- How do I install and register Filament Lockscreen in a Laravel Filament panel?
- Install it with composer require marjose123/filament-lockscreen, then register the plugin in your target PanelProvider using ->plugin(LockscreenPlugin::make()). Check the README for whether a vendor:publish step is required for config or assets, because unpublished Filament assets after a deploy are a classic silent-failure mode. Pin an exact minor version rather than a caret constraint until you have verified it against your pinned Filament major.
- Which Filament and Laravel versions does marjose123/filament-lockscreen support?
- Filament plugin contracts and the asset pipeline changed between v3 and v4, and this package has a narrow tested matrix, so confirm the composer.json constraint against your pinned Filament major before committing. The package has roughly 62 stars and no dependents, and there is no published CI matrix proving support across Laravel and Filament versions. Test on your exact Laravel and Filament combination in a staging panel first.
- Is the lock screen enforced server-side or is it just a client-side overlay?
- This is the most important thing to verify: if the lock is only an Alpine modal, a crafted request can reach panel routes and bypass it entirely. Confirm there is a middleware or interceptor blocking panel routes and check where it sits relative to Authenticate and the panel authMiddleware. Treat the feature as a presence control, not an authentication control, until you have a request test proving enforcement.
- Can Filament Lockscreen auto-lock the panel after a period of inactivity?
- The package is described as supporting both manual locking and auto-lock after a period of inactivity, but confirm the config keys and defaults in the repo before relying on it. Auto-lock is session-scoped and is not a substitute for Laravel session.lifetime or password.confirm-based idle policy. For compliance purposes keep the real idle-timeout control separate and document this as convenience UX.
- Does unlocking require the current password, and are failed unlock attempts rate limited?
- The unlock form is effectively a password oracle attached to a live session, so failed attempts should be throttled. Confirm in the source whether throttling exists and, if it does not, add a RateLimiter to the unlock endpoint or Livewire action. Also verify the form requires the current password rather than accepting a cached or stale credential.
- Does the plugin work with multiple Filament panels, multiple guards, or non-Eloquent auth?
- Register the plugin per panel rather than globally, and start with an internal or admin panel rather than a customer-facing one. Plugins that assume a single guard or Eloquent-backed users can misbehave with multi-guard, multi-panel, or non-Eloquent auth, so test against your exact guard configuration. Also confirm the lock state is scoped to the correct panel session.
- Does Filament Lockscreen store lock state in the database or only in the session?
- Verify whether lock state lives only in the Laravel session or is persisted to a table, because a table means you inherit a migration and potentially a write on each request. Session-only state does not survive session regeneration, so test what happens on login, logout, and session rotation. The intended design is a user-initiated flag that gates panel routes without destroying the authenticated session.
- How does the lock screen behave with Filament SPA mode, impersonation, and remember me sessions?
- Filament SPA mode, impersonation via impersonate(), and remember-me sessions all change how the panel and the underlying session behave, and these edge cases are not widely proven for a low-adoption package. Write explicit tests for each if you use them. If it breaks under impersonation, avoid locking during impersonation sessions or gate the feature off.
- Is marjose123/filament-lockscreen production ready and actively maintained?
- The dominant risk is adoption rather than technology: one maintainer, near-zero dependents, and no downstream production signal means you would be among the first to find edge-case defects. Pin an exact minor version, review release cadence and issue responsiveness over the last 12 months, and keep a rollback plan since the integration is additive and reversible. Alternatives are a custom Livewire lock screen or Laravel's built-in password confirmation, which are better supported but less polished.
- How do I customize the lock screen UI and translations and test it in my Filament test suite?
- Check the README for published views, config, and language files, plus any theming or override hooks that let the unlock screen match your design system. If i18n coverage is missing for your locales, publish and override the translation files. Because public documentation and tests are limited, add your own feature tests asserting that locked sessions are redirected and that a correct password unlocks the panel.