Laravel Action Otp Laravel Package

Product Decisions This Supports

• Build vs. buy for authentication step-up: OTP delivery, verification, resend throttling, magic links, and session confirmation are commodity flows. This package lets the team buy the plumbing and spend engineering time on product-specific identity rules instead.
• Feature scoping for passwordless and 2FA roadmap: The v2.1.0 ActionOtp::identifyUsing() addition makes identifier selection a server-side decision for verify and resend. This supports launching OTP login by email, phone, or account ID without trusting a client-supplied field, and lets a resolver return null to answer empty without consuming a rate-limit attempt — useful for anti-enumeration and abuse-control requirements.
• Security and abuse-control decisions: Server-side identifier resolution, attempt counting semantics, and confirm-session handling are inputs to decisions about lockout thresholds, enumeration resistance, and how much session state a verification step should require.
• Integration boundary decisions: The ConfirmSession change clarifies that session confirmation is the package controllers' responsibility, not a global request concern. This informs architecture decisions about whether OTP confirmation is used only inside package routes or also as a reusable primitive in custom flows (e.g., sensitive-action confirmation, password reset, invite acceptance).
• Localization and market rollout: Updated Polish and German translations support go-to-market decisions for those locales with lower incremental effort.
• Test strategy and CI: ActionOtpFake cleanup reduces test-harness friction, supporting decisions to standardize OTP-dependent feature tests on the package's fake rather than bespoke mocks.
• Backward-compatibility planning: The ConfirmSession behavior change is a migration item for any team that verified sessions manually outside package routes; this affects release sequencing for dependent services.

When to Consider This Package

Adopt when:

• The product needs standard OTP flows (code entry, resend, magic link) in a Laravel app and does not need a bespoke identity provider.
• Identifier selection must be enforced server-side, or the product needs enumeration-resistant OTP responses (the identifyUsing() resolver returning null).
• The team wants confirmation sessions scoped to package controllers, with tests handled through ActionOtpFake.
• Target locales include Polish or German, or the team is comfortable owning remaining translations.
• OTP is an authentication or step-up mechanism, not the sole security boundary, and the team can own delivery provider configuration, rate limits, and observability.

Look elsewhere or build custom when:

• The product requires WebAuthn/passkeys, hardware tokens, or a full IdP with federation — this package is OTP-scoped.
• The workflow needs manual ConfirmSession verification outside package routes without managing SESSION_KEY; v2.1.0 shifts that responsibility to the caller, so plan for it or stay on the prior version until migrated.
• Custom delivery channels, per-tenant policy engines, or compliance controls (e.g., audited attempt logs) exceed what the package exposes.
• The team cannot accept a release with caller-visible behavior changes in a security-sensitive path within its current change-management cadence.

How to Pitch It (Stakeholders)

For executives: This package covers the standard one-time-password and magic-link flows so we can ship passwordless login and step-up verification without building and maintaining authentication plumbing. The v2.1.0 release strengthens abuse resistance by letting the server choose which identifier is verified and by making "no such account" answers not consume an attempt. It also improves localization for Polish and German. One change requires a small migration: code that confirmed sessions manually outside the package's routes must now set the session key itself.

For engineering: v2.1.0 adds ActionOtp::identifyUsing() for server-side identifier resolution on verify and resend — the request field is ignored, and a null resolver returns empty without counting an attempt. ValidOtpCode now fails validation on a blank purpose rather than throwing. otp.confirm sets the session inside package controllers (code, magic link, verify) instead of via global request() in ConfirmSession::handle(), so manual ConfirmSession verification no longer implicitly needs a session but must set ConfirmSession::SESSION_KEY explicitly. Also includes translation rewording and removal of an unused Recorder argument from ActionOtpFake. Treat the ConfirmSession change as the migration item; everything else is additive or internal.