Filament Auto Logout Laravel Package

Getting Started

• What it is: a Filament panel plugin (not a middleware or a standalone package) that logs an idle user out of a Filament panel after a configurable period of inactivity, usually with a warning modal and countdown first. v3.0.0's only change is adding Filament v5 to the supported range — no feature or API changes are listed, so the developer-facing surface is the same as 2.x.
• Upgrade (or install):

  composer require niladam/filament-auto-logout:^3.0
  

  Only take ^3.0 if you are already on Filament v5. On v3/v4 panels stay on ^2.0; there is nothing to gain from forcing it.
• Where to look first: the Panel provider you actually use (app/Providers/Filament/AdminPanelProvider.php). Registration happens in panel() alongside the other plugins — that is the single place where behaviour is turned on. Then publish the config so you can read the available keys rather than guessing:

  php artisan vendor:publish --tag="filament-auto-logout-config"
  

• First use case: a kiosk/shared-workstation admin panel (front desk, clinic, warehouse terminal) where the browser is left open all day. Register the plugin, set a short idle timeout with a short warning window, and confirm the user lands on the login screen instead of a dead modal.

Implementation Patterns

• Per-panel configuration, not global. Because it is registered on a Panel, you can give AdminPanelProvider a 10-minute timeout and leave a customer-facing panel alone. Prefer this over one global value; it is the package's main structural advantage over a hand-rolled middleware.
• Drive the duration from config/env, not code. Set the idle window, warning window, and post-logout redirect in the published config (or via the plugin's fluent setters, if the version you pin exposes them) and source the numbers from config/filament.php-style env vars. That keeps staging (2 minutes, so you can actually see the modal) different from production (15–30 minutes) without a code diff.
• Align it with the framework's own session lifetime. The visible countdown is client-side; the real enforcement is Laravel's session expiry. Keep SESSION_LIFETIME longer than timeout + warning window. If the session dies first, users get a 419/"page expired" screen instead of your nice warning modal, and QA will file it as a plugin bug.
• Treat the warning step as a UX contract. A logout with zero warning will be reported as "the app randomly logged me out". The pattern that works is: warning appears, user can extend, then hard logout with a redirect back to the panel's login route — and the same redirect for every panel so bookmarks behave predictably.
• Audit via the logout event. Hook the event the plugin dispatches before logging out into your activity log / Log::info so you can later distinguish "user idled out" from "user's session was invalidated" when investigating support tickets.
• Rollout pattern: enable it on the admin panel only, ship it behind config (enabled => env(...)), watch for a week, then turn on for other panels. It is a behaviour change for every existing user, not an additive feature.

Gotchas and Tips

• The version gate is the whole release. 3.0.0 is semver-major purely because the filament/filament constraint moved to v5. Practically: nothing in your code changes, but Composer will refuse the update until Filament itself is on v5 — and conversely, upgrading Filament to v5 will force this bump. If you see a conflict, run composer why-not niladam/filament-auto-logout 3.0.0 before assuming the plugin is at fault; it is usually a sibling Filament plugin still pinning v4.
• Filament v5 requires a newer PHP runtime (8.2+). Check platform.php in composer.json and your CI matrix before upgrading — the constraint failure will look like a package problem and is actually a runtime problem.
• Re-publish anything you overrode. If you customised the published config or views for the countdown/warning modal, do not blanket --force publish. Diff the old file against the new stub: config keys can be added/renamed between majors, and stale published Blade views that reference Filament v4 markup are the most likely thing to break on a v5 panel (blank modal, or a modal that never dismisses). Clear caches after any publish: php artisan optimize:clear (plus filament:optimize-clear if you use Filament's production optimisations).
• A JS countdown is not a security control. Background-tab throttling, sleeping laptops, and the user simply not looking mean the timer fires late. Do not use this to satisfy an "auto-terminate privileged session at N minutes" compliance requirement — that needs server-side enforcement. Position it as idle-UX; keep SESSION_LIFETIME and a real re-auth prompt as the security boundary.
• Multiple tabs are each running their own timer. One tab logging out invalidates the session for all of them; other tabs will throw 419s on their next Livewire request until reloaded. If users work in several tabs, expect this and decide whether the warning modal should broadcast (e.g. via the BroadcastChannel/storage-event pattern) or whether the 419 is acceptable.
• Full page loads reset the clock. A Livewire SPA navigation keeps the timer; a hard refresh or a link that escapes the panel resets it. If "idle" means something specific for your app, verify it against a stopwatch before writing docs.
• Debugging checklist when it silently does nothing: (1) plugin actually added in the panel you're browsing, (2) enabled key resolved to true in php artisan tinker (config('filament-auto-logout')), (3) config cache cleared after edits — php artisan config:cache on a deploy will happily bake in the old timeout, (4) the plugin's JS is present in the page source, (5) not running behind a panel that requires a full reload to pick up the plugin list. That order resolves ~90% of "it's installed but not logging me out".
• Pin deliberately. There is no reason to track * here: this package's majors are entirely driven by Filament majors, so pin ^2.0 or ^3.0 to match your Filament version and let Dependabot bump them in lockstep.