PHPackages                             seablast/auth - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. seablast/auth

ActiveLibrary[Authentication & Authorization](/categories/authentication)

seablast/auth
=============

No-password authentication and authorization library for Seablast for PHP

v0.1.10(1mo ago)02.1kMITPHPPHP >=7.2 <8.6CI passing

Since Jun 1Pushed 1mo ago1 watchersCompare

[ Source](https://github.com/WorkOfStan/seablast-auth)[ Packagist](https://packagist.org/packages/seablast/auth)[ RSS](/packages/seablast-auth/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (10)Dependencies (20)Versions (15)Used By (0)

Seablast Auth
=============

[](#seablast-auth)

A no-password authentication and authorization extension for [Seablast for PHP](https://github.com/WorkOfStan/seablast) apps. This extension facilitates secure user verification and efficient access control.

Optionally, Seablast Auth has a lightweight integration with Google and Facebook to support social authentication, allowing seamless sign-in through various social media platforms. Integrable via Composer, it activates only when required, equipping your app with essential security features effortlessly. If your Seablast-based application necessitates user authentication or resource authorization, incorporating Seablast Auth will equip it with these capabilities instantly. (For applications that do not require these features, Seablast Auth can simply be omitted to maintain a lighter application footprint.)

Note: Ensure that your PHP and MySQL timezones are properly set, as the code uses CURRENT\_TIMESTAMP for time-related operations. (It would be possible to use purely SQL statements with `INTERVAL` but at a cost of not caching the SQL responses.)

User management
---------------

[](#user-management)

- RBAC (Role-Based Access Control) supported
- user MUST have one role (admin, editor, ordinary user)
- user MAY belong to various groups (based on subscription tariff, a promotion, etc.)

Usage
-----

[](#usage)

When just getting the identity of a logged-in user is needed:

```
    // Instantiate the IdentityManager class with `\mysqli`
    $identity = new IdentityManager($this->configuration->mysqli());
    // If prefix is used, inject it
    $identity->setTablePrefix($this->configuration->dbmsTablePrefix());
    // To make Remember Me cookies predictable and thus avoid conflicts, inject a cookie path
    $identity->setCookiePath($this->configuration->getString(SeablastConstant::SB_SESSION_SET_COOKIE_PARAMS_PATH));
```

To create the expected database table structure, just add the seablast/auth migration path to your phinx.php configuration, e.g.

```
    'paths' => [
        'migrations' => [
            '%%PHINX_CONFIG_DIR%%/db/migrations',
            '%%PHINX_CONFIG_DIR%%/../vendor/seablast/auth/conf/db/migrations',
        ],
        'seeds' => '%%PHINX_CONFIG_DIR%%/db/seeds'
    ],
```

Following tables will be created (prefixed as set in your app), so avoid conflict with the naming of tables by your app:

- email\_token (user)
- group (user\_groups)
- group\_activation\_tokens (user\_groups)
- roles (user)
- session\_user (user)
- users (user)
- user\_group (user\_groups)

### Cookies

[](#cookies)

IdentityManager expects cookie scope being set already by:

```
session_set_cookie_params(
    int $lifetime_or_options,
    ?string $path = null,
    ?string $domain = null,
    ?bool $secure = null,
    ?bool $httponly = null
): bool
```

Note: `sbRememberMe` cookie is created/read only if the web is accessed over HTTPS and if allowed by `AuthApp:FLAG_REMEMBER_ME_COOKIE` (allowed by default). Bundled models inject the flag into `IdentityManager`; direct `IdentityManager` users can call `setRememberMeCookieEnabled(false)`.

### Routing

[](#routing)

`/user` is the default route (which can be changed by `AuthConstant::USER_ROUTE`) to the user log-in/log-out page, but if you want to customize it, configure path to your own template within your app's `conf/app.conf.php` like this:

```
        //->setString(AuthConstant::USER_ROUTE, '/user') // can be changed
        ->setArrayArrayString(
            SeablastConstant::APP_MAPPING,
            '/user',
            [
                'template' => 'user', // your latte template including login-form.latte
                'model' => '\Seablast\Auth\UserModel',
            ]
        )
```

Successful login either reloads the current page or goes to a social login success page:

```
        ->setString(AuthConstant::SOCIAL_LOGIN_SUCCESS_URL, '') // empty OR not set => just reload; otherwise go to the fully qualified URL of a social login success page
```

Note 1: Seablast::v0.2.5 and newer use the default settings in the [conf/app.conf.php](conf/app.conf.php), so Seablast Auth configuration is loaded automatically.

`send-auth-token.js` (since Seablast::v0.2.10) expects the route `/api/social-login` as configured in [app.conf.php](conf/app.conf.php) and provider either `facebook` or `google`.

These arguments `window.sendAuthToken(token, apiRoute, errorLogger);` are processed since Seablast::v0.2.13.

Note 2: `const API_BASE = ''; const flags = [];` MUST be defined in JavaScript as the default `/user` expects these two variables.

