Laravel Inertia Vue Starter Kit Laravel Package

Getting Started

This is a starter kit, not a runtime dependency — so "getting started" means scaffolding your app from it rather than composer require-ing it.

1. Create a project from the template:

   composer create-project seckay/laravel-inertia-vue-starter-kit my-app
   # or, more commonly:
   gh repo create my-app --template SebKay/laravel-inertia-vue-starter-kit
   

2. Install and boot:

   cd my-app
   composer install
   npm install
   cp .env.example .env
   php artisan key:generate
   php artisan migrate
   npm run dev   # or `npm run build`
   

3. Look here first:
   • routes/web.php and routes/auth.php — the full auth surface (login, register, password reset, and as of 7.1.0, email verification).
   • app/Http/Controllers/Auth/* — registration, verification, and session controllers.
   • app/Models/User.php — check the MustVerifyEmail contract and any suspension-related casts/scopes.
   • resources/js/Pages/Auth/* — Vue pages mirroring each auth flow.
   • app/Http/Middleware/ — where the suspension check and verified middleware land.
4. First use case: register a user, confirm the verification email lands (log driver by default — check storage/logs/laravel.log or Mailpit), click the signed verification link, then flip a user's suspended flag in tinker and confirm the session is invalidated on next request.

Implementation Patterns

Email verification flow (new in 7.1.0)

• User implements MustVerifyEmail; routes are protected with the verified middleware.
• Registration dispatches a verification notification — customize the mail in app/Notifications/ rather than editing the controller.
• Use php artisan make:notification and swap it in the Registered event listener if you need branded mail.
• For API/SPA front-ends outside the kit's Vue pages, the signed URL + verification.verify named route is what you reproduce.

Registration emails (new in 7.1.0)

• Welcome/registration mail is dispatched post-create. Keep it queued (ShouldQueue) in production; the kit's default is synchronous, which is fine locally but slow under load.
• If you localize, register translations for the mail views and pass the user's locale into the notification.

User suspension (new in 7.1.0)

• Suspension is enforced via middleware on authenticated routes. Wrap your own route groups with the same middleware so new features inherit the check.
• Pattern for admin tooling: a suspended_at timestamp (nullable) plus a isSuspended() helper beats a boolean — you get audit history for free.
• Combine with session invalidation (Auth::logout() + $request->session()->invalidate()) so suspension takes effect immediately rather than at next login.
• For queued jobs and notifications, add a guard: suspended users shouldn't receive drip emails or trigger side effects.

Best-practice scaffolding (7.1.0)

• The "best practices" PR tightens conventions — follow the existing Form Request + Action/Controller split rather than inlining validation.
• Keep resources/js/Pages aligned one-to-one with controllers; Inertia props are the contract.

Extending the kit

• Add modules (teams, billing) as new route files + middleware groups; don't fork the auth controllers — extend or decorate them.
• Pin the template version in your README so future upgrades from upstream are diffable (git remote add upstream ... and cherry-pick).

Gotchas and Tips

• It's a template, not a package. There's no upgrade path via Composer. To absorb 7.1.0 changes into an existing app, diff 7.0.0...7.1.0 and manually port the auth/verification/suspension files.
• MustVerifyEmail is a breaking-ish behavior change. If you scaffolded from 7.0.0, adding the contract retroactively will lock out existing unverified users. Backfill email_verified_at before enabling the verified middleware.
• Suspension middleware ordering matters. Place it after auth but before verified, otherwise suspended users hit verification redirects instead of a clean 403/logout.
• Mail in local dev: default MAIL_MAILER=log. Use Mailpit or MAIL_MAILER=smtp with a local catcher, or you'll spend an hour wondering why verification emails "don't arrive."
• Signed URL expiry on verification links defaults to 60 minutes; long-lived invites need URL::temporarySignedRoute with an explicit TTL.
• Queue workers in tests — use Notification::fake() and Event::fake(); otherwise verification tests race against synchronous mail sending.
• Session/cache drivers: suspension checks that hit the DB on every request add latency. Cache the suspension flag with a short TTL and bust it on update.
• GH Actions fixes in 7.1.0 mean CI now runs the full suite — if you fork, keep .github/workflows in sync or your first PR will fail on matrix differences.
• Extension points worth knowing: app/Actions/ (if present) for reusable domain logic, app/Http/Middleware/EnsureUserIsNotSuspended.php, and the Registered/Verified event listeners — hook here rather than editing controllers on every project.