Skip to content

v3: mobile login, registration and verification on javaabu/auth v3 - #2

Open
n4ff4h wants to merge 7 commits into
Javaabu:mainfrom
n4ff4h:next-gen
Open

v3: mobile login, registration and verification on javaabu/auth v3#2
n4ff4h wants to merge 7 commits into
Javaabu:mainfrom
n4ff4h:next-gen

Conversation

@n4ff4h

@n4ff4h n4ff4h commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

v3: mobile login, registration and verification on javaabu/auth v3

A rewrite of javaabu/mobile-verification for the next-gen packages. Tracked on n4ff4h#9 (the fork), where every issue has its decisions.

What's in it

  • Built on javaabu/auth v3. Mobile login is a javaabu/auth LoginMethod (MobileLoginMethod) of any user type. Route::authRoutes() registers it, and the login page links to it. Once the code is right, auth's StartAuthenticatedSession takes over, so two-factor authentication still applies (skip_two_factor opts out). Nothing assumes the web guard or App\Models\User.
  • Mobile registration. Number, then code, then a javaabu/stencil details form (MobileRegistrationForm, swappable in config). The user is created by a CreatesUsersFromMobileNumbers action; then Registered fires and the user is logged in.
  • Verifying and changing numbers. The Route::mobileNumberRoutes() account page, linked from javaabu/auth's account navigation for every type that has it (UserTypes::accountLink(), Let packages add links to the account navigation n4ff4h/auth#15), and mobile.verified:{type} middleware for pages that need a verified number.
  • Codes.
    • From random_int(), stored hashed, single use, and invalid once a newer code is sent.
    • Configurable expiry and length, and a resend interval.
    • A lock after too many wrong codes, plus named rate limiters per IP.
    • request_code_rules adds extra checks such as a captcha.
  • SMS through javaabu/sms-notifications: one translated VerificationCodeNotification.
  • API.
    • Route::mobileApiRoutes() issues Sanctum or Passport personal tokens through auth's ApiTokens.
    • The Passport mobile grant is optional. It picks the user type from the client's provider.
    • Both check account status and two-factor.
  • Admin actions. Route::mobileNumberActions() lets admins change a number without a code, unlock it, or remove it. They sit behind MobileNumberPolicy and per-type javaabu/permissions permissions.
  • Pages in Blade (javaabu/forms v2) and Inertia React (@javaabu/forms + Onu, shipped through javaabu/manifest). They follow the user type's stack.
  • Dhivehi for every string, and RTL: logical CSS only, and numbers kept left to right.
  • Docs and AI files. Docusaurus docs (including docs/upgrading.md), llms.txt, a Laravel Boost guideline and skill, and AGENTS.md.
  • Foundations.
    • PHP 8.4/8.5 × Laravel 12/13 × lowest/stable, plus Pint and Codecov.
    • A run without the optional packages, and a React job.
    • A check that javaabu/helpers and javaabu/settings v1 stay out of the production tree.

Upgrade notes (full guide in docs/upgrading.md)

  • Requires PHP 8.4+, Laravel 12+ and javaabu/auth v3. javaabu/helpers, javaabu/activitylog and javaabu/laravel-recaptcha are dropped. Passport is now optional.
  • The mobile_numbers table is unchanged. The migration skips the table if it already exists.
  • v2's controller traits are gone (LoginsWithMobileNumber, RegistersWithMobileNumber, UpdatesMobileNumber, …). Add MobileLoginMethod to the user types and use the route macros instead. The URLs change to login/mobile, register/mobile and settings/mobile-number.
  • Traits\InteractsWithMobileNumbers moves to Concerns\InteractsWithMobileNumbers.
  • Several MobileNumber attributes became methods, for example is_locked → isLocked().
  • Config keys were renamed: number_format_validator, code_generator, notification, request_code_rules.
  • Translations moved from strings.php to JSON.
  • Mobile logins now get the two-factor challenge.

Before merging / releasing

  • The unreleased javaabu/* dependencies come from VCS repositories in composer.json: n4ff4h/auth, forms, manifest, permissions, stencil. Drop these once those packages are released.
  • CODECOV_TOKEN: uploads are configured, but Codecov rejects them without a token.
  • The README badges point at ?branch=next-gen (per the next-gen standards); switch them to main after merging.
  • A Dhivehi speaker should review the strings in docs/advanced-usage/translations.md#for-review.
  • Register with docs.javaabu.com (Register with Javaabu Docs (docs.javaabu.com) n4ff4h/mobile-verification#8).
  • Tag v3.0.0.

Not done on purpose

  • No index page of all numbers for admins: apps show numbers on their own user pages and use the admin actions.
  • No API registration endpoint. Registration needs the details form, which is a web flow.
  • Not tested in a real browser or with a real SMS gateway. Coverage is PHPUnit (Blade and Inertia responses) and Vitest (React pages).

