- What is mpociot/cockpit used for in a Laravel application?
- Cockpit is a self-hosted developer dashboard and config-driven CRUD scaffold for Laravel back-offices. You declare an Eloquent model and fields once, and it generates list, create, edit, and delete screens over a browser UI and JSON API. It is positioned for local development, staging, and internal tools where trusted operators browse or edit a handful of tables.
- How do I install mpociot/cockpit with Composer?
- Run composer require mpociot/cockpit in an existing Laravel app; package auto-discovery registers the service provider. Publish the package config with vendor:publish and set the route prefix and middleware. Then register a low-risk model and verify a listing and edit form render behind your own guard.
- Which Laravel and PHP versions does mpociot/cockpit support?
- The provided context does not list explicit Laravel or PHP version constraints for Cockpit. The evaluation warns that composer.json constraints may top out below your framework version. Run composer why-not mpociot/cockpit against your locked app before committing, and treat pinning or backporting as a real cost.
- Is mpociot/cockpit safe for production admin panels?
- It is prototype-grade and should be treated as a scoped accelerator, not a platform component. Production use is only defensible for trusted operators, non-regulated screens, and a small set of model-centric CRUD views. For per-tenant isolation, SSO, granular roles, or auditable authorization, fit is poor.
- How does Cockpit handle authentication and authorization?
- Cockpit reuses your Laravel guards and middleware, but resource visibility may be config-driven rather than Gate-driven. Wrap every panel route in can: middleware yourself and add a CI assertion that enumerates admin routes and checks guard plus gate. If panel visibility is only a config boolean, do not treat it as sufficient for a high-privilege surface.
- Can I change the Cockpit route prefix and middleware?
- Yes, the package exposes configurable route prefix and middleware settings, and the dashboard is intended to be kept private behind your own auth middleware. Publish the config and review the service provider to confirm how routes are registered. Add CI checks so no admin route can be registered outside your protected middleware group.
- Does Cockpit validate create and edit form input automatically?
- No, generated forms are a UI over validation, not validation itself. Every writable field still needs a FormRequest or model-level validation rule before you expose the endpoint. Without that, you have effectively shipped an unvalidated write endpoint.
- What are the main risks of adopting mpociot/cockpit?
- The ranked risks are abandonment and no upgrade path, route surface exposure, authorization opacity, data-integrity gaps, and performance foot-guns. The package has low adoption signals, including 39 stars and zero dependents, so no one is exercising it against current Laravel and PHP pairs. Budget explicit fork ownership and a concentrated review at each Laravel major.
- Can Cockpit support multi-tenant or role-based back-offices?
- Cockpit is a poor fit where the panel needs per-tenant isolation, SSO, granular roles, or an auditable authorization model. Its value comes from resource-per-model screens, not from tenant-aware policy enforcement. If you proceed, you must add scoping and Gate checks yourself rather than relying on config flags.
- How should I evaluate Cockpit before committing to it?
- Run a one-to-two-day vertical slice: require the package, publish config, read the small service provider, register one low-risk model, and verify listing plus edit behind your guard. Define the three to five non-regulated screens in scope and confirm each maps cleanly to one Eloquent model. Put every panel definition and provider registration in one deletable directory so exit cost stays low.