Events

All identity events live under Derafu\PlatformBundle\Identity\Event\ and extend Symfony\Contracts\EventDispatcher\Event. The bundle dispatches them after successful operations — subscribe to them to send emails, log activity, seed data, or trigger side effects.

Subscribing

use Derafu\PlatformBundle\Identity\Event\UserRegistered;
use Symfony\Component\EventDispatcher\Attribute\AsEventListener;

#[AsEventListener]
class SendConfirmationEmail
{
    public function __invoke(UserRegistered $event): void
    {
        $user = $event->user;
        $token = $event->verificationTokenPlaintext;

        // Build URL and send email...
    }
}

User lifecycle events

Note on PasswordResetRequested and MagicLinkRequested: not dispatched when the email does not belong to any user — this is intentional to avoid leaking account existence.

Note on UserEmailChanged: carries the oldEmail so a listener can notify the old address (“if this wasn’t you, contact support”).

Organization events

Note on OrganizationMemberRemoved: the membership entity is already deleted when listeners run — the event carries organization and user separately.

Invitation events

Note on InvitationCreated: the plaintextToken is the only chance to build the accept URL. Once the request ends, only the hash in the database survives.

Team events

Events that carry plaintext tokens

These events expose a plaintext token that must not be logged or persisted. They exist solely so the app’s mailer can build a URL and send it:

• UserRegistered.verificationTokenPlaintext
• PasswordResetRequested.verificationTokenPlaintext
• EmailChangeRequested.verificationTokenPlaintext
• MagicLinkRequested.plaintextToken
• InvitationCreated.plaintextToken