README

The Symfony host of omnisense/omnibridge's contracts, and the Symfony side of omnisense/omnibase: the adapters of the host's contracts over Symfony's own services (router, translator, security, CSRF, kernel), their container wiring, and the framework packages the core no longer requires. The mirror of omnibridge/laravel for Laravel.

A Symfony site requires it beside the core:

composer require omnisense/omnibase omnibridge/symfony

omnibase's BaseBundle refuses to start without it. A Laravel site does not require it: it requires omnibridge/laravel instead.

The contracts

Each adapter is bound under its contract's name and reached through Omnibridge\Runtime (Runtime::urls()...) or by autowiring the contract.

Locales, Files and Routes have no generic Symfony answer: an application's languages, storages and route names are its own. omnibase binds them to its Localizer, its Flysystem storages and its router (Base\Bridge\Symfony\*, below). Laravel's bridge binds them, and omnibase's own contracts, itself, because Laravel has none of omnibase's services.

The pages' Twig functions on the contracts: omnibridge/twig's AccessExtension (is_granted() on Access, csrf_token() on Tokens) is registered here, after twig-bridge's SecurityExtension and CsrfExtension (TwigBundle adds the bridge's extensions first), so a page asks the same code under Symfony as under Laravel (omnibridge/laravel's View\Twig), answered by the same services. Without SecurityBundle or CSRF protection the contract is missing and its function left out.

Also here: FileLinks, the links of the error pages and the profiler mapped from the container to the developer's machine (APP_PATH), Symfony's own FileLinkFormatter on a mapped format.

The wiring

• config/services.php (OmnibridgeBundle::SERVICES): the six adapters, each aliased by its contract's name and tagged omnibridge.adapter.
• DependencyInjection\ContractsPass: the service locator Omnibridge\Runtime reads (omnibridge.contracts), of the contracts whose service exists; an adapter whose framework service is missing (no SecurityBundle, no CSRF protection) is removed with the aliases that lead to it, so such a container still compiles. An application may run it with its own list, former names and id.
• OmnibridgeBundle, for a Symfony application without omnibase: imports the services, adds the pass, hands the locator to Runtime at boot and takes it back at shutdown.

An omnibase site does not register OmnibridgeBundle: omnibase's BaseBundle imports the same config/services.php (giving RouterUrls and SecuritySessions omnibase's router), runs the same pass with omnibase's own contracts added (Nouns, Media, Pictures, Texts, the parameters, the mailer) and seeds the registry itself.

What moved from omnibase, what stayed (plan "omnibase agnostique", A1)

The rule: an adapter moved when it adapts a contract to Symfony's own services and nothing of omnibase; it stayed when it reads omnibase's own services or models. This package does not require omnisense/omnibase, so nothing is circular: the core's Symfony bundle stands on this package, never the reverse.

Moved (Base\Bridge\Symfony\X is now an alias of the class here, declared by the core's src/Resources/Aliases.php where this package is installed; the former service ids are aliases of the new ones):

Stayed in the core, Base\ (omnibase's domain under Symfony, D3):

The former names are removed at omnibase 4's final pass, once the sites name the new classes.

Signing in: Omnibridge\Symfony\Auth\ (omniauth)

Where omnisense/omniauth is installed (it is only suggested), OmnibridgeBundle registers omniauth's extension (Auth\DependencyInjection\OmniauthExtension; an omnibase site's BaseBundle calls OmniauthExtension::register() too). With no config/packages/omniauth.yaml, nothing is wired. With one, every way of signing in goes through omniauth's conductor and one Symfony authenticator:

# config/packages/security.yaml
firewalls:
    main:
        custom_authenticators: [Omnibridge\Symfony\Auth\OmniauthAuthenticator]
access_control:
    - { path: ^/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }

# config/routes/omniauth.yaml
omniauth: { resource: ., type: omniauth }

# config/packages/omniauth.yaml - each key turns its method on
omniauth:
    password: { routes: [security_login] }
    link: { route: security_loginWithToken }      # 15 minutes, once, hashed
    email_code: ~
    backup_codes: ~
    trusted_device: ~                              # scheb/2fa's cookie and tokens
    totp: { secret_key: '%env(OMNIAUTH_TOTP_KEY)%' }   # omniauth/otp; the secrets sealed at rest (sodium)
    passkey: { rp_id: '%env(RELYING_PARTY_ID)%' }  # omniauth/webauthn
    oauth: { providers: { google: { client_id: '...', client_secret: '...' } } }   # omniauth/google (the mechanics: omniauth's Omniauth\OAuth\)

totp.secret_key (base64 of 32 bytes, from the vault or the environment, never in the repository; the same on every host of one database - the Laravel twin's config/omniauth.php reads the same variable) seals the TOTP secrets at rest: omniauth/otp's SealedTotpSecrets over a SodiumSecretBox decorates the totp_secrets store, so the method and any page that reads or writes the store (omnibase's enrolment and its QR code) go through it. Unset, the secrets are kept as the store has them. A secret kept in clear before is read as it is until the application rewrites its rows (omnibase sites: a migration).

