Filament Wildcard Login Laravel Package

Technical Evaluation

What changed in v3.0.0: the only functional change is "Update to Filament 5" (PR #20). Everything else is Dependabot noise on GitHub Actions (fetch-metadata, actions/checkout, git-auto-commit-action). Those CI bumps carry no runtime risk; the Filament major-version jump is the entire risk surface.

Architecture fit: The package is a thin Filament authentication plugin — it extends Filament's login flow to accept wildcard/pattern-based identifiers. That is a small, well-bounded extension point rather than a framework-level commitment, which is favourable: adoption does not couple our domain code to the package. It only couples our admin panel auth path to it. Any blast radius is confined to login, but login is a tier-0 path, so "small surface" and "high consequence" both apply.

Integration feasibility: Mechanically easy — Composer install, register the plugin on the Panel provider, configure allowed patterns. The hard constraint is version lockstep: a v3.0.0 major bump almost certainly means the package no longer supports Filament 4. We cannot adopt this package unless the target application is already on Filament 5. This is an ordering problem, not a technical one.

Technical risk:

• Security (highest). Wildcard matching on an authentication identifier is inherently dangerous if patterns are ever influenced by end users. *@corp.com is a convenience; * is an account-takeover primitive. Before adoption we must confirm patterns are administrator-configured and immutable at runtime, that matching is anchored (full-string, not substring), and that it cannot interact with password-reset or impersonation flows. This package appears to be single-maintainer with a small contributor base — we are trusting a low-bus-factor project with an auth decision.
• Version coupling. A major bump tied to a framework major means our upgrade calendar is now partly dictated by a third party. Filament 5 adoption itself implies PHP/Livewire floor changes across the app, which dwarf this package in effort.
• Silent breakage. The release notes are a GitHub autogenerated changelog with no migration guide, no stated minimum PHP version, and no explicit "dropped Filament 4" statement. We are inferring the breaking change from the semver number, not from documentation.

Key questions for the maintainer / our team:

1. Is Filament 4 support dropped outright, or is there a parallel 2.x line still receiving security patches?
2. What are the minimum PHP, Laravel, and Livewire versions for v3.0.0?
3. Are wildcard patterns admin-only, and is matching anchored and case-normalised?
4. Does the package alter rate limiting, 2FA, or password-reset resolution for matched accounts?
5. What is the maintainer's support commitment and release cadence, given the single-maintainer profile?

Integration Approach

Stack fit: Only relevant if we run Filament 5 on Laravel with a PHP version meeting its floor. If we are on Filament 3 or 4 today, v3.0.0 of this package is simply not installable and the assessment is deferred, not rejected.

Migration path:

• Greenfield or already-on-Filament-5 panels: adopt v3.0.0 directly, pinned to an exact version, with a feature flag around the wildcard capability so it can be disabled without a deploy.
• Filament 4 panels: do not attempt a partial upgrade. Sequence is (1) upgrade the host app to Filament 5 and stabilise, (2) only then introduce this package. Never bundle a framework major and a new auth dependency in one release.
• Already running filament-wildcard-login v2: treat this as a required coordinated upgrade, not an optional one — staying on v2 means falling off the supported line. Budget it alongside the Filament 5 work, not after it.

Compatibility: Treat v3.0.0 as compatible with Filament 5 only. Verify the constraint in composer.json rather than trusting the release title, and confirm our lockfile resolver agrees before committing to a date.

Sequencing:

1. Read the composer.json diff between v2.0.0 and v3.0.0 to confirm the actual version constraints and any dropped support.
2. Security review of pattern-matching semantics (blocking gate).
3. Spike: install on a Filament 5 branch, exercise login success/failure/no-match/ambiguous-match cases.
4. Staging rollout with the wildcard feature disabled; enable for an internal cohort.
5. Production.

Operational Impact

Maintenance: Very low ongoing effort — the package has essentially one feature. The real cost is that our Filament major-version upgrades now have a small external dependency on the critical path. If the maintainer lags on Filament 6, we either delay our upgrade or vendor/fork the package. For a package this small, forking is a credible and cheap fallback; note that in the risk register rather than treating it as unthinkable.

Support: Single-maintainer project, community-supported, no commercial SLA. Acceptable for an admin-panel convenience; questionable if wildcard login becomes the primary auth mechanism for external users. Escalation path is "open an issue" — plan accordingly.

Scaling: Negligible runtime cost — matching happens once per login attempt. No additional infrastructure, queues, or storage. Scaling concerns are entirely about policy (how many patterns, who manages them) rather than throughput.

Failure modes:

• Over-broad pattern → unauthorised access to any matching account. Highest severity, lowest detectability. Mitigate with anchored matching, admin-only configuration, and audit logging of pattern changes.
• Dependency drift → package blocks a Filament upgrade, creating schedule pressure to rush the framework migration.
• Abandonment → no Filament 6 support; forces a fork at an inconvenient time.
• Silent auth regression → e.g. exact-match logins breaking when wildcard matching is introduced. Cover with regression tests on the standard login path.

Ramp-up: Days, not weeks. A Laravel developer familiar with Filament can integrate this in an afternoon. The time sink is the security review and the Filament 5 prerequisite — and the prerequisite is almost certainly the larger line item, likely an order of magnitude more effort than the package itself.

Recommendation: Adopt v3.0.0 conditional on (a) the host app being on Filament 5, and (b) a documented security review confirming administrator-controlled, anchored pattern matching. Pin the version exactly. Do not let this package's release cadence set our framework upgrade deadline — but do confirm the maintainer intends to track Filament 6 before we depend on it.