### View

[](#view)

`\Seablast\Auth\UserModel` returns arguments ($configuration, $csrfToken, $message, $showLogin, $showLogout) for the user.latte template:

```
{include '../vendor/seablast/auth/views/user-control.latte'}
```

Note 1: user.latte uses inherite.latte for all the latte parts, so either you may use it or include user-control.latte or create app version of any of the latte parts.

Note 2: vendor/seablast is accessible for Seablast apps, so the web browser assets (such as `send-auth-token.js`) used by plugins MUST be put into assets folder of the Seablast library.

### Social login

[](#social-login)

The presence of configuration strings `FACEBOOK_APP_ID` or `GOOGLE_CLIENT_ID` enables login by these platforms respectively.

Note 1: social login can be deactivated in an app by `->deactivate(AuthConstant::FLAG_USE_SOCIAL_LOGIN)` in the configuration.

Note 2: send-auth-token.js is expected in seablast directory, which needs at least Seablast v0.2.10. (These arguments `window.sendAuthToken(token, apiRoute, errorLogger);` are processed since Seablast::v0.2.13.)

Note 3: The new Google Identity Services no longer opens a traditional pop-up account chooser; instead, it displays the One Tap UI.

### MailOut::send() method is a generic mail sender built on top of Symfony Mailer

[](#mailoutsend-method-is-a-generic-mail-sender-built-on-top-of-symfony-mailer)

In order to send emails, the `SeablastConstant::USER_MAIL_ENABLED` flag MUST be activated.

```
  // Usage:
  use Seablast\Auth\MailOut;

  /** @var \Seablast\Seablast\SeablastConfiguration $seablastConfiguration */
  $sendMail = new MailOut($seablastConfiguration);
  $sendMail->send(
    'user@example.com', // to
    'Login link', // subject
    "Open this URL: https://app.example.com/?token=XYZ", // textBody
    [
      'cc'   => ['cc1@example.com', 'cc2@example.com'], // optional
      'bcc'  => 'audit@example.com',                    // optional, can be string or array
      'html' => 'Open this URL: Login', // optional
      // 'replyTo' => 'support@example.com',           // optional
      // 'from'    => 'custom-from@example.com',       // optional override of defaultFrom
      // 'priority'=> Email::PRIORITY_HIGH,            // optional (1..5), default normal
    ]
  );
```

Testing
-------

[](#testing)

Run `.\vendor\bin\phpunit` on Windows for essential PHPUnit tests. From Git Bash, [./test.sh](./test.sh) also prepares the testing database migration before running PHPUnit.

- create token and use it,
- check its disappearance as it's valid only once,
- an invalid email format is not accepted,
- SQL injection attempts is not accepted.

TODO
----

[](#todo)

- 251227, success email token login/logout page
- 251227, define also (social login) logout page
- 260707, before this update, social login didn't set users.last\_login , so these accounts were protected before deletion by "remove never-logged-in users older than 15 minute" because the session\_user is not pruned, yet. Sometimes after this update, start to carefully prune also the session\_user table.

###  Health Score

47

—

FairBetter than 93% of packages

Maintenance94

Actively maintained with recent releases

Popularity19

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity56

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~76 days

Recently: every ~85 days

Total

11

Last Release

31d ago

PHP version history (3 changes)v0.1PHP ^7.2 || ^8.0

v0.1.6PHP >=7.2 <8.5

v0.1.8PHP >=7.2 <8.6

### Community

Maintainers

![](https://www.gravatar.com/avatar/f8ab84e79abe75dc2ab7d20061533e5dbd4f5ccde41708c7ae7b70360b4d79f2?d=identicon)[WorkOfStan](/maintainers/WorkOfStan)

---

Top Contributors

[![WorkOfStan](https://avatars.githubusercontent.com/u/26247074?v=4)](https://github.com/WorkOfStan "WorkOfStan (16 commits)")

---

Tags

facebook-logingoogle-loginrole-based-access-controlsecure-login-phpsocial-loginsocial-login-google

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/seablast-auth/health.svg)

```
[![Health](https://phpackages.com/badges/seablast-auth/health.svg)](https://phpackages.com/packages/seablast-auth)
```

###  Alternatives

[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.5k6.0M766](/packages/sylius-sylius)[laravel/framework

The Laravel Framework.

34.9k556.2M21.1k](/packages/laravel-framework)[tempest/framework

The PHP framework that gets out of your way.

2.3k37.6k19](/packages/tempest-framework)[symfony/security-bundle

Provides a tight integration of the Security component into the Symfony full-stack framework

2.5k190.0M2.5k](/packages/symfony-security-bundle)[drupal/core

Drupal is an open source content management platform powering millions of websites and applications.

19467.3M1.9k](/packages/drupal-core)[elgg/elgg

Elgg is an award-winning social networking engine, delivering the building blocks that enable businesses, schools, universities and associations to create their own fully-featured social networks and applications.

1.7k17.3k99](/packages/elgg-elgg)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)