mortezamasumi/fb-passwd

Force users to change their password in Filament panels.

v5.1.3 2026-08-12 04:55 UTC

Requires

• php: ^8.5
• filament/filament: ^5.0
• mortezamasumi/fb-essentials: ^5.0
• spatie/laravel-package-tools: ^1.0

Requires (Dev)

• filament/upgrade: ^5.0
• larastan/larastan: ^3.10
• laravel/pint: ^1.30
• orchestra/testbench: ^10.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-arch: ^4.0
• pestphp/pest-plugin-browser: ^4.0
• pestphp/pest-plugin-laravel: ^4.0
• pestphp/pest-plugin-livewire: ^4.0
• phpstan/phpstan: ^2.2

MIT

• Morteza Masumi

• laravel
• filament
• mortezamasumi
• fb-passwd

Published on Packagist.org on 2026-08-12 04:57 UTC

README

A Filament panel plugin that forces users to change their password before they can use the panel. When a user's force_change_password flag is set, every panel request redirects to a dedicated change-password page until they update it.

Features

• Force password change — middleware redirects forced users to the change-password page on every panel request
• Locked-down page — once forced, the topbar is hidden and the only action is updating the password or logging out
• Rate limiting — the save action is throttled to 2 attempts per request window
• Password policy — enforces Laravel's default password rules (production only) and requires confirmation
• User menu entry — a "Change password" action in the panel user menu, always available
• Localized — ships English and Persian translations

Installation

composer require mortezamasumi/fb-passwd

Add the plugin to your Filament panel provider:

use Mortezamasumi\FbPasswd\FbPasswdPlugin;

public function panel(Panel $panel): Panel
{
    return $panel
        ->plugins([
            FbPasswdPlugin::make(),
        ]);
}

Configuration

Add a force_change_password boolean column to your user table, and set it to true when you want a user to change their password on next login:

Schema::table('users', function (Blueprint $table) {
    $table->boolean('force_change_password')->default(false);
});

$user->force_change_password = true;
$user->save();

The package ships no config file of its own; the flag is read straight from the authenticated user.

Usage

Once the plugin is registered, everything is automatic:

• A forced user hitting any panel route is redirected to change-password.
• After a successful change, the flag is cleared, the session is regenerated, and the user is sent to the login page to sign back in.
• Non-forced users can still change their password anytime via the user menu.

Translations

The package ships English (resources/lang/en) and Persian (resources/lang/fa) translations under the fb-passwd namespace, loaded automatically.

Support policy

PHP	Laravel
8.3	12

Testing

composer test

The test suite covers the redirect behaviour (including with multiple users), the user menu entry, and the password-change flow using an in-memory SQLite database.

Contributing

Please see CONTRIBUTING for details.

Security

If you discover a security vulnerability, please review our security policy on how to report it.

Changelog

Please see CHANGELOG for recent changes.

License

The MIT License (MIT). See LICENSE.md for details.