- How do I install mpyw/scoped-auth in a Laravel application?
- Install the package with Composer using composer require mpyw/scoped-auth. It has no migrations, external services, or data-store assumptions, so setup is limited to defining your scopes and wiring guards or user providers as described in the README. Pin the dependency to ^2.1 rather than floating, given the pace of Laravel version additions.
- Which Laravel and PHP versions does mpyw/scoped-auth support?
- Release v2.1.1 declares support for Laravel 14 and PHP 8.5, and the package targets Laravel 11+ with PHP 8.2+ according to the technical evaluation. Confirm that the lower Laravel and PHP bounds your platform actually runs are covered by the CI matrix rather than assumed. Treat Laravel 14 support as compatible but not battle-tested at scale, since it landed in a patch release.
- Can mpyw/scoped-auth handle multi-tenant authentication with different user providers per tenant?
- Yes. The package is designed to assign different guards and user providers to individual route groups, domains, or tenants so Auth resolves the correct user per context. That makes it a fit for multi-tenant and multi-domain applications that need per-scope login without global auth config changes. Start with one low-risk tenant-isolation rule before expanding to more scopes.
- Does mpyw/scoped-auth work with Laravel Fortify?
- Fortify integration is real but lightly exercised in CI; the v2.1.1 change was a documentation correction tied to Fortify v1.33.0, not a code change. Pin Fortify to at least 1.33.0 to align with the documented behavior. Test Fortify flows directly, especially 2FA, login pipelines, password reset, email verification, remember-me, and session invalidation. Do not rely on the changelog alone for those paths.
- What happens when a user matches more than one scope in mpyw/scoped-auth?
- The intended semantics for overlapping scope matches are not explicitly documented in the provided materials. It is unclear whether resolution is first-match, explicit precedence, or an exception. Confirm this with the maintainer or through tests before relying on scoped auth where users can span tenants or domains.
- Is mpyw/scoped-auth compatible with Sanctum or Passport token guards?
- Known interactions with Sanctum and Passport token guards are listed as an open question in the technical evaluation. The package is a thin layer over Laravel's guard and provider system, so token-guard support is plausible, but it should be verified in your own integration. Add targeted tests for token-authenticated requests before using it on protected APIs.
- Does mpyw/scoped-auth work safely with Laravel Octane?
- Octane interaction is another open question because long-lived workers can retain state across requests. Scope resolution should be evaluated per request, so verify there is no leakage between tenants or guards under Octane. Run a focused load test or worker-reuse test before deploying on Octane.
- What are the production risks of using mpyw/scoped-auth?
- The package has a small surface area, no external infrastructure, and no data migrations, which keeps integration risk low. The main concerns are single-maintainer concentration on the authentication path, early Laravel 14 support, and limited Fortify test coverage. Pin the package to ^2.1 and plan targeted verification around your auth flows.
- How is mpyw/scoped-auth different from native Laravel guards and policies?
- It is a thin, additive layer that lets you assign guards and user providers per route group, domain, or tenant instead of changing global auth configuration. It works alongside Laravel gates, policies, and guards rather than replacing them. Applications that already use stock guards with ad-hoc scope checks in controllers are the strongest fit.
- How do I migrate to or roll back from mpyw/scoped-auth?
- Adopt it incrementally: install the package, model one low-risk scope such as read-only tenant isolation, and validate against existing policy behavior before expanding. There are no data migrations because scope resolution happens at request time. Rollback is cheap: remove the dependency and the scope bindings.