- What is Grafite Auth and what features does it include?
- Grafite Auth is a Laravel authentication package that bundles login scaffolding with role-based access control, user profiles, and admin-friendly user management. It republishes Laravel UI's auth controllers, traits, and Blade stubs into your application rather than running as a runtime library. In practice it gives you a starting point for secure logins and permissions without wiring every controller and view from scratch. It assumes a Blade view layer, session-based auth, and the stock users schema.
- Which Laravel and PHP versions does grafite/auth support?
- The package is a fork of Laravel UI, so its supported Laravel and PHP range depends entirely on the last time its composer.json was updated. Controller namespaces, RouteServiceProvider patterns, Blade component syntax, and the password_resets to password_reset_tokens migration all shifted between Laravel 8 and 11, so a fork that has not tracked those changes may fail to install or, worse, install cleanly with outdated auth code. Check the composer.json constraints against your application's actual lockfile before requiring it. Treat the published stubs as a diff you review rather than a package upgrade you trust.
- How do I install Grafite Auth in a Laravel application?
- Installation is mechanically simple: one composer require, one vendor:publish step to copy controllers, traits, and Blade stubs into your app, then a route and middleware wiring pass. Because the code is published into your application, the publish step is the moment you take ownership of it. Review every generated file line by line, especially anything touching registration, login, and password reset, before committing. Then reconcile the route table and cut over one flow at a time.
- Does Grafite Auth work with Breeze, Jetstream, or Fortify?
- It overlaps with them rather than complementing them. Laravel UI, Breeze, Fortify, and Jetstream all occupy the same scaffolding slot, and installing more than one means competing controllers, routes, and views for the same endpoints. Grafite Auth is closest in shape to Laravel UI, so it makes the most sense as a replacement rather than an addition. Pick one auth scaffold per application and remove the others.
- Is Grafite Auth a package dependency or does it copy code into my app?
- It is a copy-in scaffolding package. Once you publish the stubs, the controllers, traits, and views belong to your application and the package has no further influence over them. That is the right fit for an opinionated Laravel monolith, but it also means upstream security fixes never reach you automatically. You inherit the full patch obligation without inheriting upstream's review process.
- Does Grafite Auth include role-based access control and user management?
- Yes, that is its main differentiator over plain Laravel UI: it pairs the auth scaffolding with roles, permissions, user profiles, and admin-friendly user management screens. The trade-off is that this is an opinionated design built on the default Eloquent user model and session guard. If your application needs custom guards, multi-tenancy, or a different authorization model, expect to reshape the published code substantially.
- Does Grafite Auth handle password reset, email verification, and login throttling?
- Because it republishes Laravel UI's controllers and traits, it should inherit the flows upstream included at the time of the fork, such as password reset, email verification, and remember-me token handling. Whether login throttling, password confirmation, and two-factor authentication are present depends on the precise diff against upstream, which you should verify yourself. Treat those as open questions and audit the published controllers before relying on them. Anything missing becomes your responsibility to add.
- Can I use Grafite Auth for a SPA, API, or Inertia application?
- No, it is the wrong shape for those architectures. The package presupposes a Blade view layer, session-based auth, and the stock users schema, which constrains it to conventional Laravel applications. For API-first, SPA, or Inertia-driven projects, Sanctum, Passport, or Fortify are the natural primitives. Forcing Grafite Auth into those setups will cost more than writing the controllers directly.
- How do I migrate from laravel/ui to Grafite Auth?
- Treat it as a stub diff, not a package upgrade. Publish Grafite Auth's stubs alongside your existing Laravel UI files rather than over them, then reconcile the route table and review the output line by line before committing. Cut over one flow at a time: login, then password reset, then registration, then email verification. Keep the old route registration available behind a config flag so rollback is a one-line change instead of a revert commit.
- Is Grafite Auth actively maintained, and how do I get security fixes?
- The package shows no meaningful community footprint, so there is no issue history to mine for known breakage and no community review of the diff against upstream. Releases appear tied to the Grafite ecosystem of admin panels and CRUD generators, so confirm the maintainer model and cadence before adopting. Because the stubs are copied into your application, security fixes never arrive automatically: you must track Laravel UI and Laravel's own auth changes and port them yourself. That ongoing patch burden is the biggest hidden cost of this package.