README

A drop-in authentication package for Laravel with publishable views, configurable routes, role/permission access control, and optional API, 2FA, OTP, passkey, and social login features.

Requirements

PHP 8.3+
Laravel 12 or 13
SQLite/MySQL/PostgreSQL for migrations

Optional packages (enable the matching feature in config):

Feature	Package
API bearer tokens	`laravel/sanctum`
TOTP / 2FA	`pragmarx/google2fa`
Social login	`laravel/socialite`
Passkeys	`web-auth/webauthn-lib` (experimental)

Installation

composer require rawbinn/lp-auth
php artisan lp-auth:install
php artisan migrate

lp-auth:install publishes config, views, language files, and migrations.

Quick start

1. Extend the user model

namespace App\Models;

use Rawbinn\Auth\Models\User as BaseUser;

class User extends BaseUser
{
    //
}

Point Laravel auth at your model in config/auth.php:

'providers' => [
    'users' => [
        'driver' => 'eloquent',
        'model' => App\Models\User::class,
    ],
],

2. Configure features

// config/lp-auth.php
'features' => [
    'login' => true,
    'register' => true,
    'password_reset' => true,
    'roles_permissions' => true,
    'two_factor' => false,
    'otp' => false,
    'passkey' => false,
    'google' => false,
    'social' => false,
],

3. Roles and permissions

access()->hasRole('Administrator');
access()->allow('manage-users');

Blade directives:

@role('Administrator')
    ...
@endrole

@permission('view-backend')
    ...
@endpermission

Use @endrole, @endpermission, @endroles, @endpermissions, @endneedsroles, and @endneedspermissions to close blocks. Do not use @endauth for role/permission blocks — that is reserved for Laravel's @auth directive.

4. Middleware

Route::middleware(['auth', 'lp-auth.permission:manage-users'])->group(function () {
    //
});

Legacy Larapress aliases are also registered: access.routeNeedsRole, access.routeNeedsPermission.

Routes

Web routes are enabled by default (LP_AUTH_ROUTES=true). Customize paths, prefixes, controllers, and redirects in config/lp-auth.php.

API routes live under config('lp-auth.api.prefix') (default api/auth) and require Sanctum when issuing tokens.

Disable all package routes:

LP_AUTH_ROUTES=false
LP_AUTH_API_ROUTES=false

Publishing

Tag	Description
`lp-auth-config`	Publish `config/lp-auth.php`
`lp-auth-views`	Publish Blade views
`lp-auth-lang`	Publish language files
`lp-auth-migrations`	Publish migrations
`lp-auth`	Publish everything above

Published config/lp-auth.php can be trimmed to only the values you need to override. The package merges the full default config from the package automatically.

Migrations on existing apps

The package ships a base users table migration for fresh installs. If your application already has a users table, publish migrations with:

php artisan vendor:publish --tag=lp-auth-migrations

Then keep only the additive migrations (profiles, roles, permissions, OTP, passkeys, auth columns) and skip 2014_10_12_000000_create_users_table.php.

Packagist / Git

composer require rawbinn/lp-auth

Repository: github.com/rawbinn/lp-auth

Tag releases from Git for Packagist distribution. This monorepo also exposes the package through a Composer path repository.

Testing

From the package directory:

composer install
composer test

From the monorepo root:

composer test:lp-auth

Larapress integration

Larapress consumes this package for authentication and access control. Set Larapress-specific redirects and branding in your published config/lp-auth.php.

License

MIT. See LICENSE.

rawbinn / lp-auth

Maintainers

Package info

Statistics

Security