- How do I install salla/ouath2-merchant in a Laravel app?
- Install it with Composer using the exact package name, salla/ouath2-merchant, then register the package service provider and add your Salla client ID, secret, and redirect URI. Adoption is additive: you do not have to replace your existing auth stack, since the guard and middleware are opt-in. Check the typo in the vendor name carefully when copying the require command.
- Which Laravel and PHP versions does salla/ouath2-merchant support?
- The package requires PHP ^8.1 and illuminate/support ^9 through ^13, so it covers Laravel 9, 10, 11, 12, and 13. If any of your services still run Laravel 8 or PHP 8.0, they are out of scope and need a separate integration path. Confirm the PHP floor across your estate before committing to a rollout.
- Why is the package name spelled ouath2 instead of oauth2?
- The vendor/package name contains a typo, salla/ouath2-merchant, and it is now load-bearing across several first-party repositories. Renaming it is a coordinated multi-repo Composer migration rather than a quick patch, so the guidance is to avoid renaming without auditing every consumer. Either budget for that migration or accept the spelling permanently.
- How does the salla-oauth guard and salla.oauth middleware work?
- The package registers a SallaOauth facade, a salla-oauth guard, and a salla.oauth[:scopes] bearer-token middleware that you attach by alias to specific routes. On a cache miss, the middleware resolves the caller by calling the Salla user info endpoint at accounts.salla.sa/oauth2/user/info and caches the result. Because the alias is opt-in, you can roll it out route by route and back it out just as easily.
- How do I request a token with specific Salla scopes?
- Use the SallaOauth facade as a low-ceremony escape hatch when you need a token for a particular scope set, or pass scopes through the middleware alias as salla.oauth:scope1,scope2. The facade wraps the underlying league/oauth2-client provider, so the standard authorization code flow and token refresh behavior still apply. Keep scope strings identical to what Salla documents for merchant apps.
- How can I fake Salla authentication in feature tests?
- The documented pattern is to stub fetchResourceOwnerDetails so the provider returns a canned resource owner instead of hitting the network. That lets your feature tests exercise the guard and middleware without live Salla credentials or external calls. Combine the stub with your normal HTTP-level test helpers so the Salla user info round trip never runs during CI.
- Is it safe that the middleware caches user info keyed by the access token?
- The middleware keys its cache entries by the raw access token, and the team explicitly warns against logging cache keys. That is a real secret-exposure path: Redis MONITOR output, slow logs, key dumps, or an accidental log line would leak a live credential. Hashing the token before using it as a cache key is a small, backwards-compatible hardening change worth requesting before broad rollout.
- What happens when a Salla access token is revoked or expires?
- Once the user info response is cached, a revoked token keeps passing the middleware until the cache entry expires unless you invalidate it explicitly. Confirm the cache TTL and whether any revocation hook exists before relying on the package for sensitive routes. If your threat model needs fast revocation, pair the guard with your own invalidation or a token introspection check.
- Can I use this package outside Laravel, or in a plain PHP service?
- Yes, the core of the package is a league/oauth2-client provider for Salla's authorization server, so any PHP 8.1 project can consume it directly. You simply skip the SallaOauth facade, the salla-oauth guard, and the salla.oauth middleware, which are Laravel-only glue. That degraded mode is a reasonable fit for non-Laravel services in the same estate.
- Is salla/ouath2-merchant production ready and actively maintained?
- Treat it as an internal package with a public face: it is MIT licensed and used by several first-party Salla repositories, but its community signal is minimal at around 25 stars with no published dependents. Releases appear to be manually tagged, so pin a version or commit SHA and confirm who owns the package and the SLA for a Salla API breaking change. Style checks such as PSR-2 are not enforced in CI, which is low impact but signals limited external review.