datalogix / laravel-guardian

dev-main 2026-09-14 18:02 UTC

Requires

• php: ^8.2
• bacon/bacon-qr-code: ^3.0
• illuminate/auth: ^11.0|^12.0|^13.0
• illuminate/console: ^11.0|^12.0|^13.0
• illuminate/contracts: ^11.0|^12.0|^13.0
• illuminate/database: ^11.0|^12.0|^13.0
• illuminate/filesystem: ^11.0|^12.0|^13.0
• illuminate/http: ^11.0|^12.0|^13.0
• illuminate/mail: ^11.0|^12.0|^13.0
• illuminate/notifications: ^11.0|^12.0|^13.0
• illuminate/routing: ^11.0|^12.0|^13.0
• illuminate/session: ^11.0|^12.0|^13.0
• illuminate/support: ^11.0|^12.0|^13.0
• illuminate/validation: ^11.0|^12.0|^13.0
• illuminate/view: ^11.0|^12.0|^13.0
• laravel/socialite: ^5.0
• livewire/livewire: ^3.0|^4.0
• pragmarx/google2fa: ^9.0

Requires (Dev)

• graham-campbell/testbench: ^6.3
• laravel/pint: ^1.30

MIT

• Ricardo Gobbo de Souza

• security
• Authentication
• login
• signup
• laravel
• logout
• guard
• rate-limiting
• email-verification
• password-reset

Published on Packagist.org on 2026-09-14 18:02 UTC

README

Laravel Guardian is an extensible authentication package providing login, sign-up, password reset, email verification, two-factor authentication and OAuth social login — all built on top of Livewire.

Installation

You can install the package via composer:

composer require datalogix/laravel-guardian

The package will automatically register itself.

Quick start

Register at least one "fortress" — a self-contained authentication flow bound to a guard and, optionally, a domain or path prefix — from a service provider's boot method:

use Datalogix\Guardian\Fortress;
use Datalogix\Guardian\Guardian;

public function boot(): void
{
    Guardian::registerFortress(Fortress::make()->basic());
}

Then run the migrations. Guardian only loads the migrations it actually needs, based on which features you enabled (two-factor columns, trusted devices, OAuth identities):

php artisan migrate

You can register more than one fortress to run independent auth flows side by side — for example a customer-facing app and an admin panel:

Guardian::registerFortress(Fortress::make()->basic());
Guardian::registerFortress(Fortress::make()->admin());

Features

• 🔑 Login & Logout – Session-based authentication with rate limiting and remember-me support.
• 📝 Sign-up – Self-service registration with configurable identifier (email, username, CPF or CNPJ).
• 🔁 Password Reset & Confirmation – Forgot-password flow and password re-confirmation for sensitive actions.
• ✉️ Email Verification – Signed, expiring verification links.
• 🔒 Two-Factor Authentication – TOTP (authenticator app), email or SMS codes, recovery codes and trusted devices.
• 🌐 OAuth / Social Login – Sign in with any Laravel Socialite provider, with automatic account linking.
• 🏰 Multiple Fortresses – Run independent authentication flows per guard, domain or path (e.g. customer app + admin panel).
• 🚦 Rate Limiting – Configurable throttling on every sensitive action out of the box.
• 🇧🇷 CPF/CNPJ Validation – Ready-to-use validation rules for Brazilian documents.

Configuration

All features are optional and configurable per fortress through the fluent Fortress API (see src/Concerns for the full list of available methods, e.g. twoFactor(), oauth(), signUp(), emailVerification()).

You can publish the package config, views and translations with:

php artisan vendor:publish --provider="Datalogix\Guardian\GuardianServiceProvider" --tag="guardian-config"
php artisan vendor:publish --provider="Datalogix\Guardian\GuardianServiceProvider" --tag="guardian-views"
php artisan vendor:publish --provider="Datalogix\Guardian\GuardianServiceProvider" --tag="guardian-lang"

Publishing the config creates a config/guardian.php file:

// config/guardian.php

return [
    'framework' => Framework::tryFrom(env('GUARDIAN_FRAMEWORK')) ?? Framework::Livewire,
    'cache_path' => base_path('bootstrap/cache/guardian'),
];

Note: only the Livewire front-end is currently supported. Inertia is present in the API for a future release but is not implemented yet — a fortress configured to use it will fail fast on boot with a clear error.