milon / bohurupee-laravel

v0.5.5 2026-09-20 18:10 UTC

Requires

• php: ^8.2
• illuminate/support: ^12.0 || ^13.0
• laravel/socialite: ^5.16

Requires (Dev)

• orchestra/testbench: ^10.0 || ^11.0
• phpunit/phpunit: ^11.0 || ^12.0 || ^13.0

MIT

• milon

• oauth
• development
• laravel
• local
• oidc
• socialite

Published on Packagist.org on 2026-09-20 18:11 UTC

README

milon/bohurupee-laravel

Optional Laravel Socialite adapter for Bohurupee. When enabled, Socialite::driver() talks to a local Bohurupee process instead of Google, GitHub, or any other remote IdP.

Packagist · GitHub · Bohurupee

This package is dev-only. It refuses to boot when APP_ENV=production.

The screenshots are the Socialite example in the Bohurupee repo. The buttons never call Google or GitHub. Bohurupee asks which persona to continue as, then Socialite receives that user.

Requirements

• PHP 8.2 or newer
• Laravel 12 or 13 (illuminate/support ^12 or ^13)
• Laravel Socialite ^5.16
• A Bohurupee process, usually http://127.0.0.1:4190

Install

composer require milon/bohurupee-laravel --dev

The service provider is auto-discovered. Start Bohurupee, then point the app at it:

BOHURUPEE_ENABLED=true
BOHURUPEE_URL=http://127.0.0.1:4190

Keep the usual config/services.php client IDs and redirect URIs. Bohurupee accepts any local secret.

Publish the config if you prefer PHP over env:

php artisan vendor:publish --tag=bohurupee-config

Configure

Variable	Default	Meaning
BOHURUPEE_ENABLED	false	Wrap Socialite when true
BOHURUPEE_URL	http://127.0.0.1:4190	Server-side origin (token + userinfo)
BOHURUPEE_PUBLIC_URL	same as BOHURUPEE_URL	Browser authorize redirect (set when the app is in Docker)
BOHURUPEE_DRIVERS	empty	Comma-separated names to wrap. Empty wraps every Socialite::driver($name), including custom slugs
BOHURUPEE_EXCEPT	empty	Names that stay on the real provider
BOHURUPEE_ERROR_REDIRECT	/login (see below)	HTML redirect after Deny / OAuth error=

BOHURUPEE_ENABLED=true
BOHURUPEE_URL=http://127.0.0.1:4190
# BOHURUPEE_PUBLIC_URL=http://127.0.0.1:14190
# BOHURUPEE_DRIVERS=google,github
# BOHURUPEE_EXCEPT=apple
# BOHURUPEE_ERROR_REDIRECT=/login

When Laravel runs in Docker Compose and Bohurupee is a sibling service, point BOHURUPEE_URL at the internal hostname (http://bohurupee:4190) and BOHURUPEE_PUBLIC_URL at the published host port the browser can open.

Deny / OAuth errors

When the user clicks Deny (or Bohurupee returns another error= on the callback), Socialite::driver(...)->user() throws Milon\Bohurupee\OAuthErrorException instead of failing on a missing code.

The exception renders itself:

• JSON (Accept: application/json / expectsJson): 400 with error, error_description, state, provider
• HTML: redirect to BOHURUPEE_ERROR_REDIRECT, or filament.admin.auth.login / login / /login, with flash keys bohurupee_oauth_error, filament-socialite-login-error, and error

Apps can also catch the exception:

use Milon\Bohurupee\OAuthErrorException;

try {
    $user = Socialite::driver($provider)->user();
} catch (OAuthErrorException $e) {
    return response()->json($e->toArray(), 400);
}

Usage

Existing Socialite routes do not change. The factory returns a local provider for each wrapped name:

use Laravel\Socialite\Facades\Socialite;

Route::get('/login/{provider}', function (string $provider) {
    return Socialite::driver($provider)->redirect();
});

Route::get('/auth/{provider}/callback', function (string $provider) {
    $user = Socialite::driver($provider)->user();

    return [
        'id' => $user->getId(),
        'email' => $user->getEmail(),
        'name' => $user->getName(),
        'nickname' => $user->getNickname(),
        'avatar' => $user->getAvatar(),
    ];
});

Authorize, token, and userinfo are called on Bohurupee:

• GET {BOHURUPEE_URL}/{driver}/authorize
• POST {BOHURUPEE_URL}/{driver}/token
• GET {BOHURUPEE_URL}/{driver}/userinfo

Mapped fields, first match wins:

Socialite	userinfo keys
id	id, sub
email	email
name	name, display_name
nickname	nickname, login, preferred_username
avatar	picture.data.url, picture, avatar, profile_image_url, avatar_url

$user->getRaw() is the full userinfo JSON. Provider-shaped payloads are documented in the Bohurupee repo at docs/socialite.md.

Production

If BOHURUPEE_ENABLED=true and APP_ENV=production, boot throws Milon\Bohurupee\ProductionForbiddenException. Require the package as --dev and leave the flag off in deployed environments.

Tests

composer install
composer test

CI runs PHP 8.2–8.5 against Laravel 12 and 13. Tests mock HTTP, so they never call a real provider.