README

A simple and flexible authentication package for Laravel applications with JWT support. This package provides a complete authentication flow with login, registration, token refresh, and logout functionality.

Features

JWT-based authentication
Login and registration endpoints
Token refresh mechanism
Secure logout with token blacklisting
Configurable token expiration times
Flexible credential validation

Requirements

PHP 8.2 or higher
Laravel 12.x
Tymon JWT Auth package

Installation

1. Install the package via Composer

composer require cofa/laravel-authentication-flow

2. Configuration (Optional)

The package comes with default configuration that will be automatically merged. If you want to customize the settings, publish the configuration file:

php artisan vendor:publish --provider="Cofa\LaravelAuthenticationFlow\ApiAuthServiceProvider" --tag="config"

This will create a config/apiauth.php file in your application that you can modify.

JWT Configuration

1. JWT Setup

The tymon/jwt-auth package is automatically installed as a dependency. Laravel will handle the provider registration automatically.

2. Generate JWT Secret Key

Generate a secret key for JWT:

php artisan jwt:secret

This will update your .env file with a JWT_SECRET value.

3. Configure Auth Guard

Update your config/auth.php file to use the JWT guard:

'guards' => [
    // ...
    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

4. Update User Model

Update your User model to implement the JWT interface:

<?php

namespace App\Models;

use Tymon\JWTAuth\Contracts\JWTSubject;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;

class User extends Authenticatable implements JWTSubject
{
    use Notifiable;

    // ...

    /**
     * Get the identifier that will be stored in the subject claim of the JWT.
     *
     * @return mixed
     */
    public function getJWTIdentifier()
    {
        return $this->getKey();
    }

    /**
     * Return a key value array, containing any custom claims to be added to the JWT.
     *
     * @return array
     */
    public function getJWTCustomClaims()
    {
        return [];
    }
}

Configuration Options

You can customize the authentication behavior by modifying the config/apiauth.php file:

return [
    'token_ttl' => 60,         // Access token lifetime in minutes
    'refresh_ttl' => 10080,     // Refresh token lifetime in minutes (7 days)
    'guard' => 'api',           // The authentication guard to use
];

Usage

The package provides the following API endpoints:

Authentication Routes

All routes are prefixed with /auth:

POST /auth/login - Login with credentials
POST /auth/register - Register a new user
POST /auth/refresh-token - Refresh access token
POST /auth/logout - Logout and invalidate tokens

Example Requests

Login

POST /auth/login
Content-Type: application/json

{
    "email": "user@example.com",
    "password": "YourPassword123!"
}

Response:

{
    "profile": {
        "id": 1,
        "name": "John Doe",
        "email": "user@example.com",
        "createdAt": "2023-01-01T00:00:00.000000Z",
        "updatedAt": "2023-01-01T00:00:00.000000Z"
    },
    "credentials": {
        "accessToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "expiresIn": "2023-01-01T01:00:00.000000Z",
        "refreshToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
        "refreshExpiresIn": "2023-01-08T00:00:00.000000Z"
    }
}

Refresh Token

POST /auth/refresh-token
Content-Type: application/json

{
    "refreshToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9..."
}