- What is ukeloop/laravel-impersonatable-guard used for?
- It adds a Laravel authentication guard for controlled log-in-as-another-user workflows, letting admins impersonate an account and switch back to the original user. It targets support, admin, and QA use cases. The package is designed to integrate with existing guards and auth flows without custom session handling.
- How do I install laravel-impersonatable-guard in a Laravel app?
- Install ukeloop/laravel-impersonatable-guard via Composer and follow the package README for guard and configuration registration. It follows standard Laravel package conventions. Confirm your application meets the v3.0.0 Laravel and PHP constraints before installing.
- Does this package support Laravel 13?
- Yes. The headline change in v3.0.0 is Laravel 13 support. That keeps the package aligned with the current Laravel framework line. Teams on earlier Laravel versions should verify compatibility before adopting v3.
- What Laravel and PHP versions does v3.0.0 support?
- The provided release notes do not state the exact Laravel and PHP version range for v3.0.0. They also do not list which earlier Laravel versions were dropped versus v2.0.0. Verify Composer constraints and the README before planning adoption, especially if you are on Laravel 11 or 12.
- Is v3.0.0 a breaking change from v2?
- The major version number signals potential breaking changes, but the release notes do not enumerate changes to the guard driver, configuration, middleware, routes, or public API. Treat the upgrade as a compatibility boundary rather than a routine dependency bump. Compare the v2.0.0 to v3.0.0 diff and test impersonation start and switch-back flows before merging.
- Does laravel-impersonatable-guard provide audit logging for impersonation?
- The provided context does not indicate that the package supplies impersonation audit logging. It explicitly notes that missing audit trails and overly broad impersonation permissions are security risks. The host application should provide authorization controls and logging, and you should verify the package source or README before relying on it in production.
- Can I use it with Sanctum, Passport, or custom auth guards?
- The package is intended to integrate with existing guards and auth flows, but the context warns that custom guards, Sanctum, Passport, and multi-tenant session handling need specific testing. Confirm compatibility in your application's guard configuration. Do not assume every custom authentication path works unchanged.
- How should I test an impersonation upgrade in production?
- Branch first, update the Composer constraint to ^3.0, run the full test suite, and explicitly exercise impersonation start and switch-back flows. Add authorization tests, session integrity checks, and audit-log verification. Sequence the host Laravel 13 upgrade before this package upgrade and keep it isolated from unrelated auth changes.
- What are alternatives to laravel-impersonatable-guard?
- The provided context does not name specific alternative packages. Evaluate alternatives that clearly document Laravel version support, security guidance, authorization controls, and audit hooks. Compare them against your need for guard integration and switch-back behavior.
- Is laravel-impersonatable-guard safe and maintained for production use?
- Impersonation is security-sensitive infrastructure, so guard misconfiguration or broad permissions can create privilege-escalation paths. The package appears small and focused, but the release notes are dominated by dependency automation and provide limited migration or security detail. Assign an internal owner, verify audit logging and authorization, and avoid treating v3.0.0 as a low-risk update.