Weave Code
Auth Laravel Package
delight-im/auth
delight-im/auth is a framework-agnostic PHP authentication library with a simple API. It handles registration, login, email verification, password resets, sessions, cookies, roles, and social login, with no complex setup required.
Authentication for PHP. Simple, lightweight and secure.
Frequently asked questions about Auth
- Is delight-im/auth a Laravel package?
- No. delight-im/auth is a framework-agnostic PHP authentication library, not a Laravel package. It ships plain classes that use PDO and superglobals, with no service provider, facade, config file, or Eloquent model. Adopting it in Laravel means writing and owning an adapter layer yourself.
- How do I install delight-im/auth in a Laravel application?
- Install it with Composer, import the bundled SQL schema for users, users_confirmations, users_remembered, and users_throttling, and point its Database class at Laravel's PDO connection. Then wrap the Auth class in a singleton binding and add controller routes for registration, login, verification, and password reset. Expect to write the service provider, configuration, and mailer glue yourself.
- Does delight-im/auth support Laravel 10 and Laravel 11?
- There is no official Laravel version support matrix because this is not a Laravel package. Laravel 10 and 11 can load it through Composer, but the framework contract is your responsibility. You must verify PHP 8.2 and 8.3 behavior and maintain the adapter as Laravel evolves.
- Can I use delight-im/auth with an existing Laravel users table?
- Not cleanly. The library assumes it controls the user table and its own column names, so it conflicts with an existing Laravel users table or table-prefix conventions. You can isolate it in separate tables or fork and adapt the queries, but both options increase ownership cost. Plan the data migration and hash portability path before committing.
- Does delight-im/auth support MFA, OAuth/SSO, passkeys, or API tokens?
- No. delight-im/auth provides registration, login, email verification, password resets, remember-me cookies, roles, throttling, and social login, but it has no built-in MFA/TOTP, OAuth/SSO, passkeys, scoped API tokens, audit log, or multi-tenancy model. Each of those is a future build rather than a config flag. If your roadmap needs them, the total cost of ownership rises sharply.
- How do I replace PHP mail() in delight-im/auth with Laravel's mailer?
- The library defaults to PHP's mail() function, which is not suitable for production deliverability or queueing. You need to override its Mailer class with an adapter that sends through Laravel's Mail facade or queue. Treat that override as mandatory, not optional.
- Is delight-im/auth safe for production and who owns security patching?
- The library includes throttling, timing-safe comparison, and reset-token handling, but it has no security advisory feed, CVE process, or disclosure channel. It is a single-maintainer project with low release cadence and negligible downstream ecosystem validation. In practice your team becomes the de facto security owner, so define an SLA and a fork-in-place plan before adoption.
- How testable is delight-im/auth in a Laravel test suite?
- Testing is awkward because the monolithic Auth class reads request context from superglobals such as $_POST and $_SERVER. There is no PSR-3 or PSR-7 compliance to mock against cleanly, so expect integration-level coverage at best. You can improve isolation by wrapping calls behind your own request-aware adapter, but you still inherit global-state coupling.
- Does delight-im/auth work with PHP 8.2 and PHP 8.3?
- Support is not guaranteed and must be verified explicitly. The library predates current PHP releases, so PHP 8.2 and 8.3 deprecations around nullability, dynamic properties, and strict signatures need testing. Treat that revalidation as a recurring maintenance tax, not a one-time check.
- What are the best alternatives to delight-im/auth for Laravel authentication?
- For a Laravel application, the lower-risk defaults are Laravel's native auth stack plus Breeze, Fortify, or Jetstream depending on whether you need scaffolding, headless/API auth, or a full suite. delight-im/auth is better reserved for plain-PHP, Slim, legacy, or short-lived internal services where speed matters more than longevity. If you need MFA, SSO, passkeys, or multi-tenant identity, choose a maintained first-party or dedicated identity platform instead.
Weaver
How can I help you explore Laravel packages today?