Nova Zadarma Laravel Package

Technical Evaluation

• Architecture fit: webard/nova-zadarma is a Laravel Nova package that integrates Zadarma telephony functionality into the Nova admin panel. It fits teams already standardized on Laravel + Nova and using Zadarma as their telephony provider. It is not a general-purpose Laravel package and should not be treated as a core telephony abstraction outside Nova.
• Integration feasibility: Reasonable for a Laravel team: Composer install, config publishing, Nova asset publishing, Zadarma credentials, and a publicly reachable webhook endpoint. The addition of webhook signature verification is a meaningful security improvement and should be treated as required configuration, not optional hardening.
• Technical risk: Medium. v2.0.0 is a major-version release from v1.1.2 with only a high-level changelog. “Refactored” and “cleaned” strongly imply possible breaking changes in config keys, routes, service providers, or widget behavior. Production readiness is vendor-claimed, not independently established. Confirm supported Laravel/Nova/PHP versions, webhook signature algorithm, replay protection, and multi-tenant/role behavior before adoption.
• Key questions:
  • Which Laravel, Nova, and PHP versions are supported?
  • Is there a migration guide from v1.x, and which config keys changed?
  • What signature algorithm/header is used, and how are secrets rotated?
  • Does the webhook route enforce CSRF/auth exclusions correctly and safely?
  • Is the widget scoped per user/tenant, and how are permissions handled?
  • What test coverage and release cadence exist?
  • What is the rollback path if signature verification or Nova assets fail?

Integration Approach

• Stack fit: Suitable only for Laravel applications with Nova installed. Requires Composer, Nova’s asset pipeline, config caching, and an HTTPS webhook endpoint reachable by Zadarma. If the product does not use Nova or Zadarma, this package is not a fit.
• Migration path: Treat v2.0.0 as breaking until proven otherwise. For v1.x users: branch the upgrade, review the GitHub diff, back up published config, update the Composer constraint to ^2.0, republish/merge config, update webhook signature settings, verify widget position configuration, and regression-test call events and admin UI behavior. For new adopters: install in a sandbox first, configure Zadarma credentials, expose the webhook endpoint, and validate signature verification before production.
• Compatibility: Confirm Nova major version compatibility, Laravel LTS support, PHP version constraints, and whether existing published assets/routes conflict. The webhook endpoint must be publicly reachable over HTTPS and excluded from CSRF where appropriate, without weakening auth controls elsewhere.
• Sequencing:
  1. Build a version compatibility matrix for Laravel, Nova, PHP, and Zadarma.
  2. Install and validate in a sandbox with a test Zadarma account.
  3. Configure webhook endpoint, signature secret, and widget position.
  4. Run end-to-end webhook verification and Nova UI tests.
  5. Migrate staging from v1.x, merging config changes explicitly.
  6. Deploy to production canary with rollback plan.
  7. Document configuration, secrets, and operational runbook.

Operational Impact

• Maintenance: Low-to-moderate. The package surface is small, but it depends on Nova internals and an external telephony provider. Pin versions, keep config in environment/secrets management, and monitor upstream releases and Zadarma API changes.
• Support: Likely community/GitHub support rather than enterprise SLA. Assign an internal owner for the integration and define escalation to Zadarma for telephony/API issues. Do not rely on the vendor’s “ready for production” statement as a support guarantee.
• Scaling: Webhook verification itself should be lightweight, but webhook volume and any synchronous processing can affect response times. Keep webhook handlers stateless, queue non-critical work, and monitor Zadarma rate limits and Nova admin usage.
• Failure modes: Signature mismatch after secret rotation, stale config cache, missing Nova asset publication, webhook route blocked by CSRF/auth middleware, widget layout/position regressions, and Zadarma outages. Add alerting for webhook failures and document retry/dead-letter handling.
• Ramp-up: Laravel developers should ramp quickly. TPM/product operations need to coordinate telephony account setup, webhook security, Nova deployment, and runbook ownership. Budget time for staging validation because the major-version refactor is not fully described in the release notes.