Laravel Auth Laravel Package

Getting Started

claudiodekker/laravel-auth is an authentication scaffold package, split into two installable pieces as of v0.2.0:

• Core (claudiodekker/laravel-auth-core) — the runtime auth layer (routes, controllers, guards, translations).
• Bladebones (claudiodekker/laravel-auth / -bladebones) — a Blade-based scaffolding generator, in the same spirit as Breeze/Jetstream.

First steps for a fresh install:

1. Require the metapackage or the core directly:

   composer require claudiodekker/laravel-auth
   

2. Run the scaffolding generator (if using Bladebones) to publish auth views, routes, and config into your app rather than relying on vendor overrides.
3. Publish config and translations:

   php artisan vendor:publish --tag=auth-config
   php artisan vendor:publish --tag=auth-lang
   

4. Verify your environment against php -v (needs 8.2 for this release line) and composer show laravel/framework (Laravel 10 target).

First use case: stand up a working login/registration/password-reset flow with Blade views you own and can edit, then layer your own authorization (policies, gates) on top. Do not treat this as a full authorization system — it's authentication + scaffolding.

Implementation Patterns

Generate once, own the output. Bladebones is a generator, not a runtime package. Treat its output like Breeze's: commit the generated controllers/views/routes into your app and modify them freely. Re-running the generator should be a deliberate act on a clean branch, not part of your deployment pipeline.

Separate core from UI. Because Core and Bladebones are now split (and Bladebones depends on laravel-auth-core, not the metapackage), you can swap the UI layer. If you want Inertia, Livewire, or your own frontend, install Core and build the views yourself — the routes/controllers stay consistent.

Integrate with existing user models. Point the package at your App\Models\User via config before generating, so scaffolded controllers and views reference the right model and guard. If you already have auth, generate on a throwaway branch and cherry-pick the pieces you need instead of overwriting.

Translations as a contract. Core now tests against translation keys rather than string matches (per #23). This means you can safely override auth.php / package lang files and expect behavior not to break — a good reason to keep your own translations published and under version control.

Version-pinning across the monorepo. Since the two packages moved into a single monorepo, keep Core and Bladebones on the same minor version to avoid subtle drift. In composer.json, prefer "claudiodekker/laravel-auth": "^0.2" rather than dev-main.

Gotchas and Tips

• v0.2.0 is where Laravel 10 / PHP 8.2 support lands. If you're on those, this is the release you need; anything earlier will fight you on framework constraints. Conversely, if you're stuck on Laravel 9, stay on 0.1.x.
• Breaking-ish move into the monorepo. Package names changed: Bladebones now depends on claudiodekker/laravel-auth-core rather than claudiodekker/laravel-auth. If you had claudiodekker/laravel-auth-bladebones pinned at ^0.1, that constraint and its transitive dependency will need updating. Check composer why claudiodekker/laravel-auth-core after upgrading.
• composer.lock drift. After upgrading, run composer update claudiodekker/laravel-auth claudiodekker/laravel-auth-core --with-dependencies and inspect the diff — the dependency rename is the most likely source of duplicate installs or autoload conflicts.
• Generator styling changed (Pint). If you previously committed generated files, re-running the generator post-upgrade will produce a large cosmetic diff. Either accept it wholesale in one commit or skip re-generation and only adopt the runtime changes from Core.
• Timing-related regression fixed in Core (#23). If your tests were flaky around auth flows (session expiry, signed URL TTLs, remember-me), re-run your suite after upgrading — the fix may let you remove defensive sleep()s or test workarounds.
• Debugging auth failures: start with php artisan route:list --name=auth to confirm the package routes are registered. If routes are missing, the service provider likely isn't auto-discovered (check bootstrap/cache/packages.php or run php artisan package:discover).
• Extension points: config file (guards, password rules, throttling), published translations, and the generated controllers are your stable seams. Avoid editing anything under vendor/ for auth logic — the monorepo reshuffle is exactly the kind of change that would bite you.
• Pre-1.0 churn. At v0.2.x, expect more structural changes like the monorepo move. Pin minor versions and read each changelog's Changed section before upgrading in production.