Download the PHP package azaharizaman/nexus-identity without Composer
On this page you can find all versions of the php package azaharizaman/nexus-identity. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download azaharizaman/nexus-identity
More information about azaharizaman/nexus-identity
Files in azaharizaman/nexus-identity
Package nexus-identity
Short Description Domain layer: Framework-agnostic Identity and Access Management package for Nexus ERP
License MIT
Informations about the package nexus-identity
Nexus\Identity
Framework-agnostic Identity and Access Management package for Nexus ERP
The Identity package provides a comprehensive, pure PHP solution for authentication, authorization, session management, and user identity management. It follows strict contract-driven design principles and integrates seamlessly with the Nexus monorepo architecture.
Features
- ✅ Pure PHP 8.3+ - No framework dependencies in core logic
- ✅ CQRS Architecture - Separate Query and Persist interfaces for clean separation
- ✅ Contract-Driven - All data structures and operations defined via interfaces
- ✅ Role-Based Access Control (RBAC) - Flexible permission management with role hierarchy
- ✅ Direct Permission Assignment - Bypass roles for fine-grained control
- ✅ Wildcard Permissions -
users.*grants all user permissions - ✅ Session Management - Secure token-based authentication
- ✅ API Token Authentication - Scoped tokens for programmatic access
- ✅ Multi-Factor Authentication (MFA) - TOTP, WebAuthn/Passkeys, Backup Codes
- ✅ Single Sign-On (SSO) - SAML, OAuth2, OIDC support (pluggable)
- ✅ Password Security - Argon2id hashing, breach detection, history tracking
- ✅ Account Lifecycle - Registration, activation, suspension, locking
- ✅ Security Events - Integration with AuditLogger
- ✅ Multi-Tenant - Tenant-scoped users and roles
Installation
Architecture
CQRS Pattern (v1.1.0+)
The package follows CQRS (Command Query Responsibility Segregation) pattern. Each repository domain has separate interfaces:
| Domain | Query Interface (Read) | Persist Interface (Write) |
|---|---|---|
| User | UserQueryInterface |
UserPersistInterface |
| Role | RoleQueryInterface |
RolePersistInterface |
| Permission | PermissionQueryInterface |
PermissionPersistInterface |
| MFA Enrollment | MfaEnrollmentQueryInterface |
MfaEnrollmentPersistInterface |
| Trusted Device | TrustedDeviceQueryInterface |
TrustedDevicePersistInterface |
| WebAuthn Credential | WebAuthnCredentialQueryInterface |
WebAuthnCredentialPersistInterface |
| Backup Code | BackupCodeQueryInterface |
BackupCodePersistInterface |
Best Practice: Inject the specific Query or Persist interface based on your needs:
Package Structure
Core Principles
-
Logic in Packages, Implementation in Applications
- Package defines what (interfaces, services, value objects)
- Application defines how (Eloquent models, repositories, migrations)
-
Framework Agnostic
- Zero Laravel dependencies in
src/ - No
Illuminate\*classes - No Eloquent models
- No database queries
- Zero Laravel dependencies in
-
Dependency Injection
- Constructor injection for all dependencies
- Interface-based dependencies only
- CQRS Separation
- Query interfaces for read operations
- Persist interfaces for write operations
- Clear command/query responsibility
Usage Examples
User Management
Authentication
Authorization
Basic Permission Checking (RBAC)
Policy-Based Authorization (ABAC)
For complex authorization that requires context, relationships, or business rules:
When to use Policy-Based Authorization:
- ✅ Authorization depends on relationships (e.g., manager, same department)
- ✅ Authorization requires resource state (e.g., invoice status, case ownership)
- ✅ Complex multi-condition rules
- ✅ Context-dependent decisions
When to use Basic Permission Checking:
- ✅ Simple "can user perform action" checks
- ✅ Role-based access (admin, manager, user)
- ✅ Static permissions that don't change based on context
Role Management
Permission Management
API Token Management
Value Objects
Value objects are immutable and enforce business rules:
UserStatus
Credentials
Permission
Exception Handling
All domain exceptions extend PHP's base Exception:
Integration with Application Layer
The application layer (apps/Atomy) must provide implementations for all contracts:
- Eloquent Models implementing entity interfaces
- Repositories implementing repository interfaces
- Service Implementations (password hashing, validation, etc.)
- Database Migrations
- Service Provider Bindings
Example binding in AppServiceProvider:
Security Considerations
- Password Hashing: Use Argon2id or bcrypt (minimum cost 12)
- Session Tokens: Cryptographically secure random tokens (256 bits minimum)
- API Tokens: One-way hashed in database, only shown once on generation
- Failed Login Tracking: Lock account after configurable threshold (default 5)
- Password History: Prevent reuse of last N passwords (default 5)
- Session Fingerprinting: Bind sessions to IP/User-Agent
- MFA Enforcement: Can be required per role
- Audit Logging: All authentication/authorization events logged
Requirements Addressed
This package addresses all requirements listed in REQUIREMENTS.csv for Nexus\Identity:
- ✅ ARC-IDE-1300 to ARC-IDE-1310: Architectural requirements
- ✅ BUS-IDE-1311 to BUS-IDE-1360: Business requirements
- ✅ FUN-IDE-1361 to FUN-IDE-1410: Functional requirements
- ✅ PERF-IDE-1411 to PERF-IDE-1416: Performance requirements
- ✅ REL-IDE-1417 to REL-IDE-1423: Reliability requirements
- ✅ SCL-IDE-1424 to SCL-IDE-1428: Scalability requirements
- ✅ MAINT-IDE-1429 to MAINT-IDE-1435: Maintainability requirements
- ✅ COMP-IDE-1436 to COMP-IDE-1444: Compliance requirements (GDPR, PCI-DSS, NIST)
- ✅ USE-IDE-1445 to USE-IDE-1500: User stories
Testing
Package tests should use mocks for all repository implementations:
📖 Documentation
Package Documentation
- Getting Started Guide - Quick start guide with prerequisites, core concepts, and first integration
- API Reference - Complete documentation of all 28 interfaces, 10 services, 20 value objects, and 19 exceptions
- Integration Guide - Laravel and Symfony integration examples with complete setup instructions
- Basic Usage Example - Simple usage patterns for authentication, authorization, and MFA
- Advanced Usage Example - Advanced scenarios including WebAuthn, passwordless auth, and complex workflows
Additional Resources
IMPLEMENTATION_SUMMARY.md- Implementation progress, metrics, and key design decisionsREQUIREMENTS.md- All 401 requirements with status trackingTEST_SUITE_SUMMARY.md- Test coverage metrics and test inventory (331+ tests, 95%+ coverage)VALUATION_MATRIX.md- Package valuation metrics for funding assessment ($300K+ estimated value)- See root
../../ARCHITECTURE.mdfor overall system architecture - See
../../docs/NEXUS_PACKAGES_REFERENCE.mdfor package ecosystem reference
License
MIT License. See LICENSE file for details.
All versions of nexus-identity with dependencies
psr/log Version ^3.0
spomky-labs/otphp Version ^11.3
endroid/qr-code Version ^5.0
web-auth/webauthn-lib Version ^4.7
web-auth/cose-lib Version ^4.2
azaharizaman/nexus-common Version dev-main