# integer-net/magento2-sansec-watch

> Sansec Watch integration for Magento 2

`composer require integer-net/magento2-sansec-watch`

Canonical URL: https://packagento.com/integer-net/magento2-sansec-watch

## At a glance

- **Vendor**: integer-net (https://packagento.com/integer-net.md)
- **Latest version**: 2.0.0-beta — released 2026-06-16
- **Pricing**: Free
- **Package type**: Magento 2 module
- **Status**: active, accepting new buyers

## Installation

Packagento is licence-gated, so even free packages need a licence on a project before Composer can resolve them.

1. **Sign in or create an account** at https://packagento.com/customer/account/.

2. **Add the package to your account.** Open https://packagento.com/integer-net/magento2-sansec-watch and complete the free checkout. A licence is minted automatically.

3. **Create or pick a project, then activate the licence on it.**
   - Projects represent the Magento installs you deploy to. Manage them at https://packagento.com/projects/.
   - Activate the new licence on the project you'll deploy this package to. Activation is what generates the Composer credentials scoped to that project.

4. **Add the project credentials to your Magento codebase.**

   Grab the project's public + private key from https://packagento.com/projects/ (open the project, then its Credentials tab), and add them to `auth.json`:

   ```json
   {
     "http-basic": {
       "packagento.com": {
         "username": "ppk_live_...",
         "password": "psk_live_..."
       }
     }
   }
   ```

   Add the Packagento Composer repository to `composer.json`:

   ```json
   {
     "repositories": [
       { "type": "composer", "url": "https://packagento.com" }
     ]
   }
   ```

5. **Install and apply.**

   ```bash
   composer require integer-net/magento2-sansec-watch:*
   bin/magento setup:upgrade
   bin/magento setup:di:compile
   bin/magento cache:flush
   ```

## What it does

Sansec Watch integration for Magento 2

## README

This module allows the integration CSP rules from Sansec Watch (https://sansec.watch/) into Magento without the need for file manipulations and a re-deployment

### Setup

```shell
composer require integer-net/magento2-sansec-watch
bin/magento module:enable IntegerNet_SansecWatch
bin/magento setup:upgrade
```

### Configuration

The configuration can be found under `Stores > Configuration > IntegerNet > Sansec Watch`
Only the sansec watch project ID is needed, which can be found in the URL, if you navigate to https://sansec.watch/d/account/list and select a project
(e.g. `685769a2-38a4-4d06-a19a-67a528197f51`)

### How it works

The policies are fetched from the Sansec Watch API and saved into a database table (`integernet_sansecwatch_policies`)
When Magento collects the CSP rules, it uses the `Magento\Csp\Model\CompositePolicyCollector` class and this module adds
a collector to this class, which will read the policies from the database table and add them to the existing policies.

Once policies are fetched from Sansec Watch, the result will be hashed and further updates are only executed, if the
newly fetched policies differ from the existing ones. (This is handled via the entry `integernet_sansecwatch` in the `flag` table)

#### Full Page Cache (FPC)

After policies are updated (either by an updated list from sansec watch or by force), the FPC will be, depending on the configuration either cleared, invalidated or ignored.

### Usage

#### Backend

Directly below the configuration is a button, `Update Policies Now`, which will fetch and update the policies on demand.
This will do a forced update, where rules are updated, even if the hashes of the old and new policies match.

#### Command Line

An update can be triggered via `bin/magento integer-net:sansec-watch:update`
This will by default only update the policies if the hashes of the old and new policies doesn't match.

A dry-run is possible by adding the `--dry-run` flag, which will only fetch and output the policies, but not update the 
database table.

If an update should be force (regardless of the hashes), the `--force` flag can be added.

#### Cronjob

The policies are also fetched via the cronjob `integernet_sansecwatch_update`, which will run every hour (cron expression: `0 * * * *`)
This will also only update the database, if the hashes of the old and new policies do not match

## Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

### [1.1.1]

#### Fixed

- Use heredoc instead of nowdoc to render scripts with the SecureHtmlRenderer (prevent problems with processed templates)

### [1.1.0]

#### Added

- Added policy search in the admin configuration.
- Added sorting for the displayed policy list.
- Added a German (`de_DE`) translation for admin texts.

#### Changed

- Collapsed long policy lists by default in the admin UI.
- Hid labels for informational fields that are not editable configuration values.
- Made admin UI strings translatable.

#### Fixed

- Added an explicit empty-state message when no policies are available.

### [1.0.12] - 2025-09-23

#### Changed

- Memoized policy fetches to avoid repeated requests during a single update flow.
- Disabled inline policies by default.

### [1.0.10] - 2025-02-20

#### Fixed

- Sorted policies before calculating the change hash so identical policy sets no longer trigger incorrect update detection.

### [1.0.9] - 2025-02-14

#### Added

- Added a status indicator for the report URI configuration.

