pushery/legal-consent-for-laravel

Court-proof, versioned legal consent for Laravel — GDPR-correct separation of contract acceptance, notice acknowledgement, and consent, with an append-only audit trail.

v0.10.0 2026-08-03 14:35 UTC

Requires

• php: ^8.4
• ext-dom: *
• ext-json: *
• ext-libxml: *
• illuminate/auth: ^13.0
• illuminate/bus: ^13.0
• illuminate/cache: ^13.0
• illuminate/collections: ^13.0
• illuminate/console: ^13.0
• illuminate/contracts: ^13.0
• illuminate/database: ^13.0
• illuminate/http: ^13.0
• illuminate/log: ^13.0
• illuminate/notifications: ^13.0
• illuminate/routing: ^13.0
• illuminate/support: ^13.0
• league/commonmark: ^2.7

Requires (Dev)

• cweagans/composer-patches: ^1.7
• larastan/larastan: ^3.0
• laravel/pao: ^1.1
• laravel/pint: ^1.0
• livewire/livewire: ^4.3
• orchestra/testbench: ^11.0
• pestphp/pest: ^5.0
• pestphp/pest-plugin-agent: ^5.0
• pestphp/pest-plugin-browser: ^5.0
• pestphp/pest-plugin-laravel: ^5.0
• pestphp/pest-plugin-mutate: ^5.0
• pestphp/pest-plugin-phpstan: ^5.0
• pestphp/pest-plugin-rector: ^5.0
• pestphp/pest-plugin-type-coverage: ^5.0
• pushery/wirekit: ^2.17.1
• rector/rector: ^2.0
• spaze/phpstan-disallowed-calls: ^4.12

Suggests

• laravel/fortify: Record registration consent inside the account-creating request (Way A).
• livewire/livewire: Opt-in reactive UI: the ReConsentForm and ConsentSettings inline components (publish the plain or WireKit-flavored views).

MIT

• laravel

Published on Packagist.org on 2026-08-03 14:35 UTC

README

Legal Consent for Laravel

Court-proof, versioned legal consent for Laravel. It is a document-acceptance ledger: the package renders and proves your legal texts — it does not own them.

A registration does three legally distinct things — accepting a contract, taking notice of a privacy notice, and giving a real consent — and treating them as one "I accept everything" checkbox is a common, and real, GDPR violation. This package keeps them apart, and proves acceptance the way the law requires (Art. 7(1); EDPB 05/2020 §108): it stores the exact text a user was shown, its version and hash, and the server-side context — not just a timestamp.

Installation

composer require pushery/legal-consent-for-laravel

PHP 8.4+ · Laravel 13 · SQLite, PostgreSQL, and MySQL 8.4 LTS — every database-touching path is tested against real PostgreSQL and real MySQL, not just SQLite.

What it does

• Append-only audit ledger — every acceptance, acknowledgement, and withdrawal is one immutable row with denormalized proof, hardened by a database trigger and an app-layer guard.
• Versioned documents — a SHA-256 hash detects a change; you classify how it must be communicated; only a core contract change forces active re-consent.
• Four notice modes — silent editorial, announced-but-never-blocking, deemed consent with an objection window (§ 308 Nr. 5 BGB), and a hard re-consent gate — each with delivery proof.
• Interchangeable content sources — Markdown files, or an admin-maintained draft store reviewed per locale before a publish freezes it.
• Fortify-optional — record consent three ways: a trait, an event listener, or a headless JSON API. laravel/fortify is never required.
• Optional, off by default — a tamper-evidence hash chain, an Art. 8 age gate, and multi-tenancy scoping, each a single config switch.
• Optional reactive UI — plain Blade stubs by default; opt-in Livewire components and a WireKit-flavored variant, with no hard Livewire or Flux dependency.

Documentation

Full docs at docs.pushery.com/legal-consent-for-laravel.

• Installation — requirements, the publish tags, and the two groups that stay separate because publishing them unasked would destroy data.
• Quick start — write a text, publish a version, give a model a ledger, switch the gate on.
• Recording consent — the three ways to write the ledger, the registration checklist, and the accept-time hash guard.
• The four notice modes — how a change is classified, announced, and only sometimes enforced, with a worked example each.
• Configuration reference — every key, its default, and what it decides.

Quality bar

Every change is held to Laravel Pint, Larastan at max, Rector, and a test suite at 100% line and type coverage, plus mutation testing, a real-browser end-to-end suite, and cross-engine tests against real PostgreSQL and MySQL 8.4 — the engines it runs on in production. The full gate runs before every release.

The suite is not part of the published package: tests/ and the PHPUnit configuration stay in the development repository, so composer test has nothing to run from an installed copy. See CONTRIBUTING.md.

Security

Please review the security policy and report vulnerabilities privately rather than opening a public issue.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.