Weave Code
Centaur Laravel Package
srlabs/centaur
Centaur is a lightweight Laravel package from srlabs that streamlines common application scaffolding with sensible defaults and an expressive, configurable API. Install via Composer, publish the config, and customize every layer to fit your project. Simple to adopt, easy to extend, and built to stay...
An opinionated implementation of Cartalyst's Sentinel package for Laravel
Frequently asked questions about Centaur
- What is srlabs/centaur and what does it do?
- Centaur is an opinionated Laravel package from srlabs that implements Cartalyst Sentinel for authentication and authorization. It aims to reduce scaffolding effort around user models, roles, permissions, and login flows by shipping sensible defaults you can publish and customize. Treat it as an application auth module rather than a general utility library or a strategic identity platform.
- How do I install srlabs/centaur with Composer in a Laravel app?
- Install it with composer require srlabs/centaur, then let Laravel package auto-discovery register the service provider. Publish the package config and any migrations with php artisan vendor:publish, review the defaults, and run php artisan migrate. Because Centaur wraps Sentinel, confirm the Sentinel dependency and its migrations are wired up before testing login and logout in a sandbox.
- Which Laravel and PHP versions does Centaur support?
- Confirm supported Laravel and PHP versions against the package's composer.json before committing, since an opinionated Sentinel wrapper often trails the newest Laravel releases. Pin exact versions in composer.lock and test auto-discovery, config publishing, and migrations against your target PHP matrix. If the constraints do not cover your Laravel version, budget for a fork or reject adoption.
- Which version of Cartalyst Sentinel does Centaur require?
- Centaur is an implementation of Cartalyst Sentinel, so it requires a compatible Sentinel version that your application must also accept. Check whether that Sentinel release is still maintained and how security fixes flow to it, since Centaur cannot patch upstream gaps. Review the transitive dependency and license obligations as part of due diligence.
- Does Centaur publish migrations, routes, controllers, views, or a user model?
- Given its scaffolding role, Centaur likely publishes configuration and migrations and may ship a user model, routes, controllers, or views, but verify exactly what vendor:publish exposes. Anything it publishes becomes part of your application and should be reviewed, namespaced, and kept behind an adapter boundary. Avoid letting Centaur models or routes leak across the codebase if you may later swap auth implementations.
- Can Centaur coexist with Laravel's native auth, Sanctum, policies, or multi-tenancy?
- Centaur is opinionated, so it is a poor fit for a brownfield app with established native auth, custom user tables, or nonstandard login flows. Coexistence with Laravel guards, Sanctum, policies, password resets, API tokens, and multi-tenancy depends on how Centaur wires Sentinel guards and models, which you must verify in a time-boxed spike. Keep an adapter or facade boundary so the auth implementation stays replaceable.
- How do I migrate existing users and password hashes to Centaur and Sentinel?
- Map existing users to the Centaur and Sentinel schema, preserving identifiers where possible, and confirm how password hashes are stored and verified before migrating. Plan to invalidate sessions intentionally and to re-test activation, throttling, and password reset flows after cutover. Run the work in an isolated branch behind a feature flag with a documented exit plan to native Laravel auth or an internal fork.
- Is srlabs/centaur actively maintained and safe for production?
- Adoption is thin, at roughly 59 GitHub stars, in a security-sensitive domain, so treat Centaur as a conditional accelerator rather than a default choice. Check last release and commit dates, CI status, test coverage, and whether a security policy exists, plus who owns upgrades and incident response. Without a maintained fork or internal owner, abandonment risk is real.
- How should I test Centaur authentication, roles, and permissions?
- Write feature tests around login, logout, password reset, activation and throttling if used, and role and permission checks against your real session driver. Verify behavior under your queue, cache, and test setup, and run composer audit in CI. Keep the tests implementation-agnostic so they still pass if you later move to Laravel's native auth.
- What are the alternatives to Centaur for Laravel authentication and RBAC?
- Alternatives include Laravel's native auth with Gate and policies, Sanctum or Passport for API tokens, Socialite for social login, and Spatie's permission package for RBAC. Choose Centaur only when Cartalyst Sentinel is already a deliberate architectural decision; otherwise standardize on native Laravel auth. Compare maintenance, security patching, and migration cost before committing.
Weaver
How can I help you explore Laravel packages today?