#### Changed

- Added compatibility with `symfony/http-client` 5.x.

#### Fixed

- Prevented policies from being loaded when the module is disabled.

### [1.0.7] - 2024-12-02

#### Added

- Added an admin action that links directly to the Sansec dashboard.
- Added default button styling for the dashboard shortcut.

### [1.0.6] - 2024-11-30

#### Changed

- Made the default Sansec policy fetch parameters configurable.
- Stopped enabling `strict-dynamic` by default.

### [1.0.4] - 2024-11-17

#### Fixed

- Resolved policy table names through Magento's `ResourceConnection` to improve compatibility with customized database table names.

### [1.0.3] - 2024-11-17

#### Changed

- Added compatibility with `symfony/http-client` 7.

### [1.0.2] - 2024-11-05

#### Fixed

- Added support for Magento installations that use database table prefixes.

### [1.0.1] - 2024-10-29

#### Changed

- Changed the package license to MIT.

### [1.0.0] - 2024-10-18

#### Added

- Initial release of the Magento integration for importing CSP policies from Sansec Watch.
- Added scheduled and manual policy updates, including CLI support.
- Added an admin policy list and backend timestamps for the last checks and updates.
- Added full page cache handling after policy updates.
- Added extension points for customizations.

[1.1.0]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.12...1.1.0
[1.0.12]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.11...1.0.12
[1.0.11]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.10...1.0.11
[1.0.10]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.9...1.0.10
[1.0.9]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.8...1.0.9
[1.0.8]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.7...1.0.8
[1.0.7]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.6...1.0.7
[1.0.6]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.5...1.0.6
[1.0.5]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.4...1.0.5
[1.0.4]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.3...1.0.4
[1.0.3]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.2...1.0.3
[1.0.2]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.1...1.0.2
[1.0.1]: https://github.com/integer-net/magento2-sansec-watch/compare/1.0.0...1.0.1
[1.0.0]: https://github.com/integer-net/magento2-sansec-watch/tag/1.0.0

## Recent Versions

| Version | Released |
|---|---|
| 2.0.0-beta | 2026-06-16 |
| 1.1.1 | 2026-05-11 |
| 1.1.0 | 2026-04-03 |
| 1.0.12 | 2025-09-23 |
| 1.0.11 | 2025-03-12 |
| 1.0.10 | 2025-02-20 |
| 1.0.9 | 2025-02-14 |
| 1.0.8 | 2024-12-09 |
| 1.0.7 | 2024-12-02 |
| 1.0.6 | 2024-11-30 |

Showing 10 of 16 versions. Full release history on https://packagento.com/integer-net/magento2-sansec-watch.

## Dependencies

### Require

| Package | Constraint |
|---|---|
| beberlei/assert | ^3.3 |
| cuyz/valinor | ^2.4.0 |
| magento/framework | >=100.0.0 |
| magento/module-csp | * |
| php | >=8.3.0 |
| symfony/clock | ^6.4 \|\| ^7.0 \|\| ^8.0 |
| symfony/http-client | ^5.0 \|\| ^6.0 \|\| ^7.0 \|\| ^8.0 |
| symfony/uid | ^6.2 \|\| ^7.0 \|\| ^8.0 |

### Require (dev)

| Package | Constraint |
|---|---|
| bitexpert/phpstan-magento | ^0.42.0 |
| ergebnis/composer-normalize | ^2.52 |
| php-parallel-lint/php-console-highlighter | ^1.0 |
| php-parallel-lint/php-parallel-lint | ^1.4 |
| phpstan/extension-installer | ^1.4 |
| phpstan/phpstan | ^2.2 |
| phpstan/phpstan-deprecation-rules | ^2.0 |
| phpstan/phpstan-phpunit | ^2.0 |
| phpstan/phpstan-strict-rules | ^2.0 |
| phpunit/phpunit | ^12.5 |
| rector/rector | ^2.4 |
| roave/security-advisories | dev-latest |
| symplify/easy-coding-standard | ^13.2 |

## Licence and pricing

Free. A licence is still minted on checkout and bound to your project for Composer access — no payment step.

Refundable within 14 days of first purchase via https://packagento.com/account/refunds/.

## Install via Claude Code or any MCP client

The Packagento MCP server can run the licence + project + Composer steps above in one tool call:

```
purchase_and_install_packages(
  composer_names=["integer-net/magento2-sansec-watch"],
  project_id="proj_xxx"
)
```

This handles cart, checkout, licence minting, project activation, and writes auth.json credentials. Connect a client with `claude mcp add packagento https://mcp.packagento.com`. Full setup at https://packagento.com/docs/mcp-setup.

## Vendor

integer-net is a Magento 2 vendor on Packagento. See https://packagento.com/integer-net.md for their full catalogue.