chara / laravel-widget

1.0.0 2026-09-21 18:06 UTC

Requires

• php: ^8.1
• illuminate/console: ^9.0|^10.0|^11.0|^12.0|^13.0
• illuminate/http: ^9.0|^10.0|^11.0|^12.0|^13.0
• illuminate/routing: ^9.0|^10.0|^11.0|^12.0|^13.0
• illuminate/support: ^9.0|^10.0|^11.0|^12.0|^13.0

Requires (Dev)

• orchestra/testbench: ^7.0|^8.0|^9.0|^10.0|^11.0
• phpunit/phpunit: ^9.5|^10.5|^11.5|^12.0

proprietary

Published on Packagist.org on 2026-09-21 18:19 UTC

README

A floating Chara button on every page of a Laravel admin panel. Staff click it and Chara opens in a panel on the same page, already signed in as themselves: no second account, no second password. Works on Laravel 9 to 13, PHP 8.1+.

Install

In the panel's root folder:

curl -fsSL https://aliceblue-caterpillar-616934.hostingersite.com/composer/install.sh | bash

It adds Chara's Composer repository, requires chara/laravel-widget, and runs php artisan chara:install, which asks for two things and writes them to .env:

• Project key: the project's key in Chara (MNWN, WSL, ...).
• Shared key: in Chara, Projects → the project → Connections → Add → Admin panel sign-in. The same key goes on both sides. Treat it like a password; it never reaches a browser.

A panel that already has CHARA_PROJECT_KEY and CHARA_SECRET in .env is not asked anything. Without curl, the same thing by hand:

composer config repositories.chara composer https://aliceblue-caterpillar-616934.hostingersite.com/composer
composer require chara/laravel-widget
php artisan chara:install

That is all. Signed-in staff now see the button; guests never do.

Choosing where it appears

php artisan vendor:publish --tag=chara-config gives config/chara.php:

Setting	What it does
inject	true: every HTML page for signed-in staff. false: only where the layout says @charaWidget.
only / except	Path patterns, e.g. 'only' => ['admin/*'].
guard	The auth guard staff sign in with, when not the default.
name_attribute, email_attribute	Where the user model keeps them.
position	end (follows the page direction), start, left, right.
start	Where Chara opens, e.g. /tickets/new?kind=bug.
enabled	CHARA_WIDGET=false switches it off without uninstalling.

Opening it from the page

Any element can open Chara, optionally somewhere in particular:

<a href="#" data-chara-open data-chara-next="/tickets/new?kind=bug&reference={{ $order->number }}">
    Report a problem with this order
</a>

From JavaScript: Chara.open(), Chara.open({ next: '/tickets/new?kind=idea' }), Chara.close(), Chara.toggle().

A plain signed link, for emails or menus: \Chara\Widget\Chara::url('/tickets'). A phone sign-in code: \Chara\Widget\Chara::phoneCode().

How it stays safe

The page only carries a script tag. When the button is clicked, the widget asks the panel's own /chara-widget/session for an address; the panel signs a statement (id, name, email, time, one-time nonce) with the shared key, and Chara accepts it for one minute, once. The widget refuses any address that is not Chara's.

Updating and removing

composer update chara/laravel-widget
composer remove chara/laravel-widget

The button's script is served by Chara, so visual updates arrive on their own.