User Kit Bundle

⭐ Found this useful? Install from Packagist and give the repo a star on GitHub.

Symfony bundle for user account lifecycle and presence: enable/disable accounts (UserChecker), throttled lastActivityAt updates, configurable online detection and an opt-in session registry (where am I signed in, sign out a device, concurrent-session limits). Designed to complement nowo-tech/auth-kit-bundle without a hard Composer dependency.

This bundle is FrankenPHP worker mode friendly.

"My sessions" — every signed-in browser, the current one flagged

Sign out another session — it is signed out on its next request

Features

• enabled / disabled accounts — AccountStatusUserChecker blocks login for disabled users
• lastActivityAt — updated on authenticated HTTP requests (throttled)
• online_threshold — UserPresenceResolver::isOnline() and optional Twig user_is_online()
• Named profiles — separate config per user entity (User, Admin, …) with O(1) class resolution
• Session invalidation hook — optional Doctrine listener that calls your SessionInvalidatorInterface when an account is disabled (default implementation is a no-op)
• Optional traits — EnabledUserTrait, LastActivityTrait
• UI preferences — UiPreferences embeddable / UiPreferencesTrait (locale, theme, width, density, motion, font scale, contrast, sidebar, footer) and the Twig user_ui_html_attributes() helper for <html> data-* attributes
• Product tour progress — ProductTourProgress embeddable / trait (markPageSeen(), hasSeenPage(), syncEnabledPages())
• GDPR self-service SPI (opt-in) — tagged export providers / erasers / erasure guards, versioned JSON PersonalDataExporter, transactional PersonalDataEraser with veto hook
• Session registry and limits (opt-in, sessions.enabled) — one row per signed-in session (HMAC of the id only, browser / OS names, truncated IP), revoked sessions signed out on their next request with any session handler, "My sessions" and admin pages (UiKit + FormKit CSRF-only actions), sign out one / all others / everywhere, concurrent-session limit (evict_oldest / reject_new, per-user resolver), automatic sign-out on password change and account disable, audit events, retention purge command, GDPR export / erasure
• Translations — domain NowoUserKitBundle (de, en, es, fr, it, nl, pt)

Quick start

composer require nowo-tech/user-kit-bundle

# config/packages/nowo_user_kit.yaml
nowo_user_kit:
    default_profile: default
    profiles:
        default:
            user_class: App\Entity\User
            account_status:
                enabled: true
            last_activity:
                enabled: true
                online_threshold: 300

The legacy flat layout (user_class at root) remains supported. See Configuration.

Session registry (opt-in; create the user_kit_session table with Doctrine Migrations, see Upgrading):

nowo_user_kit:
    sessions:
        enabled: true
        limit: { max_sessions: 5, policy: evict_oldest }
        web_ui: { enabled: true }   # routes: type nowo_user_kit_sessions

Requirements

• PHP 8.2+
• Symfony 7.4 | 8.x
• Doctrine ORM; nowo-tech/ui-kit-bundle and nowo-tech/form-kit-bundle (installed with the bundle; used by the session pages)

AuthKit coexistence

Login (AuthKit) → form_login → UserProvider → UserChecker (UserKit) → OK / blocked

Use the same user_class in both bundles. UserKit may inherit user_class from nowo_auth_kit.user_class when that parameter exists.

Demo

make -C demo up    # Symfony 8.1 — http://localhost:8023

Login with demo@user-kit.test / demo, then open My sessions (sign in from a second browser to see two sessions).

Playwright e2e (login → My sessions → sign out another session) and the README screenshots run against the running demo (REQ-DEMO-013):

make test-e2e          # official Playwright image, demo/symfony8/e2e
make demo-screenshots  # refresh docs/images/demo/*.webp

The demo runs under FrankenPHP in Docker. See demo/README.md and docs/DEMO-FRANKENPHP.md for development vs production setup, including FrankenPHP worker mode for production.

Development

make up
make test-coverage-100
make phpstan
make igor

Documentation

• Installation
• Configuration
• Usage
• Templates
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• GitHub Actions CI requirements
• PSR evaluation (REQ-CS-007)
• Demo with FrankenPHP
• FrankenPHP worker audit
• Baseline product spec
• Code inventory
• UI preferences spec (002)
• Personal data (GDPR) spec (003)
• Session registry spec (004)

Tests and coverage

• PHP: 100% line coverage on src/ (verified via make test-coverage-100)
• Compatibility: PHP 8.2+ · Symfony 7.4 / 8.x (CI matrix)

Package

• Composer: nowo-tech/user-kit-bundle
• Config root: nowo_user_kit