ramon / verified

v2.2.0 2026-10-28 00:06 UTC

Requires

• php: ^8.3
• ext-dom: *
• ext-fileinfo: *
• flarum/core: ^2.0.0

Requires (Dev)

• flarum/gdpr: ^2.0
• flarum/phpstan: ^2.0
• flarum/testing: ^2.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^11.5 || ^12.5.22 || ^13.2.0
• roave/security-advisories: dev-latest
• vimeo/psalm: ^6.0

Suggests

• ext-sodium: Required to encrypt identity documents at rest (Admin → Document encryption).
• flarum/gdpr: Data export, anonymization and erasure of verification documents.
• flarum/nicknames: Shows the nickname next to the username in the verified popover.

MIT

• Ramon Guilherme

• badge
• verification
• verified
• flarum

Published on Packagist.org on 2026-10-28 00:06 UTC

README

Verified

A verified badge for Flarum users, the way X does it.

Verified adds a blue check next to usernames everywhere they show up: posts, profiles, user cards and mentions. Users apply from their own settings page, admins approve or reject from a dedicated panel, and the badge follows the user around the forum from then on.

It can be as light or as strict as your community needs. Run it as a simple request and approve flow, or require an identity document with each request, encrypt the uploads with a public key and let a retention policy purge the files later.

What it does

• Blue verified badge wherever the username is rendered, with an optional hover tooltip showing who verified and when
• Verification requests from the user's settings page, reviewed in an admin panel
• Optional identity document upload, with public key encryption and configurable retention
• Avatar lock for verified users, so the face people trust does not change silently
• Custom badge SVG, size and color if the default does not match your theme
• Notifications by alert and email when a request is handled
• Plays nice with flarum/gdpr for export, anonymization and erasure

Installation

composer require ramon/verified
php flarum migrate
php flarum cache:clear

Then enable Verified on the Extensions page. Settings, permissions and the request queue all live in the admin panel, each option explained in place.

Good to know

• Documents are wiped on the schedule you choose. The nightly verified:purge-documents command takes care of it, no cron of your own needed.
• Encryption is your call: switch Encrypt uploaded documents on in the settings, generate the keypair there and paste the private key into config.php (it never goes in the database). While it is on, uploads are refused if they cannot be sealed, so nothing is ever stored unencrypted by accident. Switch it off and new uploads are stored as-is, while files already encrypted stay readable.
• Everything the frontend does goes through the /api/verified/* endpoints, so verification can also be automated from outside.

Development

composer install
composer test:setup        # once: creates the SQLite test database
composer test              # unit + integration tests
composer analyse:phpstan
cd js && npm ci && npm run check-typings && npm run format-check && npm run build

License

MIT. Questions and ideas are welcome on the issue tracker.