Filament Sqids Laravel Package

Product Decisions This Supports

• Obfuscated record identifiers in admin URLs: filament-sqids wires Sqids (the Hashids successor) into Filament so panel routes expose short, reversible, non-sequential IDs instead of auto-incrementing primary keys. This is a product/compliance decision as much as a technical one — it removes the "?id=1042" enumeration signal from internal tooling and any shared/exported admin links.
• Build vs. buy for ID obfuscation: the alternative is hand-rolling a trait + custom getRouteKey() / route-binding override on every model and resource, or adopting a broader package (e.g. sqids/sqids directly, hashids/hashids, or UUID/ULID primary keys). This package's value is that it is Filament-aware — the integration surface is the panel, not your domain models.
• Roadmap / architecture bet on non-UUID identifiers: choosing Sqids keeps integer primary keys (good for index size, joins, and existing reporting) while adding a presentation-layer encoding. That is a materially different trade-off from migrating to UUIDv7/ULID, and it is reversible in a way a primary-key migration is not.
• Scope signal for internal-tooling roadmap: pre-1.0 (0.0.1 → 0.1.0) with a changelog-only release indicates a single-maintainer, early-stage plugin. Reasonable for internal admin panels, support tooling, and back-office ops; not a fit for anything customer-facing or audited without a vendoring/fallback plan.
• Feature-level use cases: hiding record counts and growth rate from users who see admin URLs, making shared deep links less guessable, keeping support tickets/screenshots from leaking sequential IDs, and reducing "just try the next ID" behavior in multi-tenant admin panels.

When to Consider This Package

Adopt when all of the following hold:

• You run Filament v3/v4 panels and want short IDs in resource URLs without touching your schema.
• Your IDs are integers and you want to keep them that way (analytics, joins, legacy integrations).
• The threat model is casual enumeration and link hygiene, not cryptographic secrecy. Sqids is encoding, not encryption — anyone with the alphabet and salt can decode. Do not pitch this as a security control.
• You can pin the version and accept pre-1.0 churn.

Look elsewhere when:

• You need real unguessability or authorization guarantees. Route-key obfuscation is not access control; enforce policies regardless. If you need non-enumerable public identifiers, use UUIDv7/ULID at the schema level.
• The IDs escape the panel. If encoded IDs leak into APIs, exports, webhooks, or third-party systems, you now have two ID representations to reconcile — a permanent complexity tax.
• You have a multi-package or multi-tenant ID strategy already (e.g. a shared HasPublicId trait). A Filament-specific plugin risks fragmenting that.
• Long-term maintenance risk is unacceptable. A single-maintainer 0.x package with a one-line changelog is a dependency you may end up owning. Fork/vendor it or budget for replacement.

How to Pitch It (Stakeholders)

For executives (one line): A small plugin that stops our internal admin screens from advertising sequential record IDs in their URLs — low cost, low risk, reversible, but a pre-1.0 dependency we should treat as convenience rather than infrastructure.

For engineering: korfra/filament-sqids binds Sqids encoding into Filament's route-key resolution so resources resolve on short encoded IDs while the database keeps integer PKs. This is a presentation-layer concern, so it should not change your models, migrations, or policies — verify that assumption against the source before adopting, because the v0.1.0 release notes are a bare changelog link with no described features, fixes, or breaking changes.

Recommended next steps before any decision:

1. Do not treat v0.1.0 as an informative release. The notes contain only a compare link. Read the diff (0.0.1...v0.1.0) directly — feature additions, signature changes, and minimum Filament/PHP version bumps are all plausible and unstated.
2. Spike it in one non-critical panel behind a config flag; confirm what happens to existing bookmarked integer URLs and to relation-manager / nested-resource routes, which are the usual breakage points.
3. Pin the version exactly and record a fallback (a ~20-line route-key override) so removal is a one-day task, not a migration.
4. Set expectations explicitly: obfuscation ≠ authorization. Policies and tenant scoping must be verified independently.

Verdict: Worth a time-boxed spike for internal Filament panels; not yet justified as a standard across the estate on the strength of this release alone.