🤖 Generated with Claude Code

n4ff4h and others added 6 commits November 5, 2026 20:02
@n4ff4h @claude
Foundations for v3: PHP 8.4 / Laravel 12+, CI matrix, Pint, and the r…
7c4d3df 
…ewritten core

- composer: PHP ^8.4, illuminate ^12 || ^13, Testbench ^10 || ^11, branch alias
  dev-next-gen → 3.x-dev; depends on javaabu/auth v3, forms v2, manifest,
  permissions v3, stencil and sms-notifications; drops javaabu/helpers,
  javaabu/activitylog, javaabu/laravel-recaptcha; Passport moves to suggest
- CI: Pint, PHP 8.4/8.5 × Laravel 12/13 × lowest/stable, Codecov from one
  leg, a run without the optional packages, and a check that javaabu/helpers
  and javaabu/settings v1 stay out of the production tree
- Core: MobileNumber model (v2 table kept, hashed codes, expiry, resend
  interval, attempt lock), InteractsWithMobileNumbers user trait, rules,
  SendVerificationCode and VerifyVerificationCode actions, a translatable
  SMS notification, events
- README badges for tests, Codecov, Packagist and the licence

Refs #1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Mobile login, registration and number verification on javaabu/auth v3
3cc469e 
- MobileLoginMethod: a javaabu/auth LoginMethod, so the login page links to
  it and Route::authRoutes() registers its routes in each type's guest group.
  The code finishes with StartAuthenticatedSession: two-factor still applies
  (skip_two_factor opts out), sessions and LoginResponse as for passwords
- Mobile registration: number, code, then a javaabu/stencil details form
  (MobileRegistrationForm, swappable), users created by
  CreatesUsersFromMobileNumbers, Registered event, logged in
- Route::mobileNumberRoutes(): signed-in users verify or change their number;
  mobile.verified middleware sends users without one there
- API: Route::mobileApiRoutes() for Sanctum/Passport personal tokens, and the
  optional Passport `mobile` grant, picking the user type from the client's
  provider
- Named rate limiters on top of the per-number expiry, resend interval and lock
- Blade pages with javaabu/forms v2
- Users are loaded through the type's guard provider; tests use two guards

Refs #2

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Overridable controllers, a policy and per-type permissions for admin …
8ef3551 
…actions

- Route::mobileNumberActions('user', [...]): admins change a user's number
  without a code, unlock a locked number, or remove it
- MobileNumberPolicy abilities (mobile-verification.update/unlock/remove)
  take the managed user type and the account; replace the policy in config
  or redefine an ability with Gate::define()
- Permissions update_/unlock_/remove_{type}_mobile_numbers registered with
  javaabu/permissions in each type's group, for every type or
  managed_user_types; register_permissions turns them off
- Controllers come from mobile-verification.controllers; the code generator
  and number format validator resolve through the container
- Tests run with two guards and frozen seconds

Closes #7

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Inertia React pages, Dhivehi translations and RTL checks
36a04cb 
- React pages (TypeScript, @javaabu/forms + Onu) for every Blade page:
  mobile-verification::Login, Register, Verify, RegisterDetails (stencil's
  StencilForm) and Settings/MobileNumber (javaabu/auth's AccountLayout),
  shipped through javaabu/manifest; apps import @javaabu/mobile-verification
- The stack follows the auth user type, or mobile-verification.views
- Dhivehi for every string (lang/dv.json), with a test that fails on a
  string without Thaana or with different placeholders; SMS in the
  request's locale; the name field types Thaana on Dhivehi pages
- Numbers and codes stay left to right (dir="ltr", <bdi>); a test keeps
  physical direction utilities out of the views
- CI: a React job (typecheck, Vitest) with auth and stencil from vendor/

Closes #6
Refs #5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Docs for people and agents, llms.txt, Laravel Boost guideline and skill
89632e5 
- Docusaurus docs (package-skeleton structure): installation, the user model,
  logging in, registration, verifying numbers, API, pages (Blade and React
  side by side), managing numbers, validation rules, configuration, codes
  and rate limits, the SMS, overriding, events, Dhivehi with the strings to
  review, API reference, AI assistants, and the upgrade guide from v2
- llms.txt with the rules and every page; AGENTS.md and CLAUDE.md
- resources/boost guideline and the javaabu-mobile-verification skill with
  common mistakes and testing references
- docs/ ships in the Composer dist (llms.txt points at it); JS tooling doesn't
- README quick start, CHANGELOG for 3.0.0

Closes #3
Closes #4
Closes #5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Fail loudly when a registered user model lacks HasMobileNumber; more …
573e243 
…tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h n4ff4h mentioned this pull request Nov 5, 2026
Open
7 of 8 tasks
@n4ff4h @claude
Add the mobile number page to javaabu/auth's account navigation
ce45d6e 
- Register UserTypes::accountLink('mobile-number', 'Mobile number',
  position: 30), so every user type with Route::mobileNumberRoutes() gets
  the link in auth's Blade nav and React AccountLayout (n4ff4h/auth#15)
- The React account pages pass account_links to AccountLayout
- Tests: the link per type, none for types without the page, the current
  page marked, account_links in the Inertia props and the React nav
- Docs, llms.txt, the Boost skill and the changelog: the app no longer
  links the page itself

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@n4ff4h