PHPackages padosoft/laravel-iam-contracts - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. padosoft/laravel-iam-contracts ActiveLibrary[Authentication & Authorization](/categories/authentication) padosoft/laravel-iam-contracts ============================== Contratti (interfacce + DTO) condivisi di Laravel IAM: AuthorizationEngine/PDP, KeyProvider/SecretCipher, Assurance, FeatureScope. v1.2.0(2w ago)15995MITPHPPHP ^8.3CI failing Since Jun 27Pushed 2w ago1 watchersCompare [ Source](https://github.com/padosoft/laravel-iam-contracts)[ Packagist](https://packagist.org/packages/padosoft/laravel-iam-contracts)[ RSS](/packages/padosoft-laravel-iam-contracts/feed)WikiDiscussions main Synced 2w ago READMEChangelog (2)Dependencies (2)Versions (5)Used By (5) [![Laravel IAM](art/banner.png)](art/banner.png) Laravel IAM — Contracts ======================= [](#laravel-iam--contracts) **The shared contract layer of the Laravel IAM ecosystem.** Interfaces and immutable value objects every `padosoft/laravel-iam-*` package implements or consumes. [![Tests](https://camo.githubusercontent.com/1cf437c45a959a4be2a8a90c09fd77c9d8e3295e5c9e8beb3d078b48e918b934/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f7061646f736f66742f6c61726176656c2d69616d2d636f6e7472616374732f74657374732e796d6c3f6272616e63683d6d61696e267374796c653d666c61742d737175617265266c6162656c3d7465737473)](https://github.com/padosoft/laravel-iam-contracts/actions/workflows/tests.yml) [![Latest Version on Packagist](https://camo.githubusercontent.com/a1fe52f60e7081ef552d4263e90c4896779431a44ec08f52035a68f5a874b5e1/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f7061646f736f66742f6c61726176656c2d69616d2d636f6e7472616374732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-contracts) [![Total Downloads](https://camo.githubusercontent.com/45ba78478693e06edc51f2ca31efa76181e1cf528ce95301cd387884105b492b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f7061646f736f66742f6c61726176656c2d69616d2d636f6e7472616374732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-contracts) [![PHP Version](https://camo.githubusercontent.com/f71d0909c81314b8b80c2a6e2631e166307f45b0dd2398bf0584186b2b8681c6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f7061646f736f66742f6c61726176656c2d69616d2d636f6e7472616374732e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/padosoft/laravel-iam-contracts) [![License](https://camo.githubusercontent.com/942e017bf0672002dd32a857c95d66f28c5900ab541838c6c664442516309c8a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75652e7376673f7374796c653d666c61742d737175617265)](LICENSE) **[📚 Read the documentation →](https://doc.laravel-iam-contracts.padosoft.com)** --- Why this package ---------------- [](#why-this-package) Laravel IAM is an **Identity & Authorization Control Plane** split across several packages — a server, a client, governance/AI modules, a directory connector, migration bridges. They all need to speak the same language: *what is a subject? how does the PDP decide allow/deny? how is a secret encrypted? what is an assurance level?* `laravel-iam-contracts` is that language. It ships **only interfaces and `final readonly` value objects** — no implementations, **no Laravel dependency, no runtime dependencies at all** (just PHP). It is the **dependency root** of the ecosystem: everything depends on it, it depends on nothing. That gives you the property that makes the whole platform pluggable: **you depend on abstractions, not implementations.