README

⭐ Found this useful? Install from Packagist and give the repo a star on GitHub.

Symfony bundle for user account lifecycle and presence: enable/disable accounts (UserChecker), throttled lastActivityAt updates, configurable online detection and an opt-in session registry (where am I signed in, sign out a device, concurrent-session limits). Designed to complement nowo-tech/auth-kit-bundle without a hard Composer dependency.

This bundle is FrankenPHP worker mode friendly.

My sessions page listing the current Chrome session and a Firefox session, each with device, network, sign-in time and last activity

_{"My sessions" — every signed-in browser, the current one flagged}

Confirmation dialog to sign out the Firefox session from My sessions

_{Sign out another session — it is signed out on its next request}

Features

enabled / disabled accounts — AccountStatusUserChecker blocks login for disabled users
lastActivityAt — updated on authenticated HTTP requests (throttled)
online_threshold — UserPresenceResolver::isOnline() and optional Twig user_is_online()
Named profiles — separate config per user entity (User, Admin, …) with O(1) class resolution
Session invalidation hook — optional Doctrine listener that calls your SessionInvalidatorInterface when an account is disabled (default implementation is a no-op)
Optional traits — EnabledUserTrait, LastActivityTrait
UI preferences — UiPreferences embeddable / UiPreferencesTrait (locale, theme, width, density, motion, font scale, contrast, sidebar, footer) and the Twig user_ui_html_attributes() helper for <html> data-* attributes
Product tour progress — ProductTourProgress embeddable / trait (markPageSeen(), hasSeenPage(), syncEnabledPages())
GDPR self-service SPI (opt-in) — tagged export providers / erasers / erasure guards, versioned JSON PersonalDataExporter, transactional PersonalDataEraser with veto hook
Session registry and limits (opt-in, sessions.enabled) — one row per signed-in session (HMAC of the id only, browser / OS names, truncated IP), revoked sessions signed out on their next request with any session handler, "My sessions" and admin pages (UiKit + FormKit CSRF-only actions), sign out one / all others / everywhere, concurrent-session limit (evict_oldest / reject_new, per-user resolver), automatic sign-out on password change and account disable, audit events, retention purge command, GDPR export / erasure
Translations — domain NowoUserKitBundle (de, en, es, fr, it, nl, pt)

Quick start

composer require nowo-tech/user-kit-bundle

# config/packages/nowo_user_kit.yaml
nowo_user_kit:
    default_profile: default
    profiles:
        default:
            user_class: App\Entity\User
            account_status:
                enabled: true
            last_activity:
                enabled: true
                online_threshold: 300

The legacy flat layout (user_class at root) remains supported. See Configuration.

Session registry (opt-in; create the user_kit_session table with Doctrine Migrations, see Upgrading):

nowo_user_kit:
    sessions:
        enabled: true
        limit: { max_sessions: 5, policy: evict_oldest }
        web_ui: { enabled: true }   # routes: type nowo_user_kit_sessions

Requirements

PHP 8.2+
Symfony 7.4 | 8.x
Doctrine ORM; nowo-tech/ui-kit-bundle and nowo-tech/form-kit-bundle (installed with the bundle; used by the session pages)

AuthKit coexistence

Login (AuthKit) → form_login → UserProvider → UserChecker (UserKit) → OK / blocked

Use the same user_class in both bundles. UserKit may inherit user_class from nowo_auth_kit.user_class when that parameter exists.

Demo

make -C demo up    # Symfony 8.1 — http://localhost:8023

Playwright e2e (login → My sessions → sign out another session) and the README screenshots run against the running demo (REQ-DEMO-013):

make test-e2e          # official Playwright image, demo/symfony8/e2e
make demo-screenshots  # refresh docs/images/demo/*.webp

The demo runs under FrankenPHP in Docker. See demo/README.md and docs/DEMO-FRANKENPHP.md for development vs production setup, including FrankenPHP worker mode for production.

Development

make up
make test-coverage-100
make phpstan
make igor

Documentation

Installation
Configuration
Usage — Standard Symfony host and DDD / hexagonal host
Templates
Contributing
Code of Conduct
Changelog
Upgrading
Release
Security
Engram
Spec-driven development
GitHub Spec Kit

nowo-tech / user-kit-bundle

Package info

Security

Fund package maintenance!

Statistics