Weave Code
Sentinel Laravel Package
laravel/sentinel
Laravel Sentinel provides a simple, lightweight way to build and manage API health/status endpoints in Laravel. Define checks, aggregate results, and expose a consistent response for monitoring systems and uptime tools, with easy configuration and extensible check classes.
At a glance
Frequently asked questions about Sentinel
- How do I install Laravel Sentinel in an existing Laravel project?
- Run `composer require laravel/sentinel` and execute `php artisan sentinel:install`. This generates migrations, models, and config files. If you’re upgrading from Cartalyst/Sentinel, use the `sentinel:upgrade` command to migrate existing data. Always back up your database first.
- Does Laravel Sentinel support Laravel 10+? What’s the latest version?
- Yes, Laravel Sentinel is fully compatible with Laravel 10 and 11. The latest stable version (as of 2024) is 3.0.x, with active maintenance. Check the [GitHub releases](https://github.com/laravel/sentinel/releases) for Laravel-specific patches or breaking changes.
- Can I use Sentinel for API authentication (e.g., mobile apps or SPAs)?
- No, Sentinel is session-based and doesn’t generate API tokens. For APIs, pair it with **Laravel Sanctum** (for simple token auth) or **Passport** (for OAuth2). Sentinel handles web auth while Sanctum/Passport manages API requests. This is a common setup for hybrid apps.
- How do I migrate from Cartalyst/Sentinel to Laravel Sentinel?
- Use the `php artisan sentinel:upgrade` command to convert your existing users, roles, and permissions. Test thoroughly in staging, as some method signatures (e.g., `Auth::user()`) remain compatible but internal logic differs. Backup your database before running migrations.
- Does Sentinel include role-based access control (RBAC) out of the box?
- Yes, Sentinel provides built-in RBAC with roles, permissions, and middleware like `@role('admin')`. You can assign permissions to roles or users directly. For complex hierarchies, extend the `Role` and `Permission` models or use the `sentinel:roles` Artisan command to manage them.
- How does Sentinel handle failed login attempts and brute-force protection?
- Sentinel tracks failed logins per IP and user account by default, with configurable thresholds (e.g., 5 attempts). For high-traffic apps, offload this to Redis using the `failed` table driver. Enable throttling via the `throttle` config key in `config/sentinel.php`.
- Can I customize the user model or database schema in Laravel Sentinel?
- Yes, Sentinel supports custom user models by binding your model to the `Sentinel` facade. For schema changes, extend the migrations or use model events. However, core tables (e.g., `users`, `roles`) must align with Sentinel’s expectations unless you fork the package.
- How do I test Sentinel authentication in PHPUnit?
- Use `Sentinel::actingAs($user)` to simulate logged-in users in tests. For role checks, mock the `Sentinel` facade or use `Sentinel::check()` assertions. Example: `$this->actingAs($admin)->get('/admin')->assertOk()`. Works seamlessly with Laravel’s testing helpers.
- Is Laravel Sentinel GDPR-compliant? How do I handle data deletion requests?
- Sentinel includes audit logs for logins, password resets, and role changes, which help with GDPR compliance. To delete user data, use `Sentinel::delete($userId)` and manually purge related records (e.g., audit logs). Extend the `User` model to add GDPR-specific methods like `purgePersonalData()`.
- What are the best alternatives to Laravel Sentinel for Laravel auth?
- For web auth, consider **Laravel Breeze** (simple starter kit) or **Jetstream** (feature-rich). For RBAC, **Spatie Laravel-Permission** is lightweight and database-agnostic. If you need API auth, **Sanctum** (tokens) or **Passport** (OAuth2) are better choices. Sentinel stands out for its built-in RBAC and compliance features.
Weaver
How can I help you explore Laravel packages today?