Technical Evaluation

Moderate fit for Laravel: While not Laravel-native, the package’s modular design (authenticators, authorizators, storage backends) allows integration via Laravel’s service container and middleware. Key components like User, Authenticator, and Authorizator can be adapted to Laravel’s ecosystem with minimal abstraction.
RBAC/ACL alignment: The role-based access control (RBAC) and access control list (ACL) features align well with Laravel’s Gate and Policy systems but offer more granularity (e.g., resource-level permissions) without requiring custom middleware for every use case.
Session management: The package’s session storage (e.g., SessionStorage, CookieStorage) can replace Laravel’s default session handling for auth, but database-backed sessions (Laravel’s default) require a custom adapter.
Laravel-specific gaps:
- No built-in support for Laravel’s Auth facade, session drivers, or CSRF protection.
- Event system (e.g., auth.attempting, auth.loggedOut) is not natively integrated.
- Password hashing uses Nette’s Passwords class (BCrypt by default), which can coexist with Laravel’s Hash helper but may require duplication.

High for core auth: Authentication flows (login, logout, identity management) can be implemented via Laravel middleware and service bindings, with minimal custom code.
- Example: Bind Nette\Security\User to Laravel’s Auth facade via a custom guard.
- Use Authenticator interfaces to wrap Laravel’s UserProvider or Guard.
Medium for authorization: ACL/RBAC can be layered over Laravel’s Gates/Policies but requires:
- Mapping Nette’s Role/Resource to Laravel’s Gate definitions.
- Custom middleware to short-circuit Laravel’s auth system when using Nette’s User::isAllowed().
Low for session storage: Replacing Laravel’s session driver with SessionStorage/CookieStorage is non-trivial and may conflict with Laravel’s session lifecycle (e.g., start()/regenerate()).

Risk Area	Severity	Mitigation Strategy
Laravel integration	High	Build a thin adapter layer (e.g., `NetteAuthServiceProvider`, `NetteAuthMiddleware`) to bridge gaps.
Session conflicts	Medium	Use Laravel’s session only for non-auth data or implement a hybrid storage adapter.
Password hashing	Low	Standardize on Laravel’s `Hash` helper and treat Nette’s `Passwords` as a secondary utility.
BC breaks	Medium	Pin to v3.2.x (stable) and test against Laravel’s PHP 8.1+ requirements.
Performance	Low	Benchmark `User::isAllowed()` vs. Laravel’s `Gate::allows()`; cache ACL checks if needed.
Testing	Medium	Write integration tests for auth flows, focusing on middleware and service interactions.

Laravel Auth Stack:
- Are we replacing Laravel’s auth entirely or augmenting it (e.g., adding ACL to existing Gates)?
- If augmenting, how will we avoid duplication between Nette’s User and Laravel’s Auth::user()?
Session Strategy:
- Can we coexist with Laravel’s session driver, or must we switch to SessionStorage/CookieStorage?
- How will we handle session expiration (e.g., Laravel’s auth:timeout) vs. Nette’s sliding expiration?
RBAC Implementation:
- Will roles/resources map 1:1 to Laravel’s Gates, or do we need a hybrid system?
- How will we seed initial ACL rules (e.g., for admin vs. user roles)?
Password Handling:
- Should we migrate existing hashes to Nette’s Passwords class, or keep using Laravel’s Hash?
Middleware:
- Will we use Nette’s User::checkPermission() in every controller, or create a global middleware?
Guest Identity:
- Do we need anonymous roles (e.g., guest), or can we handle this via Laravel’s Guest middleware?
Performance:
- Are there bottlenecks in User::isAllowed() for high-traffic routes (e.g., API gateways)?
Long-Term Maintenance:
- Who will own the adapter layer (e.g., NetteAuthServiceProvider)?
- How will we handle future Laravel/Nette updates (e.g., PHP 9.0)?

Integration Approach

Laravel Compatibility:
- Core Auth: High (login/logout flows can be mapped to Laravel’s Auth contract).
- Authorization: Medium (ACL requires custom middleware to integrate with Laravel’s Gates).
- Sessions: Low (conflicts with Laravel’s session lifecycle; hybrid approach recommended).
- Passwords: Medium (Nette’s Passwords can coexist but may require hash migration).
Recommended Stack:
- PHP 8.1+ (required by v3.2.x).
- Laravel 10+ (for PHP 8.1+ support and Auth contract compatibility).
- Nette/DI (optional, for dependency injection if not using Laravel’s container).
- PHPStan (mandatory for the package; integrate into Laravel’s CI).

Phase	Tasks	Tools/Libraries
Assessment	Audit current auth stack (Laravel Gates, Policies, middleware). Identify gaps (e.g., missing RBAC, session issues).	`php artisan route:list`, `php artisan gate:list`
Adapter Layer	Create a custom service provider (`NetteAuthServiceProvider`) to bind Nette components to Laravel’s container.	Laravel’s `ServiceProvider`, `AuthManager`, `Guard`
Auth Integration	Replace `Auth::attempt()` with `Authenticator`; bind `User` to Laravel’s `Auth` facade.	`Nette\Security\User`, `Nette\Security\Authenticator`
ACL Integration	Build middleware to short-circuit Laravel’s auth when using Nette’s `User::isAllowed()`. Map roles/resources to Laravel’s Gates.	Laravel’s `Middleware`, `Gate`
Session Strategy	Decide: Hybrid (Laravel sessions + Nette storage) or Full Switch (Nette’s `SessionStorage`). Implement custom session driver if needed.	Laravel’s `SessionManager`, `Nette\Security\SessionStorage`
Password Sync	Migrate existing hashes to Nette’s `Passwords` class or wrap Laravel’s `Hash` in a compatibility layer.	Laravel’s `Hash`, `Nette\Security\Passwords`
Testing	Write integration tests for auth flows, ACL checks, and session behavior.	Laravel’s `HttpTests`, `Pest`/`PHPUnit`
Deployment	Roll out in stages: Start with auth, then ACL, then sessions. Monitor for session conflicts or permission denials.	Feature flags, Laravel Forge/Envoyer for zero-downtime deploys

Component	Laravel Equivalent	Compatibility Notes
`User`	`Auth::user()`	Bind `Nette\Security\User` to Laravel’s `Auth` facade via a custom guard.
`Authenticator`	`UserProvider`	Implement `Nette\Security\IAuthenticator` to wrap Laravel’s `UserProvider`.
`Authorizator`	`Gate`/`Policy`	Use middleware to short-circuit Laravel’s auth when checking Nette’s ACL.
`SessionStorage`	`Session`	Low compatibility: Conflicts with Laravel’s session lifecycle. Use a hybrid approach or custom driver.
`Passwords`	`Hash`	Medium compatibility: Can coexist but may require hash migration.
`Identity`	`Auth::guard()->user()`	Map Nette’s `Identity` to Laravel’s `User` model.
Middleware	Laravel Middleware