- What does sassnowski/laravel-shareable-models do?
- It is a Laravel package that turns an Eloquent model into a shareable resource by generating URLs with unique tokens that resolve back to a record. You add a trait to the target model instead of building custom token generation, storage, and lookup logic yourself. It is backend-only and framework-native, with no external service or queue dependency described.
- How do I install laravel-shareable-models in a Laravel app?
- Install it with Composer, publish or run the package migration for the share tokens table, and apply the package trait to the Eloquent model you want to share. The evaluation notes there is no significant service provider footprint or configuration surface beyond token generation. Adopt it on one model and one user-facing feature first before generalizing.
- Which Laravel and PHP versions does laravel-shareable-models support?
- The metadata shows the last release was March 2023, so confirm the supported Laravel and PHP constraints in composer.json and test against your target major in staging. Do not assume compatibility with the current Laravel release just because the package is Laravel-native. If your platform version is already out of security support, treat that as a separate risk.
- How do I make an Eloquent model shareable?
- Add the package trait to the model, run the migration that creates the polymorphic shareable links table, and use the trait API to generate a share link for a record. The package stores a token plus a polymorphic reference, so it can attach to arbitrary Eloquent models. Check that the trait does not shadow existing methods such as shareableLinks in your model.
- Does it provide routes and controllers for shared links?
- The package is a thin layer over Eloquent that mints URLs containing a token; it does not replace your app routing, authentication, or authorization. You should provide the redemption endpoint or view that fits your application and resolve the token to the intended model. That keeps access policy under your existing middleware and gates.
- Are share links revocable, and do they expire?
- The package is described as generating unique, revocable share URLs. Expiry and redemption limits are not clearly evidenced in the provided metadata, so verify whether those features exist out of the box or require forking. For production, define revocation and expiry policy before exposing links.
- How secure are the share tokens?
- A share link is a bearer credential, so anyone with the URL can attempt to redeem it and token entropy, generation mechanism, and lookup behavior matter. The provided metadata does not document the exact token algorithm or whether lookup is timing-safe, so inspect the source and test before relying on it for sensitive records. Add rate limiting and logging at your redemption endpoint.
- Can I create single-use or limited-redemption share links?
- Redemption limits and single-use behavior are not confirmed in the supplied package overview, so treat them as requirements to validate or implement yourself. You can wrap redemption in your own controller or middleware and mark a link consumed after first access if the package exposes the necessary state. If it does not, a small fork may be needed.
- How should I handle authorization for shared records?
- The package does not replace authentication or authorization; it only gives you a tokenized URL that resolves to a model. Decide explicitly what access means, such as read-only view versus full interaction, and enforce that in the redemption route with policies, middleware, and rate limiting. Avoid exposing sensitive records solely because a token exists.
- What production concerns should I plan for before adopting this package?
- Plan for token table growth: the polymorphic relation should be indexed on shareable_type and shareable_id and needs a pruning strategy if you create many links. The last release was March 2023 with effectively zero dependents, so test against your target Laravel major and have a plan to vendor or fork the small number of files. Review token entropy, revocation, expiry, and redemption logging before exposing sensitive records.