1mo agoCompare

[ Source](https://github.com/isEazy-Engage/iseazy-security-bundle)[ Packagist](https://packagist.org/packages/iseazy/security)[ RSS](/packages/iseazy-security/feed)WikiDiscussions main Synced 2w ago

READMEChangelog (2)Dependencies (25)Versions (10)Used By (0)

Iseazy Security Bundle
======================

[](#iseazy-security-bundle)

Este paquete proporciona autenticadores para Symfony que permiten validar JWT emitidos por Keycloak y autenticación por API Key.

---

Instalación
-----------

[](#instalación)

1. Añade el paquete a tu proyecto Symfony con Composer:

```
composer require iseazy/security
```

2. Define las variables de entorno necesarias en tu archivo `.env` según los módulos que actives:

**JWT (Keycloak):**

- `IDAM_URI` — URL base del servidor Keycloak
- `IDAM_EXPECTED_ISSUER_URI` — URL del emisor esperado del JWT
- `IDAM_AUDIENCE` — Audience del JWT (por defecto: `IsEazy`)

```
# .env
IDAM_URI=https://keycloak.example.com
IDAM_EXPECTED_ISSUER_URI=http://localhost:8118
IDAM_AUDIENCE=IsEazy

```

**API Key:**

```
# .env
API_KEY=your_api_key_here

```

**Authorization (módulo de capabilities):**

```
# .env
PLATFORM_URL=https://platform.example.com
PLATFORM_SERVICE_API_KEY=your-service-api-key-here

```

3. Configura el firewall en tu archivo de configuración de seguridad:

```
# config/packages/security.yaml
security:
  firewalls:
    api:
      pattern: ^/api
      stateless: true
      custom_authenticators:
        - Iseazy\Security\Security\JwtAuthenticator
        - Iseazy\Security\Security\ApiKeyAuthenticator
      entry_point: Iseazy\Security\Security\JwtAuthenticator

  access_control:
    - { path: ^/api, roles: ROLE_USER }
```

4. Configura el proveedor de usuarios para usar el servicio de usuario de Iseazy:

- Para JWT, implementa la interfaz `JwtUserFactoryInterface` y crea un servicio que devuelva el usuario basado en el payload del JWT.

```
use Iseazy\Security\Security\IseazyUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;

class UserFactory implements JwtUserFactoryInterface
{
    public function createUser(array $payload): UserInterface
    {
        // Tu lógica para crear o cargar el usuario desde el payload JWT
        return User::createFromPayload($payload);
    }
}
```

- Para API Key, implementa la interfaz `ApiKeyUserFactoryInterface` y crea un servicio que devuelva el usuario basado en la clave API.

```
use Iseazy\Security\Security\ApiKeyUserFactoryInterface;
use Symfony\Component\Security\Core\User\UserInterface;
class ApiKeyUserFactory implements ApiKeyUserFactoryInterface
{
    public function createUser(string $apiKey): UserInterface
    {
        // Tu lógica para crear o cargar el usuario desde la clave API
        return User::createFromApiKey($apiKey);
    }
}
```

5. Crea el archivo de configuración del bundle y activa los módulos que necesites:

```
# config/packages/iseazy_security.yaml
iseazy_security:
    jwt:
        enabled: true
        user_class: App\Context\Security\Domain\Entity\User
    api_key:
        enabled: true
        user_class: App\Context\Security\Domain\Entity\ApiKeyUser
    authorization:
        enabled: false   # Activar solo si usas el módulo de capabilities (ver sección Authorization)
        cache:
            ttl: 900
        http:
            timeout: 3
            fail_mode: closed
```

Cada módulo es independiente: puedes activar solo JWT, solo API Key, solo Authorization, o cualquier combinación.

---

Authorization (v2.0+)
---------------------

[](#authorization-v20)

Starting from version 2.0, this bundle includes a capability-based authorization system. This allows microservices to implement fine-grained access control based on user capabilities and scopes.

### Key Concepts

[](#key-concepts)

- **Capability**: A permission to perform an action (e.g., `campaign.edit`, `task.delete`)
- **Scope**: A domain-specific restriction on a capability (e.g., user can only edit campaigns in their organization)
- **CapabilityProvider**: Service that fetches user capabilities from a source (database, HTTP API, cache)
- **CapabilityVoter**: Symfony Security Voter that integrates capabilities into the authorization system
- **CapabilityFilter**: Domain service for filtering restrictive (scoped) capabilities

### Architecture Overview

[](#architecture-overview)

The authorization system follows **Hexagonal Architecture (Ports and Adapters)**:

- **Domain Layer**: `Capability`, `Capabilities`, `Scope` (models), `CapabilityProvider` interface (port), `CapabilityFilter` (service)
- **Infrastructure Layer**: `HttpCapabilityProvider` (adapter for remote API), `CachedCapabilityProvider` (decorator for caching)
- **UI Layer**: `CapabilityVoter` (Symfony Security integration)

### Installation

[](#installation)

```
composer require iseazy/security:^2.0
```

### Configuration

[](#configuration)

Referencia completa de opciones disponibles:

```
# config/packages/iseazy_security.yaml
iseazy_security:
    jwt:
        enabled: false                          # Activar autenticador JWT
        user_class: ~                           # FQCN que implementa JwtUserFactoryInterface
    api_key:
        enabled: false                          # Activar autenticador API Key
        user_class: ~                           # FQCN que implementa ApiKeyUserFactoryInterface
    authorization:
        enabled: false                          # Activar módulo de capabilities
        http:
            timeout: 3                          # Timeout HTTP en segundos (1-30)
            fail_mode: closed                   # 'closed' (denegar) o 'open' (permitir) si Platform no responde
        cache:
            ttl: 900                            # TTL de caché en segundos (0 = sin caché)
```

Para ver la referencia generada por Symfony:

```
bin/console config:dump-reference iseazy_security
```

### Usage Scenarios

[](#usage-scenarios)

The bundle supports two main usage scenarios:

#### Scenario 1: Producer (Platform Microservice)

[](#scenario-1-producer-platform-microservice)

Platform microservice is the **source of truth** for user capabilities. It stores capabilities in its database and provides them to other microservices.

**Step 1:** Implement `CapabilityProvider` using your database:

```