pushery / legal-consent-for-laravel

v0.36.0 2026-09-17 10:46 UTC

Requires

• php: ^8.4
• ext-ctype: *
• ext-dom: *
• ext-filter: *
• ext-hash: *
• ext-json: *
• ext-libxml: *
• ext-mbstring: *
• laravel/framework: ^13.0
• league/commonmark: ^2.9

Requires (Dev)

• cweagans/composer-patches: ^2.0
• larastan/larastan: 3.11.0
• laravel/ai: ^0.11.2
• laravel/boost: ^2.9
• laravel/mcp: ^1.0
• laravel/pao: ^1.1
• laravel/pint: ^1.0
• livewire/livewire: ^4.3
• orchestra/testbench: ^11.0
• pestphp/pest: ^5.0
• pestphp/pest-plugin-agent: ^5.0
• pestphp/pest-plugin-browser: ^5.0
• pestphp/pest-plugin-laravel: ^5.0
• pestphp/pest-plugin-mutate: ^5.0.1
• pestphp/pest-plugin-phpstan: 5.2.1
• pestphp/pest-plugin-rector: ^5.0
• pestphp/pest-plugin-type-coverage: ^5.0
• pushery/wirekit: ^2.47.0
• rector/rector: 2.6.6
• spaze/phpstan-disallowed-calls: 4.14.0

Suggests

• laravel/fortify: Record registration consent inside the account-creating request (Way A).
• livewire/livewire: Opt-in reactive UI: the ReConsentForm, ConsentSettings, LegalTextManager and LegalTextEditor components (publish the plain or WireKit-flavored views). The last two are the only in-app way to author and release a legal text.
• phpunit/phpunit: Assertions for Consent::fake(): the in-memory double calls PHPUnit\Framework\Assert, so every assert*() method needs PHPUnit on the class path. Any Pest or PHPUnit test toolchain already brings it.
• pushery/wirekit: WireKit-native view variant, 2.47.0 or newer: publish --tag=legal-consent-wirekit, or leave ui.variant on its 'auto' default and the themed views are served as soon as the package is installed.

MIT

• laravel

Published on Packagist.org on 2026-09-17 10:46 UTC

README

Legal Consent for Laravel

Court-proof, versioned legal consent for Laravel. It is a document-acceptance ledger: the package renders and proves your legal texts — it does not own them.

A registration does three legally distinct things — accepting a contract, taking notice of a privacy notice, and giving a real consent — and treating them as one "I accept everything" checkbox is a common, and real, GDPR violation. This package keeps them apart, and proves acceptance the way the law requires (Art. 7(1); EDPB 05/2020 §108): it stores the exact text a user was shown, its version and hash, and the server-side context — not just a timestamp.

Installation

composer require pushery/legal-consent-for-laravel

PHP 8.4+ · Laravel 13 · SQLite, PostgreSQL, and MySQL 8.4 LTS — every database-touching path is tested against a real PostgreSQL and a real MySQL, not just SQLite.

What it does

• Append-only audit ledger — every acceptance, acknowledgment, and withdrawal is one immutable row with denormalized proof, hardened by a database trigger and an app-layer guard.
• Versioned documents — a SHA-256 hash detects a change; you classify how it must be communicated; only a core contract change forces active re-consent.
• Four notice modes — silent editorial, announced-but-never-blocking, deemed consent with an objection window (§ 308 Nr. 5 BGB), and a hard re-consent gate. The three that announce carry delivery proof; the silent one announces nothing, so there is nothing to prove.
• Interchangeable content sources — Markdown files, or an admin-maintained draft store reviewed per locale before a publish freezes it.
• Fortify-optional — three of the four ways to record consent replace Fortify's own flow: a trait, an event listener, or a headless JSON API. laravel/fortify is never required.
• Optional, off by default — a tamper-evidence hash chain, an Art. 8 age gate, and multi-tenancy scoping, each a single config switch.
• Optional reactive UI — plain Blade stubs by default; opt-in Livewire components and a WireKit-flavored variant, with no hard Livewire or Flux dependency.

Documentation

Full docs at docs.pushery.com/legal-consent-for-laravel.

• Installation — requirements, the publish tags, and the two groups that stay separate because publishing them unasked would destroy data.
• Quick start — write a text, publish a version, give a model a ledger, switch the gate on.
• Recording consent — the four ways to write the ledger, the registration checklist, and the accept-time hash guard.
• The four notice modes — how a change is classified, announced, and only sometimes enforced, with a worked example for each of the three that announce.
• Configuration reference — every key, its default, and what it decides.
• Testing your integration — Consent::fake(), so your tests need none of this package's tables.

Quality bar

Every change is held to Laravel Pint, Larastan at max, Rector, and a test suite at 100% line and type coverage, plus a real-browser end-to-end suite and cross-engine tests against a real PostgreSQL and MySQL 8.4 — the engines it runs on in production. That gate runs before every release. Mutation testing runs on its own schedule and never gates a release: a score is a measurement to act on, not a number to hold a version behind.

The suite is not part of the published package: the tests and their PHPUnit configuration stay in the development repository, so composer test has nothing to run from an installed copy. See CONTRIBUTING.md.

Security

Please review the security policy and report vulnerabilities privately rather than opening a public issue.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.