Weave Code
Laravel Auth Laravel Package
rinvex/laravel-auth
Rinvex Laravel Auth is a flexible authentication and authorization package for Laravel, offering user management, roles and permissions, email verification, password resets, and social login with customizable, ready-to-use flows.
A powerful authentication, authorization and verification package built on top of Laravel. It provides developers with Role Based Access Control, Two-Factor Authentication, Social Authentication, and much more, compatible Laravel’s standard API and fully featured out of the box.
Frequently asked questions about Laravel Auth
- What is rinvex/laravel-auth used for?
- It is a Laravel authentication, authorization and verification package that bundles user management, role based access control, email verification, password resets, two-factor authentication and social login. The appeal is that it provides these flows out of the box rather than requiring several separate packages. However, it is not an additive layer: it replaces the authentication substrate, including the user model, guards, role and permission storage, and verification flows.
- Is rinvex/laravel-auth still maintained?
- The package is archived, so there are no security patches, no Laravel or PHP compatibility updates, and no CVE response. For authentication code, which has the highest blast radius in an application, that is a category-level disqualifier for new adoption. The small star count and likely single-maintainer project also mean the bus factor is effectively one.
- Which Laravel and PHP versions does rinvex/laravel-auth support?
- The provided context does not confirm specific Laravel or PHP version constraints for the last tagged release, so you must check the package composer.json and Packagist metadata before assuming compatibility. Because the repository is archived, there is likely to be a version gap against current Laravel and PHP releases. Treat version support as a first-order evaluation question rather than an implementation detail.
- Does rinvex/laravel-auth replace Laravel's User model and guards?
- Yes. The package replaces the authentication substrate: the user model, guards, role and permission storage, and verification flows. Adoption is a swap rather than a bolt-on, so you cannot assume it will simply wrap your existing user model. That model replacement is one of the most invasive parts of adopting the package and directly affects migration cost.
- How are roles and permissions stored in rinvex/laravel-auth?
- The package comes from the Rinvex Cortex family, which typically stores entity data through an attribute or EAV layer rather than plain pivot tables. That is a meaningful deviation from role_user pivot semantics, so teams expecting conventional relational RBAC should validate the actual schema before committing. The storage model affects query complexity, reporting, and how easily you can integrate with existing authorization checks.
- Can I use rinvex/laravel-auth alongside Spatie permission or Laravel Fortify?
- Feature overlap is high because Fortify covers authentication hardening and two-factor authentication, Socialite covers social login, Sanctum or Passport cover tokens, and Spatie's permission package is the de facto RBAC standard. The package's value proposition is bundling rather than unique capability, and its RBAC model will compete with existing policies and gates rather than complement them. Combining it with overlapping packages is usually a poor fit unless you have a deliberate reason.
- Is rinvex/laravel-auth suitable for production or compliance-reviewed applications?
- An archived authentication dependency is a standing audit finding and a compliance blocker for SOC 2 or ISO 27001 style reviews. Production feasibility is lower than demo feasibility because the invasive model swap, user migration, and authorization rewiring all carry risk. For new adoption, the safer path is to compose maintained first-party and community packages instead.
- How do I install and set up rinvex/laravel-auth?
- Mechanically the setup is conventional Laravel: install via Composer, publish the config and migrations, point the auth config at the package's user model, and seed roles. A competent Laravel developer can get a demo running in under a day. Production setup is harder because you must migrate existing users and roles and rework authorization checks that currently rely on policies and gates.
- Does rinvex/laravel-auth support two-factor authentication and social login?
- Yes, two-factor authentication and social authentication are among its advertised features, along with email verification and password resets. However, the context does not confirm whether the 2FA implementation is TOTP or RFC 6238 compliant, or whether it supports recovery codes and enforced enrollment. Because the package is archived, you should also assume no security fixes will arrive for these flows.
- What are the alternatives to rinvex/laravel-auth, and how should I migrate off it?
- For greenfield projects, do not adopt it; instead compose Laravel Fortify, Socialite, and a maintained permission package for comparable feature coverage with better long-term support. If you already run it, treat it as technical debt with a named owner, introduce an internal authorization interface for roles, permissions, and 2FA verification, and route all call sites through it. The MIT license makes forking legally clean, but you inherit the maintenance and security patching obligation.
Weaver
How can I help you explore Laravel packages today?