Nova Idle Laravel Package

Product Decisions This Supports

• Session-timeout policy: platform capability vs. per-app patch. Idle logout is a cross-cutting concern. This package forces the question of whether timeout enforcement belongs in the Laravel session config (lifetime, expire_on_close), the identity provider (Okta/Entra session policy), or in each Nova panel. Deciding this once prevents four teams from solving it four ways.
• Compliance roadmap sequencing. Automatic logoff is an explicit control in HIPAA §164.312(a)(2)(iii), PCI DSS 8.1.8 (≤15 min idle), SOC 2 CC6.1, and ISO 27001 A.9.4.2. If an audit or enterprise security questionnaire is on the roadmap, this is a named line item you can close in days rather than a quarter — if you build it rather than depend on it.
• The warning-window UX tradeoff. A hard cutoff and a "you'll be logged out in 60s — stay signed in?" modal are different products. The warning window protects long-form data entry (a support agent mid-ticket, a finance user mid-reconciliation) at the cost of a bypass path auditors may question. This package's notice-then-logout flow is the more defensible default for regulated tenants; decide deliberately, not by accident.
• Build vs. buy: buy is not on the table here. One star, zero dependents, a single release in Nov 2024, no observable maintainer bench. The feature surface is a Vue countdown component plus a handful of Nova middleware/routes — roughly 1–2 engineer-days. Recommendation: build it in-house using this repo as a reference implementation and spec, and keep your auth path free of an unmaintained third-party dependency.
• Use-case triage. The value concentrates in shared-workstation and regulated contexts: clinic front desks, call centers, kiosk/shift-based admin panels, tenant admins handling PII. For a single-operator internal dashboard behind SSO, this is over-engineering — the IdP already handles it.
• Roadmap spillover to scope explicitly. Multi-tab behavior (does closing one tab log out the others?), interaction with "remember me," whether API tokens expire on the same clock, and parity for any Inertia/SPA surfaces outside Nova. None of these are addressed by a package this size; all of them will be asked about in the security review.

When to Consider This Package

Consider it as a reference (not a dependency) when:

• You run Laravel Nova 4 specifically — the package is pinned to Nova 4's Inertia/Vue front end and will not port cleanly to Nova 3 or 5.
• You have a compliance deadline in the next one to two quarters and want a working behavior model — the notice copy, countdown cadence, and event flow — to hand to engineering as an acceptance spec.
• Your team is small and Nova-fluent, so reading ~a few hundred lines of Vue + PHP to lift the pattern costs hours, not a sprint.
• The panel is internal-facing and a brief lockout regression is survivable.

Look elsewhere — likely the right call — when:

• Your threat model is real. This sits in the authentication path, your highest-trust code. A one-maintainer, zero-dependent package has no security-response path; a CVE in a transitive dependency or a Nova minor release will not be patched on your schedule. Fork it and own it, or write it.
• You need vendor assurance. Zero dependents means zero field validation — no evidence anyone has run this in production under load, no issue history to read for failure modes.
• Session enforcement is genuinely an IdP concern (SSO-mandated orgs) — duplicating it in-app creates two sources of truth and a confusing double-logout experience.
• You're not on Nova, or you've already invested in a custom admin surface.
• You need more than idle logout — concurrent-session limits, device revocation, step-up auth. Laravel's Auth::logoutOtherDevices() plus session config covers much of this natively.

How to Pitch It (Stakeholders)

To executives / the security steering committee:

Automatic logoff is a control our auditors and enterprise buyers will ask about by name — HIPAA, PCI, SOC 2, ISO 27001 all reference it. We can close it for roughly two engineer-days of work. There's a small open-source Nova package that demonstrates the exact behavior and we're using it as our design spec, but we are not taking it as a dependency: it's a single-maintainer project with one star and no downstream users, and it would sit directly in our authentication path. We get the compliance checkbox without the supply-chain risk.

To engineering:

Here's a Nova 4 package that implements idle detection, a warning modal, and auto-logout. Read it, don't require it — treat it as the spec. Deliverable: a Vue countdown component, a configurable idle threshold and warning window per panel, server-side session invalidation that can't be bypassed by a client-side timer, and defined behavior across multiple tabs. Ship behind a config flag so tenants can set their own threshold.

To customer-facing / support leads:

Admins will see a warning before any forced logout, with an option to extend their session — so nobody loses a half-written record without notice. Threshold will be configurable, defaulting to the strictest value our largest regulated customer requires.

The one-line version: worth two days of our time as a blueprint; not worth a permanent dependency in the auth path.