Nova Idle Laravel Package

Getting Started

Install into a Laravel 10/11 app running Nova 4:

composer require eom-plus/nova-idle
php artisan vendor:publish --tag=nova-idle-config   # verify tag name in the package README

Open config/nova-idle.php first — this is the only place behavior is decided. Expect (and confirm against the actual file) three knobs that matter:

• enabled / timeout — the idle threshold in seconds or minutes.
• warning / countdown — how long the "you will be logged out" notice is shown before the redirect.
• redirect — where the user lands after auto-logout (usually nova.login).

Then check app/Providers/NovaServiceProvider.php and config/nova.php to confirm the package's middleware and script are actually registered — small packages sometimes rely on auto-discovery only for the service provider, not the Nova asset. If the warning modal never appears, that is almost always the missing Nova::script() call or a stale public/vendor build.

The first real use case: shared admin workstations and long-lived browser tabs. Set timeout to 15 minutes and warning to 60 seconds, and you immediately satisfy the "analyst walked away from a logged-in Nova panel" problem without touching your own auth code.

Implementation Patterns

Two-layer timing. Treat the package as a client-side idle detector that triggers a server-side logout. Keep config/session.php lifetime greater than timeout + warning so the browser timer is always the thing that fires first, not Laravel's own session expiry. A user should never see a raw 419 page instead of the friendly notice.

Per-environment config. Keep the package disabled in local (NOVA_IDLE_ENABLED=false) — a auto-logout during debugging wastes hours. Enable it in staging so QA can verify the modal, then in production.

Pair it with Nova's guard. Nova typically authenticates against the web guard, so the logout redirect should point at nova.login, not your app's login. If you run Nova behind a custom guard or an SSO proxy, confirm the package posts to the right logout route; you may need to override the redirect in config.

Exempt system accounts. If you have a monitoring bot or a dashboard-only Nova user, gate the middleware by user. The cleanest integration is a small middleware wrapper in app/Http/Middleware that checks Auth::user()->is_service_account and skips the package's handler, rather than editing vendor code.

Testing it. Do not try to wait out a real 15-minute timeout. Drop timeout to 30 seconds and warning to 5 in a feature-test config, or use Carbon::setTestNow() if the package exposes a server-side idle check. For the JS side, a single Dusk test that loads a Nova page, waits, and asserts the redirect is worth the setup cost.

Customize the notice. Publish the package views (php artisan vendor:publish --tag=nova-idle-views) and restyle the modal to match your Nova theme. Keep the countdown element's id/class intact or the JS that updates it will silently break.

Gotchas and Tips

• Background tab throttling. Browsers throttle setInterval in inactive tabs, so a tab left in the background may fire the logout well past the configured time — or, worse, the warning appears with a countdown that jumps. Test with the tab focused and unfocused.
• Multi-tab drift. Each tab runs its own timer. Activity in tab A generally does not reset tab B unless the package uses localStorage or a BroadcastChannel. If your users keep several Nova tabs open (common with dashboards), expect staggered logouts.
• Config cache. After editing config/nova-idle.php, run php artisan config:cache (and re-run after deploys). A cached config silently ignores your timeout change and you will spend an hour blaming the JS.
• Asset publishing. If the modal CSS/JS 404s, re-run php artisan nova:publish and check public/vendor/eom-plus/nova-idle. Nova 4's asset pipeline is picky about Nova::script vs Nova::style ordering.
• CSRF on logout. If the package POSTs to /logout, a stale page will fail the token check and leave the user appearing logged out while the session persists. Verify the actual logout by hitting a protected Nova route afterwards.
• Accessibility. A warning modal that steals focus but has no role="alertdialog" or escape handling is a support ticket waiting to happen; add ARIA attributes when you customize the view.
• Scope. This only covers pages Nova renders. Horizon, Telescope, and your own app routes are unaffected — if "idle logout everywhere" is the requirement, this package is one piece, not the answer.
• Low maintenance signal. One star and a single 2024 release means you should read the source (it is small) before relying on it, and pin the version in composer.json. Budget for forking the JS if Nova 5 changes the asset API.