Weave Code
Larastarter Laravel Package
smarttechtank/larastarter
Larastarter by SmartTechTank is a Laravel starter kit with a ready-made admin foundation: authentication, roles and permissions, user management, CRUD scaffolding, and a clean UI to help you launch new PHP apps faster.
A Laravel package that sets up a starter project with role-based authentication, API controllers, repositories, and more.
Frequently asked questions about Larastarter
- What is smarttechtank/larastarter and what does it include?
- Larastarter is a Laravel starter kit from SmartTechTank that scaffolds an admin foundation into your application: authentication, roles and permissions, user management, CRUD scaffolding, API controllers, repositories, and a clean UI. It follows a publish-and-own pattern, so the generated controllers, form requests, and traits live in your codebase instead of being hidden inside the vendor directory. You install it with Composer and run an Artisan install command to generate the files.
- How do I install Larastarter in an existing Laravel application?
- Require the package with Composer, then run the package's Artisan install command to scaffold the authentication, role, and CRUD files into your app. After that, review the published stubs and wire the routes yourself, since Larastarter expects you to own and edit the generated code. Do this on a non-production branch first and diff the output against any authentication code you already have.
- Which Laravel and PHP versions does Larastarter 1.9.4 support?
- The 1.9.4 release notes do not spell out the exact Laravel and PHP constraints, so check the require block in the package's composer.json and its CI matrix before committing. Confirm the constraint covers your production PHP baseline and your Laravel major version. Because this is a semver patch release with additive classes only, no breaking changes are called out, but coexistence with your stack still needs verification.
- How does Larastarter handle roles and permissions?
- Larastarter ships role-based authentication with user management out of the box, so you get roles, permission checks, and user CRUD without building them from scratch. Because the files are published into your application, you can extend or replace the role logic without forking the package. Review the generated migrations, middleware, and gates to confirm the guard wiring matches your existing authorization approach.
- Does Larastarter include two-factor authentication?
- Yes. It publishes a TwoFactorAuthController with enable and verify actions, and version 1.9.4 adds a disable action, a dedicated TwoFactorDisableRequest, and a matching test. The disable flow requires reauthentication by password or verification code, which aligns with OWASP guidance. Validation is enforced server-side in the form request rather than only in the UI, but recovery-code handling and session invalidation should still be reviewed in the published code.
- Will Larastarter conflict with Fortify or Jetstream two-factor authentication?
- Potentially yes, and running two 2FA stacks side by side is a real hazard because both may register middleware, routes, and session flags for the same user. Inventory your existing auth implementation before installing and choose a single owner for the 2FA flow. If you already depend on Fortify or Jetstream for 2FA, either skip Larastarter's 2FA pieces or remove the competing stack.
- Do published Larastarter files update automatically when I run composer update?
- No. Published controllers, traits, and form requests live in your repository, so composer update will not change them. Re-run the package's install or update command to pull new stubs, then diff them against your copies and merge manually instead of overwriting local changes. Treat each 1.9.x release as additive and reconcile the differences deliberately.
- Can I use Larastarter for an API-only or SPA application with Sanctum?
- The 1.9.4 release is controller- and trait-centric, which suggests a server-rendered or server-mediated authentication flow rather than a headless token flow. Whether Sanctum or Passport contexts are fully supported is not stated in the release notes, so spike it before adopting for an API-only surface. If you need headless 2FA, verify that the challenge and verify endpoints work alongside token issuance.
- Is the Larastarter 2FA disable action rate-limited and does it require reauthentication?
- The disable action requires reauthentication by password or verification code, which is the correct security posture. Whether the verification code path is rate-limited, how long the reauthentication window lasts, and what happens to active sessions after disabling must be verified in the published controller and middleware rather than inferred from release notes. Also confirm that TwoFactorDisableRequest ties authorization to the authenticated user so it cannot be exercised cross-account.
- What are the alternatives to Larastarter and when should I choose it?
- First-party options like Laravel Fortify or Jetstream are the safer pick when you want framework-maintained authentication and 2FA with no published code to maintain. Choose Larastarter when you want a batteries-included admin scaffold with roles, permissions, user management, CRUD generation, and a UI you can own and edit directly. Weigh that convenience against the long-term cost of maintaining published files and the risk of duplicating an existing auth stack.
Weaver
How can I help you explore Laravel packages today?