User Plugin Laravel Package

Product Decisions This Supports

• Onboarding and access control: v3.7.0 turns user onboarding into a configurable product surface. The independent email-confirmation and admin-approval toggles let you ship invite-only betas, gated B2B accounts, or moderated community signups without custom code. This directly supports go-to-market decisions (open vs. gated registration) and compliance/trust requirements (manual vetting of accounts).
• Headless / API-first roadmap: The new ActionManager centralizes registration, sign-in, password recovery, and profile updates into one class. This is the strongest signal in the release: it unblocks a REST/GraphQL or mobile-client roadmap without forking component logic. If your roadmap includes a decoupled frontend, SPA, or third-party integrations, this materially reduces build effort.
• Build vs. buy for admin tooling: Bulk approval, user import/export (with email-based upsert, auto group creation, and safe exports excluding password hashes), and pending-state messaging on the frontend are all admin-panel features you would otherwise scope and build. Choose the package to avoid re-implementing back-office user operations.
• Operational decisions: Bulk import supports migrations from legacy systems or CRM syncs; export supports audits, analytics handoffs, and support workflows. The export security guarantee (no password hashes/secrets) is a compliance-relevant default.
• Lifecycle messaging: The rainlab.user.seen event enables "user came online" triggers for engagement, presence, or notification features. Password-reset-completes-verify-email closes a common trust gap.
• Low-risk upgrade decision: Defaults are off and migration is automatic, so this is a feature adoption decision rather than a forced migration — you can adopt selectively.

When to Consider This Package

Consider adoption when:

• You need registration gating (email confirmation, admin approval, or both) enforced consistently across browser and API logins — the sign-in-time enforcement is the key differentiator versus bolting checks onto individual entry points.
• You are planning or running a headless/API-first architecture and want one workflow layer (ActionManager) shared between CMS components and your API endpoints, with events still firing.
• You need admin-facing user operations — bulk approval, import with update-by-email, group assignment — without building bespoke tooling.
• You require safe data egress (exports excluding secrets) as a default rather than a custom implementation.
• You value upgrade safety: additive features with off-by-default policies suit teams that cannot absorb breaking changes.

Look elsewhere or proceed cautiously when:

• Your user model is highly non-standard (complex multi-tenant identity, federated/SSO-first, or custom RBAC beyond groups) — the group-centric model and settings toggles may become constraints.
• You already run a dedicated identity provider (Auth0, Cognito, Keycloak); duplicating approval policies in two systems creates split-brain risk.
• You need granular policy orchestration (per-tenant or per-role activation rules). The release describes two global checkboxes, which is coarse; confirm extensibility before betting a multi-segment onboarding strategy on it.
• You depend on component-level behavior and want to avoid entangling UI components with ActionManager semantics; verify the redirect property restoration covers your flows.
• Bulk import at scale is a core requirement — validate performance and idempotency for large datasets before committing.

Due diligence: confirm the migration's automatic behavior on large user tables, test approval enforcement across every auth path (including any custom API guards), and verify import matching rules against your data hygiene.

How to Pitch It (Stakeholders)

For executives: v3.7.0 is an additive, low-risk release that expands what we can sell and how we control access. We can now gate signups behind email confirmation and/or admin approval — enforced everywhere including APIs — which unlocks invite-only betas, vetted B2B onboarding, and moderated communities without custom development. Import/export gives us back-office user operations out of the box, with exports that never leak credentials. Upgrade risk is minimal: policies default to off and the migration is automatic, so existing sites are unaffected.

For engineering: The headline is ActionManager, a single class exposing every user workflow (register, sign in, password recovery, profile update) with events preserved. That means REST or GraphQL endpoints can be built without duplicating component logic — a concrete reduction in surface area and maintenance for any headless roadmap. Also included: restoration of the redirect property on Authentication/Registration components, a new rainlab.user.seen presence event, Tailor field tab/span support, and password-reset completion now verifying the email address.

Recommended ask: Adopt incrementally. Pilot ActionManager in a non-critical headless endpoint, validate import behavior against a production-like dataset, and enable activation policies per environment. Decision needed: whether API-first work is on the near-term roadmap — if so, this release is a strong argument to standardize on the package rather than build identity workflows in-house.

Risks to track: coarse (global) policy granularity for multi-segment onboarding; import performance at scale; and ensuring approval enforcement is verified across all authentication paths, including any custom guards.