Confide Laravel Package

Getting Started

Confide is a Laravel 4–era authentication package. Treat the first hour as "confirm the app can still boot this package" before writing any feature code.

1. Install into an existing Laravel 4 app. In composer.json you need a Laravel 4.2-compatible release (the 0.4.x/dev-master line). Run composer require zizaco/confide, then register the service provider and facade in app/config/app.php:

'providers' => [
    'Zizaco\Confide\ConfideServiceProvider',
],
'aliases' => [
    'Confide' => 'Zizaco\Confide\ConfideFacade',
],

2. Publish config and migrations.

php artisan config:publish zizaco/confide
php artisan migrate --package="zizaco/confide"

The generated users table includes email, password, confirmation_code, confirmed, and remember-token columns. If you already have a users table, copy the relevant columns into your own migration and set user_model in app/config/packages/zizaco/confide/config.php.

3. Attach the trait to your model. This is the single most important step:

use Zizaco\Confide\ConfideUser;
use Zizaco\Confide\ConfideUserInterface;

class User extends Eloquent implements ConfideUserInterface
{
    use ConfideUser;

    protected $table = 'users';
    public $rules = [
        'username' => 'required|unique:users',
        'email'    => 'required|email|unique:users',
        'password' => 'required|min:6|confirmed',
        'password_confirmation' => 'required',
    ];
}

4. Look first at app/config/packages/zizaco/confide/config.php (user_model, email_field, login_field, email_confirmation, throttling keys), then Zizaco\Confide\Confide — that class is the real API surface (create, save, logAttempt, logout, confirm, forgotPassword, resetPassword, user, check).

5. First use case: a login/register/logout flow. Register by building the model and calling save() (Confide hashes the password and generates a confirmation code). Log in through Confide::logAttempt rather than Auth::attempt, because Confide performs its own credential, confirmation, and throttle checks.

// Registration
$user = new User;
$user->username = Input::get('username');
$user->email    = Input::get('email');
$user->password = Input::get('password');
$user->password_confirmation = Input::get('password_confirmation');

if ($user->save()) {
    return Redirect::to('login')->with('notice', 'Check your email to confirm.');
}

// Login
if (Confide::logAttempt(Input::only('email', 'password'), Input::get('remember'))) {
    return Redirect::intended('dashboard');
}

Implementation Patterns

Controller-first, not middleware-first. Confide has no built-in route filter. The typical day-to-day pattern is a UsersController with getLogin, postLogin, getLogout, getRegister, postRegister, getConfirm, forgotPassword, resetPassword, and protecting routes with a filter that calls Confide::check():

Route::filter('auth', function () {
    if (Confide::guest()) {
        return Redirect::guest('login');
    }
});

Centralize credential handling. Use Confide::logAttempt($credentials, $remember) everywhere. It respects the configured login_field (email or username), checks confirmed, and applies lockout. Do not mix Auth::attempt and Confide::logAttempt in the same app; they maintain separate code paths and can disagree about sessions and hashing.

Use the facade for state, the trait for persistence. Confide::user(), Confide::check(), and Confide::guest() are convenience wrappers; Auth::user() should return the same Eloquent model after a Confide login. Prefer one convention per codebase.

Password reminders are two separate calls. Requesting a reset emails a token; resetting verifies it:

// send
Confide::forgotPassword(Input::get('email'));

// consume
if (Confide::resetPassword(Input::get('password'), Input::get('password_confirmation'), Input::get('token'))) {
    return Redirect::to('login');
}

Email confirmation. When email_confirmation is enabled, logAttempt rejects unconfirmed users. Build a ConfirmController that calls Confide::confirm($code) or $user->confirm($code), then redirect with a friendly message. Disable confirmation in config for internal apps to remove this branch entirely.

Pair with Entrust for authorization. Confide answers "who is logged in"; Entrust (Zizaco\Entrust) answers "what may they do." Put EntrustUserTrait on the same User model and check permissions in filters or policies. This combination was the canonical Laravel 4 stack.

Testing pattern. Use database transactions or migrate in setUp. For controller tests, either seed a real user and call the login endpoint, or mock the facade:

Confide::shouldReceive('logAttempt')->once()->andReturn(true);

Prefer real-user tests for auth flows; mocks hide trait behavior (hashing, confirmation).

Extension point: if you must customize behavior, subclass the facade-backed Confide class or override trait methods on the model, then bind your class in a service provider. Avoid editing package files under vendor/.

Gotchas and Tips

• Abandoned and Laravel 4–only. Last release was 2015; there is no Laravel 5+/8+/10+ support. If this is a greenfield project, do not adopt it — use Laravel's native auth or a maintained package such as Bouncer/Spatie Permission. The assessment's opportunity score reflects a maintenance risk, not a feature gap.
• Password hashing lives in the trait's save(). The trait hashes password only when it is dirty. Bulk updates via query builder or User::update() bypass this and store plaintext. Always assign to the model and call save(), or use Confide::save($user, $attributes).
• password_confirmation must be present on the model for the confirmed validation rule to pass. Setting $user->password without $user->password_confirmation produces confusing validation errors.
• Do not double-hash. If you read $user->password and re-assign it, the trait may hash an already-hashed value. Only set plaintext passwords from request input.
• Check confirmed when debugging failed logins. logAttempt returns false for unconfirmed users with no distinct exception. Log the user's confirmed and confirmation_code state before assuming bad credentials.
• Throttling is config-driven. Inspect the lockout/throttle values in the published config if logins fail intermittently in development. Clear the related cache or attempts store when testing.
• user_model and login_field are read at runtime. Changing them in config without updating the migration/table columns causes silent failures. login_field defaults to email; switching to username requires that column and valid credentials in logAttempt.
• Remember-me tokens are handled by Confide's trait columns. If you add a custom users table, include the remember_token column or logins will not persist.
• Trait/method conflicts. If your User model already defines save(), confirm(), or getAuthIdentifier(), PHP trait resolution can shadow your method. Alias the trait method or call parent::save() carefully. The same applies when combining Confide and Entrust traits; method name collisions are the usual failure mode.
• Mass assignment. Guard password, confirmation_code, and confirmed in $guarded/$fillable to prevent them being set from request arrays. Confide does not protect these for you.
• Session regeneration and logout are not automatic in every flow. Call Session::regenerate() after successful login if your app relies on it, and verify Confide::logout() clears the remember cookie on the deployed PHP version.
• Migration drift. The package's published migration targets Laravel 4's schema builder. On newer DB drivers, timestamp defaults and index lengths can fail; copy the migration into your app and adjust before deploying.
• Debugging order: (1) is the trait on the model and the interface implemented? (2) does the users table have all required columns? (3) does Confide::user() return a model after login? (4) is the user confirmed? (5) does config user_model point to the right class? Most issues resolve here.
• Migration path off Confide: replace Confide::logAttempt with Auth::attempt, use Laravel's PasswordBroker for resets, and port confirmation to a signed URL or middleware. Do this behind feature tests that assert login, logout, reset, and authorization behavior before deleting the package.