Statamic Preference Center Laravel Package

Product Decisions This Supports

• Whether to offer self-serve preference management, not just unsubscribe. The package gives contacts a signed-link route into their own preferences (notifications, suppression list, sequences) without accounts or a login flow. That is a roadmap decision about consent UX: one-click unsubscribe vs. a real preference center that reduces list churn and complaint rates.
• Build vs. buy for consent plumbing. The security-sensitive parts are already engineered: signed magic links with configurable lifetime and post-link session, a response-time floor that prevents timing-based enumeration of your list, and per-address plus per-origin throttling. Building this in-house means re-deriving those controls, and the release notes make clear how easy it is to get wrong — "to unknown addresses" on is an open mail sender, and a fast response for unknown addresses leaks who is on the list.
• Operational ownership as a launch gate. Until v1.8.0 every value lived in .env, which meant marketing operations could not tune link lifetime, throttling, sender identity, or visible blocks without a deploy and an engineer. The new Settings → Addon Settings section moves 15 values into the Control Panel, which is the difference between "compliance can sign off" and "compliance is blocked on a config PR." Treat this as the release that makes the addon operable by non-engineers.
• Risk posture decisions, with defaults you should keep. The unknown-address switch defaults off and should stay off; the response-time floor is a security control, not polish; the second throttling counter (per origin) is what stops the endpoint being used to mail a list that is not the sender's. These are policy decisions a PM can now own visibly rather than inherit from a .env file.
• Auditability and reporting. The audit-trail toggle reports applied changes to LeadHub, which supports "who changed consent settings, and when" questions in a compliance review — but note audit.log_channel is deliberately not exposed, because a typo in a free-text log channel means an audit trail writing nowhere.
• Scoping discipline as a product signal. The release intentionally withholds routes.enabled, routes.prefix, routes.middleware, and the marketing block switch, because they are read at route-registration time — exposing them would produce half-effective settings that change nothing until the next deploy. That is the right call and worth citing when stakeholders ask why "everything" isn't in the UI.

When to Consider This Package

Consider it when:

• You are on Statamic and already run LeadHub and/or goldnead/statamic-brand-context; the package is designed to sit inside that stack rather than stand alone.
• You need a preference center with signed-link access rather than account-based login — typical for B2C lists, newsletter audiences, and any list where forcing a password kills conversion.
• You want config-as-code with operator overrides: only the deviation is stored, everything else keeps following config/preference-center.php. That is a good fit for teams that want reviewable defaults plus a UI for the handful of values that genuinely change per brand.
• You care about enumeration and abuse resistance and would otherwise be specifying throttling, timing floors, and sender fallbacks from scratch.
• You can absorb the dependency floor: goldnead/statamic-brand-context 1.13+. Up to 1.12, on single-brand installs, settings from addons registered last never reached config, and a second save of the same section silently deleted the first save's override.

Look elsewhere when:

• You are not on Statamic, or you need a consent engine that owns the whole lifecycle (capture, proof of consent, retention, DSAR) rather than the preference surface of it.
• You need runtime toggling of route enablement or the marketing block. Those are registration-time decisions and are deliberately not on the page — if your operating model requires flipping them without a deploy, this is a genuine gap, not a bug.
• You need multi-tenant brand modelling beyond what brand-context provides, or per-tenant mail-provider protocol tuning (delivery.mail_headers, delivery.ignored_query_parameters are intentionally out of the UI).
• You have no LeadHub and no interest in the audit trail; you would be carrying the dependency without using the reporting half.
• You cannot resource a post-upgrade verification pass: anyone who set values before this release should confirm they survived, given the brand-context fix.

How to Pitch It (Stakeholders)

For executives: This release converts an engineering-only addon into something marketing operations can run. Fifteen previously hard-coded values — link lifetime, session length, throttling, sender identity, which blocks appear on the page, audit reporting — are now in the Control Panel behind a new manage preference-center settings permission. No new screen to build or maintain, no new surface area: the package still has only its four public routes. The upside is autonomy and compliance readiness; the cost is a dependency bump to goldnead/statamic-brand-context 1.13+ and a one-time check that previously saved values survived.

For engineering: Settings store only the deviation; the defaults stay in config/preference-center.php. The permission ships unassigned — nobody sees the section until a role is granted it, so the rollout is opt-in by design. Registration-time settings are excluded on purpose, and the group descriptions say so, so operators are not offered switches that would take effect only after the next deploy. The remaining fix is contributor-only: the lint baseline recorded an env() occurrence count instead of naming a cause, so it went red on every addition; it now uses the rule's config-path parameter and the baseline entry disappears. No installation impact.

The one-line version: the security-critical parts of a preference center — signed links, throttling, enumeration resistance — are already built and now tunable by the people who own the list, without giving them a way to turn the endpoint into an open mail relay.