- What is jc5/recovery used for in a Laravel application?
- jc5/recovery is described as a Laravel package for creating recovery or backup codes for two-factor authentication. These codes give users a fallback when their usual 2FA device or app is unavailable. Confirm the package README for the exact API and integration points before adding it to a project.
- Is jc5/recovery for 2FA recovery codes or for restoring soft-deleted records?
- The package description says it creates recovery and backup codes for 2FA, while the supplied blurb mentions recovering soft-deleted Eloquent records. Those are different use cases, so verify the actual README and source before installing. Treat the 2FA recovery-code purpose as primary only after confirming the package metadata on Packagist or the repository.
- How do I install jc5/recovery in a Laravel app?
- Install it with Composer using the package name jc5/recovery, for example composer require jc5/recovery. Then follow the README for any service provider registration, config publishing, or migrations; Laravel package auto-discovery may handle some steps. The provided README excerpt is empty, so verify the exact commands on Packagist or the repository.
- How do I configure the number and length of recovery codes?
- The package is described as configurable, but the supplied context does not list specific configuration keys. Look for a published config file or documented options controlling code count, length, expiry, and regeneration behavior. Test the defaults in a non-production environment before relying on them.
- Which Laravel and PHP versions does jc5/recovery support?
- The context does not state supported Laravel or PHP versions. Check the package's composer.json on Packagist for illuminate/support and php constraints, and compare them with your application's locked versions. If the constraints are missing or outdated, test thoroughly or choose an actively maintained alternative.
- How are recovery codes generated and stored by jc5/recovery?
- For any 2FA recovery-code package, codes should be generated with a cryptographically secure random source, shown to the user once, and stored hashed rather than in plaintext. The provided README excerpt does not confirm jc5/recovery's storage approach, so review its migrations and model code. Also confirm that each code is single-use and invalidated after successful use.
- How should I test 2FA recovery code flows with jc5/recovery?
- Use Laravel's HTTP and database testing helpers to simulate enabling 2FA, generating codes, and consuming a recovery code. Assert that a valid code authenticates once, that reused codes fail, and that invalid codes are rejected. Because the README excerpt is empty, inspect the package's routes, events, and service provider to know what to fake or bind.
- Does jc5/recovery integrate with existing Laravel 2FA packages?
- The context only says the package creates recovery and backup codes for 2FA; it does not name supported 2FA packages or integration contracts. Check the README and source for traits, contracts, or events you can wire into your existing authentication flow. If there is no documented integration, treat it as a standalone code generator and build the verification logic yourself.
- What production concerns should I check before using jc5/recovery?
- Treat recovery codes as sensitive credentials: serve them only over HTTPS, display them once, hash them at rest, and rate-limit verification attempts. Add audit logging for code generation and use, and provide a clear regeneration flow that invalidates old codes. Also plan for user support cases where codes are lost or exhausted.
- What alternatives to jc5/recovery should I consider, and is it maintained?
- Alternatives include Laravel Fortify's built-in recovery codes, established 2FA packages that ship backup codes, or a small custom implementation using hashed single-use codes. For maintenance, check the jc5/recovery repository and Packagist release history for recent commits, Laravel version constraints, open issues, and security advisories. Because the repository is listed as unknown here, verify maintenance activity before adopting it in production.