phpinnacle/cerber

Authentication and authorization management for Laravel Filament applications.

1.0.0 2026-09-01 10:40 UTC

Requires

• php: ^8.4
• filament/filament: ^4.0|^5.0
• lab404/laravel-impersonate: ^1.7
• laravel/sanctum: ^4.0
• laravel/socialite: ^5.0
• phpinnacle/common: ^1.0
• phpinnacle/tempo: ^1.0
• socialiteproviders/yandex: ^4.1
• spatie/laravel-package-tools: ^1.92

MIT

• PHPinnacle Devs

• laravel
• phpinnacle
• filament

Published on Packagist.org on 2026-09-01 12:36 UTC

README

Cerber is the authentication and authorization layer for PHPinnacle Filament applications. It provides users, roles and permissions, OAuth providers, API tokens, impersonation, profile management and Filament resources as one configurable panel plugin.

Features

• User, role and OAuth provider Filament resources.
• Database-backed roles and permissions with grouped Filament resource, page and widget permissions.
• Google, Yandex, GitHub and Facebook Socialite provider definitions.
• OAuth account linking and optional domain-based auto-registration.
• Optional default role for newly registered OAuth users.
• Laravel Sanctum token support.
• User impersonation via laravel-impersonate.
• Configurable profile form, developer identities, guards and permission scopes.
• Optional tenancy and custom database connection.

Requirements and installation

• PHP 8.4 or later
• Laravel 13, Filament 5, Sanctum 4 and Socialite 5
• phpinnacle/common

composer require phpinnacle/cerber
php artisan vendor:publish --tag="phpinnacle-cerber-migrations"
php artisan migrate

Publish configuration when customizing navigation, permissions, OAuth registration or storage:

php artisan vendor:publish --tag="phpinnacle-cerber-config"

Registering the plugin

use PHPinnacle\Cerber\AuthProvider;
use PHPinnacle\Cerber\CerberPlugin;

$panel->plugin(
    CerberPlugin::make()
        ->authProviders(
            AuthProvider::google(),
            AuthProvider::github(),
        )
        ->scopes(Order::class)
        ->developers(['[e-mail]']),
);

Use withoutProviders(), withoutRoles(), withoutUsers() or withoutResources() when the application supplies that UI itself. modifyProfileForm() receives the Filament schema and profile page for application-specific fields.

Roles and permissions

use PHPinnacle\Cerber\Models\Permission;

$permission = Permission::register('orders.view');
$role->grant($permission);

if ($role->able('orders.view')) {
    // The role grants this permission.
}

Applications may implement HasCustomPermissions to contribute permission definitions. The exclude configuration removes selected Filament pages, widgets or resources from generated permission groups; permissions and translations customize the resulting catalog.

OAuth configuration

Create enabled provider records through the Providers resource and configure the corresponding Socialite credentials. allowed_domains controls which email domains may auto-register, and default_role assigns an initial role. Provider settings are cached using cache.enabled, cache.ttl and cache.key.

Treat provider secrets and access tokens as credentials. Store environment-specific values securely, restrict provider administration and verify callback URLs in each provider console.

Testing

composer test

Changelog and license

See CHANGELOG. Released under the MIT License.