A provider's return address is, unless it sets one, the path of its check route: omniauth puts it on the host of each trip's request (the providers are built once per worker; an absolute address made here would stay on the first request's host). Each provider package's factory (Omniauth\OAuth\Provider\ProviderFactory, tag omniauth.oauth_provider_factory) makes its own kind; omniauth/google's is registered when it is installed.

The stores (Omniauth\Contract\Accounts... the passkeys, the sender) are the application's, by their contracts' names or those omniauth.yaml's stores names; omniauth's events go to Symfony's dispatcher (listen to Omniauth\Event\SignedIn...).

Maps: Omnibridge\Symfony\Map\ (omnimap)

Where omnisense/omnimap is installed (suggested), config/packages/omnimap.yaml wires it: its providers (omnimap/google, omnimap/openstreetmap, registered when installed) over the application's http_client, a PSR-16 view of a cache pool and a PSR-18 client for geocoder-php; the map cache over a storage service of the application's (any Omnimap\Snapshot\Storage); omnibridge/twig's MapExtension (omnimap(view), omnimap_export(), omnimap_suppress()); the cache's routes and their controller.

# config/routes/omnimap.yaml
omnimap: { resource: ., type: omnimap }

# config/packages/omnimap.yaml
omnimap:
    provider: openstreetmap            # the page's map: a key of providers
    secret: '%env(MAP_SECRET)%'        # signs the pictures' names
    providers:
        openstreetmap: { user_agent: 'MySite/1.0 (+https://example.org)' }
        google: { api_key: '%env(GOOGLE_MAPS_CLIENT_KEY)%', secret: '%env(GOOGLE_MAPS_SECRET)%' }
    cache:
        drive: local.uploads           # an omnidrive drive (Omnidrive\Drives); or storage: an Omnimap\Snapshot\Storage service
        public_directory: '%kernel.project_dir%/public'   # tiles served are written there too
    routes:
        tile: { path: '/omnimap/{signature}/{id}.webp', name: omnimap_tile }

Storages: Omnidrive\Drives (omnidrive)

Where omnisense/omnidrive is installed (suggested), Omnidrive\Drives is the application's storages as omnidrive's drives: an Omnidrive\Flysystem\OperatorDrives over the services tagged flysystem.storage, by their storage names - the storages of league/flysystem-bundle's configuration (or omnibase's local ones without the bundle). Nothing is configured a second time: config/packages/flysystem.yaml names them, the code reads and writes them through Drive.

public function __construct(private readonly Drives $drives) {}

$this->drives->get('local.uploads')->write('avatars/1.png', $bytes);

Static export: Omnibridge\Symfony\Static\ (omnibridge/static)

Where omnibridge/static is installed, config/services.php registers the console command omnibridge:static:build: omnibridge/static's own command line (Console\Cli), handed this kernel's renderer (each page a visitor's GET through $kernel->handle(), at --render-origin, by default the router's default URI), the router's routes, the container and public/.

bin/console omnibridge:static:build static.php --out=var/static [--verify] [--strict]

Run on lesringostars (2026-10-24, the working copy loaded by hand, neither package installed there yet): the same report as the plain command line, but for the dev 404 page (Symfony's exception page, its trace).

Tests

docker compose run --rm test

PHP 8.4, the latest Symfony: a kernel of FrameworkBundle, SecurityBundle and OmnibridgeBundle binding each contract (one object through Runtime and the container, the answers of Symfony's services), a kernel without SecurityBundle that compiles without Access, Sessions and Tokens, and FileLinks; AuthTest, a kernel signing in through omniauth alone (each method, the second factor, its page and nobody else's, refusals, CSRF, throttle, remember-me, trusted device, a simulated Google, the return address on the host of each request under one container); MapTest, a kernel drawing its map through omnimap (OpenStreetMap's tiles answered here: the picture made once, a tile served as WebP and written in the public folder, the metadata, an administrator's capture and deletion with the page's tokens, a visitor refused). docker compose run --rm bare: without omniauth installed, a kernel compiles and has nothing of Auth\.

Licence

MIT since 2026-10-09; earlier versions remain published under LGPL-3.0-or-later.