Download the PHP package nubitio/admin-bundle without Composer

nubitio/admin-bundle

One-line backend for the Nubit admin stack. Install it, point @nubitio/react-admin at your API, and you have a CRUD admin system.

Registers automatically:

• The API Platform bridge from nubitio/api-platform: DataGridFilter, translated OpenAPI docs with x-crud hints, pagination headers, domain-exception mapping.
• Dual JWT auth: POST /api/auth/login, /api/auth/refresh, /api/auth/logout, /api/auth/change-password, GET /api/me. Web clients get HttpOnly cookies; mobile/API clients get tokens in the body (response_mode: json or X-Client-Type: android|ios). Refresh tokens are rotated and stored hashed (Doctrine entity nubit_refresh_token); changing the password revokes every session and re-issues tokens for the current one. Purge old tokens with bin/console nubit:auth:purge-refresh-tokens.
• Mercure (nubit_admin.mercure.enabled: true): issues the mercureAuthorization subscriber-JWT cookie on login/refresh so the React grids receive live updates. Replace MercureCookieDecorator to scope topics per tenant/user.
• Fail-safe Mercure publishing (mercure.fail_safe, on by default whenever MercureBundle is installed): API Platform publishes mercure: true updates after the flush, so a dead hub used to turn an already-persisted write into a 500 — clients retry and duplicate data. The bundle decorates the default hub: during HTTP requests publish failures are logged and swallowed (response stays 2xx, live refresh degrades to manual); in messenger workers and console commands they are rethrown, so routing Symfony\Component\Mercure\Update to an async transport keeps full retry/delivery semantics. Apps with a custom hub name decorate it themselves with Nubit\AdminBundle\Mercure\FailSafeHub.
• Soft delete: mark entities with #[Nubit\ApiPlatform\Attribute\SoftDeletable] and the registered Doctrine filter (nubit_soft_delete) hides rows whose deleted_at is set. Opt-in per entity by design.
• Single-tenant defaults for the Nubit\Platform contracts (registry, connection switcher, feature checker, quota enforcer) — multi-tenant apps override the aliases.
• Autoconfiguration for GridVirtualFieldInterface and LoginResponseDecoratorInterface implementations.
• Discovery CLI: bin/console nubit:discover lists API Platform resources, embedded-lines routes, and (when installed) sequence/workflow features.
• Embedded lines in docs: x-embedded-lines on parent resources lets SchemaCrudPage infer formDetail line fields automatically. Set an explicit route on #[EmbeddedLines] (omitting it is deprecated).

Setup

1. Import the routes (config/routes/nubit_admin.yaml):

2. Wire the firewall (config/packages/security.yaml) — the bundle cannot define firewalls for you. Apps with more than one user provider (e.g. an extra admin firewall) must also alias the one the API uses, otherwise autowiring is ambiguous:

3. Create the refresh-token table: bin/console make:migration && bin/console doctrine:migrations:migrate (the bundle's RefreshToken entity is auto-mapped).

Session profile (GET /api/me)

The React SessionProvider calls this on boot. Default response:

Alias MeResponseBuilderInterface to add application-specific fields without forking the route.

Embedded lines (master-detail forms)

Line entities that belong to a parent document use #[EmbeddedLines] on the Doctrine class — the bundle registers GET /api/{lines} returning a plain JSON array for SmartCrud formDetail reload (no Hydra envelope, no custom controller).

Import embedded line routes in addition to the bundle routes:

On the parent processor, extend AbstractEmbeddedLinesProcessor to bind lines before persist. Frontend:

Runtime config (GET /api/runtime-config, opt-in)

Separate from /api/me: UI flags, defaults, capabilities, onboarding state — free-form JSON defined by the application. Enable the route, implement the provider, alias it:

On the React side, useRuntimeConfig() from @nubitio/react-admin fetches the payload (RuntimeConfig is Record<string, unknown> — type it per app). Disabled by default so internal skeletons work with zero config.

Configuration (defaults shown)

Audit trail (opt-in)

audit.enabled: true records field-level before/after diffs for entities marked #[Nubit\ApiPlatform\Attribute\Auditable] (creates, updates, deletes — captured from the Doctrine change set, written to nubit_audit_log in the same request, attributed to the authenticated user). Serve them to the AuditTrailPanel in @nubitio/react-admin:

GET /api/audit-trail/{resource}/{id} returns newest-first entries in the panel shape: [{ id, timestamp, user, action, changes: { field: { before, after } } }]. Relations collapse to their id; ignored_fields are excluded from diffs; collection contents are not audited. Create the table with a migration and schedule bin/console nubit:audit:purge.

Media library (opt-in)

media.enabled: true exposes a ready-made upload pipeline matching fileField() / imageField() in @nubitio/react-admin (instant upload — the form submits only the media IRI):

• POST /api/media — traditional multipart/form-data upload (field file), returns { id, path, originalName, mimeType, size } where path is the resolved public URL.
• GET /api/media/{id} / DELETE /api/media/{id} — delete is a soft delete; files are removed later by bin/console nubit:media:purge (schedule it — instant uploads orphan files when forms are abandoned).
• GET /api/media/{id}/file — default streaming endpoint, works for any Flysystem storage behind the same /api firewall.

Storage is local disk by default (zero config). For S3 (or anything Flysystem speaks), point media.storage.filesystem at a FilesystemOperator service — e.g. with oneup/flysystem-bundle:

To serve direct S3/CDN URLs instead of streaming through PHP, implement Nubit\AdminBundle\Media\MediaUrlResolverInterface and alias it in services.yaml. Create the table with a migration (doctrine:migrations:diff picks up nubit_media once enabled). Reference uploads from your entities as a plain ManyToOne to Nubit\AdminBundle\Media\Entity\Media.

Clients

Web (@nubitio/core) — works out of the box: login stores HttpOnly cookies; CoreProvider auto-refreshes via auth/refresh.

Android / API — send response_mode: "json" on login (or the X-Client-Type: android header on every auth call):

Refresh with { "refreshToken": "..." } in the body; send Authorization: Bearer <token> on every request.

Extension points

License

MIT