README

Sign in to a Laravel app with your Glue Google account, through Glue's OAuth proxy. The Laravel sibling of glue-agency/craft-glue-auth and glue-agency/m2-glue-auth, speaking the same proxy contract.

The app holds no client id and no client secret. It is a public client: PKCE (S256) proves that the app finishing a sign-in is the one that started it.

Requirements

PHP 8.1+, Laravel 8 through 12. The suite runs against every major.

Installation

composer require glue-agency/laravel-glue-auth
php artisan migrate

The service provider is auto-discovered. Three tables are added: glue_auth_requests (sign-ins in progress), glue_auth_identities (local user ↔ Google account) and glue_auth_login_history.

The callback is /glue-auth/callback, built from APP_URL rather than the incoming request so one app always sends one value — set APP_URL to how the app is really served, per environment.

Every setting, and what it is for, is documented in config/glue-auth.php. Publish it with php artisan vendor:publish --tag=glue-auth-config only to change one.

Add the sign-in entry point

The package ships no markup. Craft has one fixed CP login screen, so its plugin can inject exact HTML; Laravel apps do not — Blade, Inertia, laravel/ui and headless all differ.

What it gives you instead is $glueAuth, shared with every view:


`$glueAuth->enabled()`	is sign-on on
`$glueAuth->url()`	where the button points
`$glueAuth->label()`	translated, or write your own
`$glueAuth->icon()`	the Glue mark as inline SVG — no published asset, no build step
`$glueAuth->icon([...])`	the same, with attributes of your own on the root element
`$glueAuth->toArray()`	`enabled`, `url`, `label` and `icon` together, for Inertia or JSON

Guard the variable, not the class

Always test isset($glueAuth) first:

@if (isset($glueAuth) && $glueAuth->enabled())
    <a href="{{ $glueAuth->url() }}" title="{{ $glueAuth->label() }}">
        {!! $glueAuth->icon() !!}
    </a>
@endif

That template carries no reference to this package, so it renders fine in an app where the package is not installed — there is simply no variable. Calling the facade instead (GlueAgency\GlueAuth\Facades\GlueAuth::enabled()) is a hard class reference that fatals the whole page the moment the package is removed, which is the last thing you want on a login screen. Use the facade in PHP, $glueAuth in templates.

Inertia

// AppServiceProvider::boot()
if (class_exists(GlueAgency\GlueAuth\Facades\GlueAuth::class)) {
    Inertia::share('glueAuth', fn () => GlueAgency\GlueAuth\Facades\GlueAuth::toArray());
}

<a v-if="$page.props.glueAuth?.enabled" :href="$page.props.glueAuth.url">
    <span v-html="$page.props.glueAuth.icon" />
    {{ $page.props.glueAuth.label }}
</a>

Anything else — a bare link to route('glue-auth.login') is enough on its own.

Dutch and English copy ships with the package; publish with --tag=glue-auth-lang.

New user attributes

attributes is the one setting a .env cannot express: what to set on a user this package creates, on top of name, email, an unusable password and email_verified_at.

// config/glue-auth.php
'attributes' => ['is_admin' => true],

Anything the users table has no column for is dropped, so one list carries between apps.

glue-agency / laravel-glue-auth

Package info

Security

Statistics