- What is toddish/verify and what does it do?
- Toddish/Verify is a Laravel authentication bundle that layers email verification and role-based authorization on top of Laravel's native Auth guard and Eloquent User model. It lets you gate login on a verified email flag and perform simple ACL-style role and permission checks. It is an opinionated add-on rather than a full auth framework, so it assumes a conventional controller-based Laravel app with Blade views, the Mail facade, and a single users table.
- Which Laravel versions does toddish/verify support?
- The package targets legacy Laravel 3 and 4-era projects running PHP 5.x, and it predates Laravel 5 conventions. It does not follow modern Composer or PSR-4 autoloading standards, so a normal composer require will not drop it into a current Laravel application. Any attempt to run it on Laravel 5 or later should be scoped as a fork-and-port project.
- How do I install toddish/verify?
- In a matching legacy app you add the dependency, register the package's service provider or bundle, add its trait and verification fields to your User model, run the migration, and publish or customize the verification views and mail templates. You then adjust the auth config to gate login on the verified flag. The work is mostly wiring and view customization, but reproducing a compatible environment is the real cost today.
- Does toddish/verify work with Laravel 8, 9, 10, or 11?
- No, not without significant modification. The package is tightly coupled to an old Auth implementation and old mail APIs, and it expects pre-PSR-4 conventions that conflict with Composer 2 and PHP 7.4 or 8.x strictness. Porting it would require namespace changes, service-provider registration, config publishing, and mail API adaptation. For modern Laravel, use the built-in email verification flow instead.
- Is toddish/verify still maintained?
- No, it is effectively abandoned with no security-maintenance path. Verification flows are authentication-adjacent, so any future CVE or framework change would go unpatched. The MIT license removes legal risk but does not address lifecycle or correctness concerns, and security-sensitive logic like code generation, expiry, and verified-state transitions would need independent review.
- What are the best alternatives to toddish/verify for Laravel?
- Laravel has shipped first-party email verification since 5.7 via the MustVerifyEmail contract and the verified middleware. Breeze, Fortify, and Jetstream provide the full verification flow out of the box, and Fortify or Jetstream are better choices if you need a broader auth surface like 2FA. For role-based ACL, packages such as spatie/laravel-permission or native Gate and Policy checks are the modern equivalents.
- How does toddish/verify handle roles and permissions?
- The package adds user roles and permissions so you can perform ACL-style access checks through a simple, configurable API. It stores this data against the Eloquent User model and assumes a single users table, so it does not abstract storage for multi-tenant or non-Eloquent identity providers. For more granular or maintainable authorization on modern Laravel, native Gates and Policies or a dedicated permission package are preferable.
- Can I use toddish/verify for API or token-based authentication?
- No. The package is built around session-based, controller-driven authentication and does not abstract the storage or mail layers, so it is a poor fit for token-based auth, API-first design, stateless sessions, or multi-tenant user stores. Supporting those cases would require re-plumbing the package itself. Use Laravel Sanctum or Passport for API authentication instead.
- Is toddish/verify safe to use in production?
- Technical risk is high, concentrated in lifecycle, framework drift, and correctness. It is unmaintained, tightly coupled to an old Auth implementation, and its verification-code generation, expiry, re-send throttling, and verified-state transitions are security-sensitive and should not be assumed correct. It is only a defensible choice if the target app is already pinned to a matching legacy framework version and the exposure window is explicitly accepted.
- How do I migrate from toddish/verify to native Laravel email verification?
- On any modern or upgradable stack, replace rather than integrate. Adopt the MustVerifyEmail contract on your User model, use the verified middleware to gate routes, and rely on Laravel's built-in signed verification URLs and notification mail. If you need a broader auth surface, use Fortify or Jetstream. This removes the fork obligation and eliminates the unpatched dependency entirely.