Filament Auth Laravel Package

Getting Started

zvive/filament-auth is a Filament (v2-era) plugin that replaces Filament's stock user management with a fuller auth admin: users, roles, permissions, plus a dashboard widget, impersonation, and optional Bouncer-backed authorization.

Minimal setup:

1. Require the package alongside filament/filament (and silber/bouncer only if you intend to use the Bouncer driver).
2. Publish and run migrations: php artisan vendor:publish --tag="filament-auth-migrations" then php artisan migrate.
3. Publish the config: php artisan vendor:publish --tag="filament-auth-config" — this file is the first place to look, not the source. In 2.3.x it controls which resource classes are registered, whether the LatestUsers widget is enabled, its sort order, and which authorization driver is used.
4. Register the plugin in your panel provider (->plugin(FilamentAuthPlugin::make()) or the service-provider route, depending on how you installed it) and clear caches.
5. Seed or create one super-admin, then log in and visit the Users resource.

First use case worth wiring up: swap the default User resource for the package's so you get role/permission assignment and impersonation without writing CRUD yourself, then keep your own User model extending the package's expectations (name/email fields, FilamentUser contract).

Implementation Patterns

Config-driven resource substitution. Since 2.3.2 the page resources read their class from config (set page resources to use config value for resource). The intended pattern is: extend the package's resource/page classes, point the config keys at your subclasses, and keep all customization out of vendor/. This is the cleanest extension seam the package offers.

Widget as an opt-in dashboard element. Enable/disable and sort the LatestUsers widget from config rather than editing the dashboard. Sort order is now configurable (2.3.2), so it can sit alongside your own widgets deterministically.

React to lifecycle events. The new create/update event triggers let you attach listeners for audit logging, welcome emails, or syncing external identity providers without forking the resource pages. Register listeners in an EventServiceProvider and assume the event payload carries the affected user model (verify the exact class before relying on it in production).

Impersonation as a support workflow. Typical usage: an admin impersonates a user from the users table to reproduce a bug, with the action gated by a policy/gate so only trusted roles see it. Treat impersonation as a privileged action — log it via the new events and ensure your "stop impersonating" path restores the original guard session.

Bouncer as an alternative driver. If your app already standardizes on Bouncer for abilities, enable that option in config instead of maintaining a parallel permission table. Don't mix Bouncer abilities and the package's native roles in the same authorization checks.

Locale and timezone delegation. Date rendering now follows Filament core's timezone handling; translations ship with Vietnamese. For other locales, publish the lang files and translate keys rather than hardcoding strings in overridden views.

Filtering and table actions. The users table uses Filament's TernaryFilter for tristate fields (e.g. verified/unverified/any) and Filament::makeTableAction() for actions — mirror that style in your own resources so behavior stays consistent across admin upgrades.

Gotchas and Tips

• Breaking change in 2.3.2: date display. Any published views, custom columns, or Blade partials that render created_at/last_login must be updated to the new Filament-core timezone formatting. Audit your overrides before deploying — this is the one change that can silently produce wrong-looking timestamps.
• tableActions was removed. If you extended the users table and referenced the old tableActions property/array, migrate to the new Filament::makeTableAction() style. This will fatal on the users page rather than degrade gracefully.
• mount is no longer static. Subclassed pages or tests that called mount statically need updating. Rare, but it fails loudly in tests rather than at runtime.
• Republish config cautiously. The config file had a spelling fix in 2.3.2. Re-running vendor:publish will overwrite your customized config — diff the shipped file against yours and merge by hand, or you'll silently lose resource-class overrides and widget toggles.
• Widget pagination was removed. If you rely on the LatestUsers widget to page through a large user base, it now shows only the configured slice. Point admins at the Users resource for anything beyond the head of the list; raise the limit only after checking query cost on big tables.
• Laravel 8 compatibility was patched on the widget. If you're pinned to Laravel 8, stay at ≥2.3.2; earlier builds can throw on the widget's query builder usage.
• Resource class resolution is indirect. Because pages now pull their resource from config, a typo'd class name in config produces confusing "page not found"/binding errors rather than a clear missing-class exception. When a resource 404s, check config first.
• Impersonation needs guard rails. Confirm the impersonation route/action is behind a gate, that it's excluded from any "log out everywhere" flows, and that it doesn't leak into queued jobs (queued work dispatched during impersonation will run as the impersonated user).
• Default display name on edit. Edits now default to the user's name rather than a generic label — if you have users without names, provide a fallback accessor or the edit page titles will look empty.
• Bouncer is optional, not bundled. Enabling the Bouncer option without installing/registering Bouncer's service provider fails at runtime. Keep migrations for the permission tables in sync with whichever driver you choose, and don't switch drivers on a live database without a migration plan for existing grants.
• Debugging tip: with heavy config indirection, php artisan config:clear plus a dd() of the resolved resource class in your panel provider is faster than tracing through vendor code when a page misbehaves after an upgrade.