** Swap the native SQL authorization engine for an OpenFGA/SpiceDB (Zanzibar) backend, swap the local key provider for AWS KMS or an HSM, swap the passkey verifier for an external SCA provider — and **none of the consuming code changes**, because it was typed against these contracts. Features -------- [](#features) - **`AuthorizationEngine`** — the pluggable PDP contract: `check()` for deterministic allow/deny decisions (with explain), plus `listSubjects()` / `listResources()` reverse-index queries (Zanzibar-style). - **`SubjectRef`** — the `type:id` value object (`final readonly implements Stringable`) used across the whole ecosystem to reference users, groups, service accounts, external groups and agents. - **Crypto seam** — `KeyProvider` (envelope encryption: wrap/unwrap/generate DEKs), `SecretCipher`(encrypt/decrypt/`shred` with per-tenant `scope` → GDPR crypto-shredding), `TokenSigner` (ES256 JWT + JWKS + key rotation). - **Assurance (NIST 800-63B)** — the `Aal` enum with `rank()`/`satisfies()`, plus `AssuranceProvider`, `StepUpProvider` and `FactorVerifier` for step-up authentication on critical actions. - **Governance / IGA** — `FeatureScope`: a single primitive to turn every governance feature (Access Review/Request, PIM, SoD, anomaly detection, least-privilege) on/off, cascading across four levels (layer → app → role → user). - **Identity** — `SessionRegistry` for revocable, server-side sessions (idle + absolute timeout, fail-closed) bound to tokens via a `sid`. - **Zero runtime dependencies** — `require` is `php` only. Installs anywhere, drags nothing in. Use cases --------- [](#use-cases) - **Write an alternative authorization engine.** Implement `AuthorizationEngine` against OpenFGA, SpiceDB, or your own store, register it behind the PDP, and the server keeps working unchanged. - **Type your domain against a stable subject reference.** Accept `SubjectRef` in your services and audit records instead of stringly-typed `"user:42"` — one value object, `Stringable`, used everywhere. - **Plug a different key custodian.** Implement `KeyProvider` for AWS KMS / Vault / an HSM without touching the code that calls `SecretCipher`. The envelope-encryption contract stays the same. - **Gate a governance feature.** Use `FeatureScope::isEnabled()` / `isPermitted()` to roll out PIM or SoD per organization, per role, or per user, with a safe default. Installation ------------ [](#installation) ``` composer require padosoft/laravel-iam-contracts ``` **Requirements:** PHP **8.3+**. No Laravel required — this package is framework-agnostic and dependency-free. Quick start ----------- [](#quick-start) ### 1. Reference a subject [](#1-reference-a-subject) ``` use Padosoft\Iam\Contracts\Support\SubjectRef; $subject = new SubjectRef(type: 'user', id: '42'); (string) $subject; // "user:42" — Stringable, safe to log, store, and key on ``` ### 2. Implement the authorization engine [](#2-implement-the-authorization-engine) The PDP is pluggable: provide an `AuthorizationEngine` and the platform routes decisions through it. ``` use Padosoft\Iam\Contracts\Authorization\AuthorizationEngine; use Padosoft\Iam\Contracts\Support\SubjectRef; final class MyEngine implements AuthorizationEngine { /** * @param array $query * @return array */ public function check(array $query): array { // deterministic, deny-overrides; never fail-open return ['decision' => 'deny', 'reason' => 'no_matching_grant']; } /** @return iterable */ public function listSubjects(string $relation, string $objectType, string $objectId): iterable { return []; } /** @return iterable */ public function listResources(SubjectRef $subject, string $relation): iterable { return []; } } ``` ### 3. Compare assurance levels [](#3-compare-assurance-levels) ``` use Padosoft\Iam\Contracts\Assurance\Aal; Aal::AAL2->satisfies(Aal::AAL1); // true — MFA satisfies a single-factor requirement Aal::AAL1->satisfies(Aal::AAL2); // false — step-up required Aal::fromString(null); // Aal::AAL1 — fail-safe: unknown ⇒ weakest level ``` ### 4. Gate a governance feature [](#4-gate-a-governance-feature) ``` use Padosoft\Iam\Contracts\Governance\FeatureScope; use Padosoft\Iam\Contracts\Governance\FeatureContext; use Padosoft\Iam\Contracts\Governance\FeatureKey; use Padosoft\Iam\Contracts\Support\SubjectRef; function maybeReview(FeatureScope $scope): void { $ctx = new FeatureContext( feature: FeatureKey::AccessReview, organizationId: 'org_123', ); if ($scope->isEnabled($ctx) && $scope->isPermitted($ctx, new SubjectRef('user', '42'))) { // run the access review } } ``` Ecosystem --------- [](#ecosystem) PackageRole**laravel-iam-contracts** *(this repo)*Shared interfaces & DTOs — the dependency root[laravel-iam-server](https://github.com/padosoft/laravel-iam-server)The IAM server: identity, PDP (RBAC+ABAC+ReBAC), OAuth/OIDC, audit, governance, Admin API & panel[laravel-iam-client](https://github.com/padosoft/laravel-iam-client)Client for apps consuming Laravel IAM: OIDC login, JWT/JWKS, middleware, Gate adapter[laravel-iam-ai](https://github.com/padosoft/laravel-iam-ai)Optional AI module: advisory-only governance (redaction + hallucination guard + audit)[laravel-iam-directory](https://github.com/padosoft/laravel-iam-directory)Optional directory module: LDAP / Active Directory (LdapRecord); SCIM in v2[laravel-iam-bridge-spatie-permission](https://github.com/padosoft/laravel-iam-bridge-spatie-permission)Migration bridge from spatie/laravel-permission: scan, shadow mode, decision diffing, cutoverDocumentation ------------- [](#documentation) Full documentation is published at **[doc.laravel-iam-contracts.padosoft.com](https://doc.laravel-iam-contracts.padosoft.com)** — a complete reference of every interface and DTO, the design rationale for a contracts-only package, the ecosystem dependency graph, ADRs, and quickstarts for both implementing and consuming a contract. - [Quickstart](https://doc.laravel-iam-contracts.padosoft.com/quickstart) — implement your first contract. - [Why a contracts-only package](https://doc.laravel-iam-contracts.padosoft.com/concepts/why-contracts) — decoupling, independent releases, ABI stability. - [Ecosystem & dependencies](https://doc.laravel-iam-contracts.padosoft.com/architecture/overview) — who implements and consumes each contract. - [Contract reference](https://doc.laravel-iam-contracts.padosoft.com/reference/overview) — every interface and value object, with signatures. The site is generated with [docmd](https://docs.docmd.io); its sources live in [`docs-site/`](docs-site/). A short, repo-local copy of the docs also lives in [`docs/`](docs/). Security -------- [](#security) Laravel IAM is **fail-closed by design**: default-deny, deny-overrides, and any error (transport, PDP, parsing) resolves to *deny* — never an allow, never an opaque 500. These contracts encode that ethos in their signatures (e.g. `SessionRegistry::active()` is fail-closed; `Aal::fromString(null)` returns the weakest level). If you discover a security issue, please email **** rather than opening a public issue. License ------- [](#license) MIT © [Padosoft](https://www.padosoft.com). See [LICENSE](LICENSE). ### Health Score 48 — FairBetter than 94% of packages Maintenance96 Actively maintained with recent releases Popularity21 Limited adoption so far Community17 Small or concentrated contributor base Maturity52 Maturing project, gaining track record Bus Factor1 Top contributor holds 93.3% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~13 days Total 3 Last Release 19d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/10467699?v=4)[Lorenzo](/maintainers/lopadova)[@lopadova](https://github.com/lopadova) --- Top Contributors [![lopadova](https://avatars.githubusercontent.com/u/10467699?v=4)](https://github.com/lopadova "lopadova (14 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (1 commits)") --- Tags access-controlauthorizationcontractsdtoiamidentityinterfaceslaravelpadosoftphpsecurity ### Code Quality Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/padosoft-laravel-iam-contracts/health.svg) ``` [![Health](https://phpackages.com/badges/padosoft-laravel-iam-contracts/health.svg)](https://phpackages.com/packages/padosoft-laravel-iam-contracts) ``` ### Alternatives [vitalybaev/laravel5-dkim Laravel 5/6 package for signing outgoing messages with DKIM. 3163.1k](/packages/vitalybaev-laravel5-dkim)[firemultimedia/mautic-multi-captcha-bundle This plugin brings Google's reCAPTCHA, hCaptcha, and Cloudflare Turnstile integration to mautic. 151.4k](/packages/firemultimedia-mautic-multi-captcha-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)