bherila/auth-laravel
A Laravel authentication package that helps add secure user login, registration, and password reset flows to your application with minimal setup, offering customizable auth scaffolding and guard integration for faster development.
Architecture fit: v0.27.0 adds a durable, database-backed OAuth credential revocation layer for Laravel/Passport-style systems. The design fits applications that need immediate, auditable revocation of authorization codes, access tokens, and refresh tokens without relying on cache TTLs or token decryption. It is especially relevant for multi-tenant SaaS, regulated environments, incident response, forced logout, client offboarding, and compromised-credential workflows. It is less compelling for simple Laravel apps with low revocation requirements or non-Passport OAuth stacks.
Integration feasibility: Adoption is opt-in and the default remains off, which limits immediate blast radius. However, production adoption is a deliberate integration project: migrate Passport’s connection, enable oauth_server.revocation.enabled, replace revocation paths with guarded operations, wrap custom issuance decisions in duringIssue(), and coordinate rollout with issuance paused. Feasibility is medium: the package provides narrow integration points, but teams must understand transaction boundaries, legacy grant registration, and fail-closed behavior.
Technical risk: Medium overall; medium-high for high-volume or multi-node deployments. Risks include migration handling of existing grants, transaction/lock contention during token writes and revocations, old processes bypassing repository guards during rollout, and fail-closed behavior for unregistered writes or unknown owner/client grants. The release preserves same-client sibling connections and follows tracked rotations during connection revocation, which is good for correctness but increases the importance of lineage data quality. Pre-1.0 versioning also means API and migration behavior may still change.
Key questions:
duringIssue() cover all custom grant/token issuance paths used by the application?Stack fit: Best fit is a Laravel application already using Passport-compatible OAuth flows and relational persistence for tokens. The package should be treated as security infrastructure, not a drop-in utility. Teams should confirm their token issuance, refresh rotation, revocation, audit, and purge jobs all route through the guarded repositories.
Migration path: Start in a non-production environment with representative legacy grants, including refresh tokens whose access rows were purged. Run the migration, verify legacy grants are registered at sequence zero, enable oauth_server.revocation.enabled, and exercise owner-level and connection-level revocation. Include rollback rehearsal and confirm how guard data behaves after Passport purge and migration rollback. For production, treat migration and enablement as a controlled change with issuance paused.
Compatibility: Validate against the application’s exact Passport version, Laravel version, queue workers, scheduler jobs, and any custom grant types. Check that all nodes run the new repository guards before issuance resumes. Confirm database engine support and migration tooling compatibility. Audit existing OAuthCredentialOwners revocation call sites because those methods adopt the owner barrier automatically; any direct token-table revocation outside guarded operations must be identified.
Sequencing: Recommended sequence: inventory OAuth issuance/revocation paths; stage migration and rollback; implement duringIssue() wrapping for custom decisions; replace direct revocation with CredentialLineages::revokingOwner() / revokingConnection(); pause issuance; migrate; deploy guarded code to all nodes; enable config; run smoke and security tests; resume issuance; monitor fail-closed events and revocation latency. Do not enable before all issuance-capable processes are on the guarded code path.
Maintenance: Adds a durable data model and migration surface that must be maintained alongside Passport upgrades. Expect ongoing ownership for lineage tables, migration scripts, config flags, purge/rollback interactions, and documentation. Because the release is pre-1.0, pin versions and review future release notes for migration or API changes.
Support: Support teams need runbooks for owner revocation, connection revocation, incident-response revocation, fail-closed issuance errors, and rollback. Security and audit teams should understand that connection revocation follows tracked rotations while preserving same-client sibling connections. Custom grant owners must know when and how to use duringIssue().
Scaling: The design moves correctness into database transactions, which is appropriate for durable revocation but can add write pressure and lock contention on token issuance/refresh/revocation paths. Validate under peak issuance and bulk revocation. High-volume tenants, refresh-heavy clients, and incident scenarios that revoke many connections should be load-tested. The package avoids cache TTL and token decryption dependencies, simplifying some operational concerns but increasing database criticality.
Failure modes: Primary failure modes are incomplete rollout where old processes bypass guards, migration errors on legacy grants, fail-closed rejection of unregistered writes or unknown owner/client grants, lock contention during issuance, and rollback/purge interactions with guard data. A paused-issuance rollout is mandatory. Monitor blocked issuance, unknown lineage, revocation sequence growth, migration duration, and database latency. Have a rollback plan that accounts for durable guard data, not just application code.
Ramp-up: Moderate. Engineering needs OAuth/Passport fluency plus migration and transaction review. Security/operations need incident-revocation runbooks. Product/TPM should gate adoption on staged migration evidence, load-test results, rollback rehearsal, and explicit acceptance of fail-closed behavior. Leverage this release when durable revocation and auditability are product requirements; defer when the application lacks the operational capacity to manage the migration and ongoing lineage data.
How can I help you explore Laravel packages today?