sylius-poppy — the customer's agent in her own account.
The Personal Agent Protocol for Sylius 2. Every channel gets /.well-known/poppy.json and an issuer of its own. An agent browses the shop, signs in to the customer account when asked to, and acts only within what was approved.
Approval in the shop, not at the agent
Sign-in goes through the shop's login page. Then the customer sees which agent asks for what, and approves. poppy:read allows reading only; poppy:write also covers the cart and the order. If the agent has no browser, she enters a code on a shop page.
My account lists every connected agent. One click disconnects it, and the agent's next request is signed out. In the admin, a list collects what agents report back, such as missing data or broken pages.
An issuer always stands for exactly one channel. An agent cannot mix up the accounts of two shops on one installation. Everything is configured under koh_poppy: scopes, lifetimes, allowed and blocked agents, rate limits. A Doctrine migration brings the tables; koh:poppy:purge removes expired entries.
Source code & documentation
Composer package
MIT · Sylius 2.2+ · PHP 8.3+
composer require koh/sylius-poppy
Built, tested and released under MIT. Available on Packagist, source on GitHub.
Built on the poppy core
MIT
The protocol itself lives in koh/poppy, the same core typo3-poppy uses. This bundle adds routes, pages, the firewall hook-up and storage for Sylius.