[n4ff4h]

javaabu/auth v3.0: a rewrite around user types, matching Laravel's current starter kits, with multi-auth at the centre. Tracked in n4ff4h#14 (developed on the fork because the orchestrating account has read-only access here).

What's in it

• User types (config('javaabu-auth.user_types'), UserTypes::register()): each kind of user has its own model, guard, password broker, route names, home, Blade/Inertia stack, layouts, features, two-factor mode, lockout limit and login methods. Nothing assumes web or App\Models\User.
• Routes from macros: Route::authRoutes('admin', ['prefix' => 'admin']) registers login/logout, registration, password reset, email verification, password confirmation, the 2FA challenge, passkeys, account status, required password change, and the profile and security pages, with starter-kit route names (admin.login, admin.password.request, …). Also Route::authApiRoutes() and Route::userAccountActions().
• Controllers, actions and responses in the starter-kit shape: actions behind contracts (CreatesNewUsers, …), controllers overridable from config, rebindable responses, auth.type:{type} middleware for app pages, password confirmation kept per user type.
• Security: rate limits per type/username/IP, timeboxed password checks, account lockout after failed logins (v2 behaviour, kept), single-use TOTP codes, cross-type checks everywhere (a user can't log in on the admin page, finish another type's 2FA challenge, reuse another type's confirmation, passkey or token).
• Two-factor authentication: TOTP + recovery codes, off/optional/required per type, in laravel/fortify's column format.
• Passkeys with Laravel's own laravel/passkeys: login, confirmation and management for every type, one morph table. Tested end to end with a software authenticator (real P-256 keys and CBOR).
• API: Sanctum, Passport or both (php artisan auth:install --api=…), Sanctum token logins with 2FA, Passport per-provider tokens, personal access tokens on the security page.
• Admin account actions: unlock, reset 2FA, require a new password, log out everywhere, behind UserAccountPolicy and permissions registered through javaabu/permissions.
• Extension points for javaabu/mobile-verification and other packages: LoginMethod + StartAuthenticatedSession for other ways to log in, and account navigation links (UserTypes::accountLink('mobile-number', 'Mobile number'), per type with $type->accountLink() / withoutAccountLink()), shown in Blade and React wherever the type has the route (Let packages add links to the account navigation n4ff4h/auth#15).
• Pages in Blade (javaabu/forms v2) and Inertia React (@javaabu/forms, through javaabu/manifest), same props, Dhivehi (lang/dv.json) and right to left.
• Docs: docs/ (including a "For package authors" page), llms.txt, Laravel Boost guideline and skill, AGENTS.md, CHANGELOG.md. docs/, llms.txt and resources/boost ship in the Composer package (no longer export-ignored), so assistants find them under vendor/javaabu/auth (docs/ is export-ignored, but llms.txt and the Boost skill point at vendor/javaabu/auth/docs n4ff4h/auth#16).

Decisions and why are on the issues: not building on Fortify (n4ff4h#2), laravel/passkeys (n4ff4h#5), gate abilities instead of a model policy (n4ff4h#12), no javaabu/stencil for these small forms (n4ff4h#11), javaabu/passport dropped (n4ff4h#6).

Upgrading from v2

Breaking. Full guide: docs/upgrading.md. The short version:

• PHP 8.4+, Laravel 12+. No longer required: laravel/ui, javaabu/helpers, javaabu/activitylog, javaabu/passport, javaabu/schema, spatie/laravel-medialibrary.
• Config moves from config/auth.php to config/javaabu-auth.php; describe each user type there. Guards, providers and brokers stay in config/auth.php.
• Delete the controllers that extended Javaabu\Auth\Http\Controllers\Auth\* and their routes; call Route::authRoutes() per type. Route names follow the starter kits (password.new-password is now password.required).
• Javaabu\Auth\User → Javaabu\Auth\Models\User (built from traits); the UserContract methods (guardName(), homeUrl(), …) go away in favour of the user type. Add the 2FA columns with UserSchema::twoFactorColumns().
• Middleware: auth:x + active:x + password-update-not-required:x → auth.type:{type}; password.confirm → auth.password.confirm:{type}.
• Views are shipped; point javaabu-auth.layouts at your layouts, or publish them.
• Session\Session and Agent move to Sessions\; Events\PasswordChanged is now PasswordUpdated; translations are JSON.
• Removed: the new_email verification flow, the media-library avatar, IsAdminModel/LogsActivity on the model.

Checks

CI on the fork is green: Pint, PHP 8.4/8.5 × Laravel 12/13 × lowest/stable, the React pages (typecheck + Vitest), and a run without the optional packages (Inertia, Sanctum, Passport, activitylog). 146 PHP tests, 12 JS tests.

For you

• Review and merge (Actions on a fork PR may need approval).
• Codecov: the org needs CODECOV_TOKEN for the coverage upload and badge.
• Register the package with docs.javaabu.com (Register with Javaabu Docs (docs.javaabu.com) n4ff4h/auth#13).
• Have a Dhivehi speaker check the strings listed in docs/advanced-usage/translations.md.
• The Inertia pages were tested with PHPUnit and Vitest, not in a real browser; passkeys likewise (software authenticator, not a real device).
• Tag and release when ready.

🤖 Generated with Claude Code