Filament Lockscreen Laravel Package

Product Decisions This Supports

Feature-level:

• Adds a "lock session" affordance to Filament admin panels — the session stays warm, the user re-authenticates to resume. Lowers shoulder-surfing and walk-away exposure in shared or open-plan offices without the friction of a full logout/re-login cycle.
• Supports the "I'm stepping away for 5 minutes" workflow explicitly called out in the package description — this is an adoption/retention nicety for internal tools, not a headline feature.
• v3.4.1 is a maintenance/dependency release: no new capabilities, no API changes, no deprecations. It does not change scope, so it doesn't open new product use cases — but it does resolve a real UX defect class (premature locking) that would otherwise have shown up as support tickets.

Roadmap & compliance:

• Frequently appears as a line item in security questionnaires and vendor reviews (session locking / automatic logoff, e.g. HIPAA §164.312(a)(2)(iii), SOC 2 CC6 logical access, PCI DSS 8.x session controls). Useful as a compensating convenience control — not a substitute for enforced idle timeout, MFA, or MDM.
• Cheap roadmap checkbox: if the admin panel is already on Filament, this closes a "nice to have" gap in roughly a day of engineering rather than a sprint.
• The idle-management refactor in v3.4.1 is a signal that timer behavior is the historically fragile part of this plugin — plan for a configurable idle threshold in your rollout rather than hardcoding a default, since users will complain in both directions (too eager / too lax).

Build vs. buy:

• This is a small, single-purpose plugin on an MIT license. The realistic decision is adopt vs. vendor vs. rebuild — not adopt vs. enterprise vendor. Rebuilding the lock UI, timer, and password-confirm re-entry flow is a day or two; adopting is hours.
• The v3.4.1 patch is evidence the maintainer is still shipping and responding to behavioral bugs, not just letting dependabot run. That mildly strengthens the "adopt" case, but 62 stars / 0 dependents / single maintainer still means: treat it as vendored code you own, and budget a fork on day one. Two of three PRs in this release are CI dependency bumps, which is a reminder that the maintenance bandwidth is thin.

Use cases that justify it:

• Shared back-office terminals, warehouse/retail kiosk panels, agency multi-tenant admin where staff rotate desks, field ops on tablets.
• Sales demos: "inactivity lock" reads as security maturity to buyers evaluating internal tooling.

When to Consider This Package

Adopt when:

• You are already on Filament (v3/v4) and the admin panel is internal — dependency fit is the value proposition here; nothing transfers off-Filament.
• The failure mode is acceptable: worst case, a user unlocks with a password or re-logs in. No data path, no PII, no money movement.
• You want day-one parity and have the appetite to pin the version and fork if it drifts from Filament's major release cadence.
• Release recency (v3.4.1) is a positive maintenance signal — one patch release beyond v3.4, with a behavioral fix rather than pure dependency churn. Still verify the compatibility matrix against your exact Filament and PHP versions before committing.

Look elsewhere when:

• You are not on Filament. Use a plain middleware + session lock, or lean on your IdP's idle-timeout policy.
• Compliance is the driver. A lock screen does not satisfy "automatic logoff" audit controls on its own; don't let it check a box in a security review and think you're done.
• You need a support contract, SLA, security review artifacts, or a named maintainer — 62 stars and 0 dependents is bus-factor 1.
• You need real customization: multi-user kiosk handoff, PIN policy, audit logging of lock/unlock events, or lock-state telemetry. You'll fork it, so price in ongoing ownership.
• Your Filament version churns aggressively and you can't absorb a plugin lagging a major release.

Migration notes for v3.4.1: No breaking changes, no config or database changes documented — a drop-in patch from v3.4. The only behavioral delta is the idle-locking refactor, so re-validate your configured idle threshold after upgrading rather than assuming prior timing holds.

How to Pitch It (Stakeholders)

For executives: This is a low-cost, low-risk addition to our existing admin tool that makes shared-workstation use safer without adding login friction. It maps to a commonly requested security line item (session lock / automatic logoff) and takes about a day to evaluate and ship. Cost: MIT, no vendor fee. Risk: single maintainer with modest adoption — so we treat it as vendorable code we own, not a strategic dependency. The latest patch (v3.4.1) shows the maintainer is still fixing real behavior, not just bumping CI dependencies, which is a mild positive — but it's a patch, not a roadmap commitment. Recommendation: adopt as a convenience control, do not represent it as a compliance guarantee.

For engineering: Filament plugin, MIT, actively released (v3.4.1, patch). Adds a lock screen that preserves the session and requires re-authentication to unlock — no session teardown, no logout. Small surface area. v3.4.1 contains two CI dependency bumps and one behavioral change to session idle management ("prevent premature locking") — treat the idle timer as the known-weak spot. Before merging: pin the version, confirm compatibility with our Filament major and PHP runtime, and add a smoke test around the lock/unlock path (including the "locked in one tab, active in another" edge case and an idle-timing assertion that locking fires after — not before — the configured threshold). If it falls behind Filament releases, forking is a day's work — plan for that rather than assuming upstream will track it.