Thanks for the detailed reply. I'll definitely check this out. What type(s) of projects have you created that use this?
almost any project which matures to requiring a user authn/authz (and there are always assets owned by users) i default to using daptin
I have hardened it a lot over the last 10 years, especially in terms of transaction/concurrency/security. happy to help you setting it up in your project. you can dm me ( x.com/phparth ) or leave an issue on the github repo