{"id":20518632,"url":"https://github.com/ramizpolic/laravel-auth","last_synced_at":"2026-04-16T23:34:05.167Z","repository":{"id":156275507,"uuid":"324408637","full_name":"ramizpolic/laravel-auth","owner":"ramizpolic","description":"Laravel boilerplate with advanced authorization and API policies","archived":false,"fork":false,"pushed_at":"2023-04-26T15:54:33.000Z","size":872,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-16T10:24:57.783Z","etag":null,"topics":["auth","authorization","authz","boilerplate","iam","laravel","security"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ramizpolic.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-12-25T17:54:46.000Z","updated_at":"2025-01-14T19:20:28.000Z","dependencies_parsed_at":null,"dependency_job_id":"a04350f9-34db-47f4-b528-0b39d9228800","html_url":"https://github.com/ramizpolic/laravel-auth","commit_stats":null,"previous_names":["ramizpolic/laravel-auth"],"tags_count":1,"template":true,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ramizpolic%2Flaravel-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ramizpolic%2Flaravel-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ramizpolic%2Flaravel-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ramizpolic%2Flaravel-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ramizpolic","download_url":"https://codeload.github.com/ramizpolic/laravel-auth/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242123201,"owners_count":20075344,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auth","authorization","authz","boilerplate","iam","laravel","security"],"created_at":"2024-11-15T21:45:31.696Z","updated_at":"2026-04-16T23:34:00.123Z","avatar_url":"https://github.com/ramizpolic.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Laravel Auth Boilerplate\n\nA boilerplate for Laravel projects based on [github.com/laravel-api-boilerplate](https://github.com/specialtactics/laravel-api-boilerplate) \nwith a focus on advanced authentication, authorization, and API policies.\nContains a dedicated entrypoint for Admin panel based on [core-ui](https://coreui.io/) admin template.\n\n## Installation\nYou can quickly get the environment up and running by\n```bash\n./env/build.sh\n\n```\n\nYou can also use native docker support which quickly boots up the environment via\n```\ndocker-compose up\n```\n\nNotes:\nMake sure to create an `.env` file from `.env.example` to change runtime configuration\n\n## API\n\nTo select appropriate version of API, following header must be provided (`v1` defines the endpoint version):\n```bash\nAccept: application/vnd.laravelauth.v1+json\n```\nCurrently supported versions: `v1`\n\n### Request\nEach endpoint supports following predefined request options by default:\n* **sorting** - `/model?sort=-name`\n* **filtering** - `/model?filter[name]=john\u0026filter[email]=gmail`\n* **selecting** - `/model?fields[users]=id,name`\n* **eager loading** - `/model?include=posts`\n* **custom appends** - `/model?append=fullname`\n\nFor each of these items, advanced authorization policies are available (both per request, and per request item). \n\nFor example, if we wish to allow preview of user `logs` only for administrator:\n```php\n// This disables possiblity of requesting \"logs\"\n// for anyone except admin users.\n//\n// Workflow:\n//   a) regular user requests `/user?include=logs` -\u003e HTTP Unauthorized\n//   b) regular user requests `/user` -\u003e gets default user response\n//   c) admin user requests `/user?include=logs` -\u003e response with logs lazy loaded\n//   d) admin user requests `/user` -\u003e gets default user response\npublic function includeLogs(User $loggedUser, User $user)\n{\n    return $loggedUser-\u003eisAdmin();\n}\n```\n\nNatively, every restful model supports **sorting, filtering**, and **selecting** of all fields user has permissions to see.\nThis is internally handled via view policies. Likewise, these options can be extend to support custom logic. To do so, simply override RestfulModel `getQuery` methods.\n\n### Response\nIn addition to requests, on top of model objects there is per-attribute authorization implemented as well.\nBy implementing specific policies, it is possible to extend model attribute view and edit permissions. \n\nFor example, consider following response:\n```json\n{\n    \"id\": 1,\n    \"name\": \"ramiz\",\n    \"is_banned\": false,\n    \"phone_number\": \"123\",\n    \"role\": 1\n}\n```\nIt is possible to forbid users from obtaining details of specific attributes by defining **View policies**.\n```php\n// This hides \"phone_number\" from response\n// for anyone except the owner of the account.\npublic function viewPhoneNumber(User $loggedUser, User $user)\n{\n    return $loggedUser-\u003eid == $user-\u003eid;\n}\n```\n\nAlso, there are fields which only specific users can edit. To implement edit field permissions, simply write related **Edit policies**.\n```php\n// This allows configuration of \"is_banned\"\n// to administrators.\npublic function editIsBanned(User $loggedUser, User $user)\n{\n    return $loggedUser-\u003eisAdmin();\n}\n```\n\n**Note:** By default, all fields that are marked as hidden will remain hidden unless related policies are defined. The same applies to editable fields (editable unless a condition is given).\n\n#### Eager loading\nAs some models require eager loading enabled by default, there is also an option for that by overriding model `getWith` method. For example, if we wish to enable `role` (which is a one-to-one relation) on `user` to be displayed along user, we can simply give it as:\n```php\npublic function getWith() {\n    return ['role_status'];\n}\n```\n\nNow, when requesting default endpoint at `/user/1` response will be given as:\n```json\n{\n    \"id\": 1,\n    \"name\": \"ramiz\",\n    \"is_banned\": false,\n    \"phone_number\": \"123\",\n    \"role\": {\n        \"id\": 1,\n        \"name\": \"admin\"\n    }\n}\n```\n\nAuthorization policies are also enabled, which will hide these fields in case of insufficient permissions. Example usage include providing user logs for owner account.\n\n## Routes\n\nComplete list of supported API is given in table below. Click to view fully expanded table.\n\u003cdetails\u003e\u003csummary\u003eClick to view\u003c/summary\u003e\n\u003cp\u003e\n\n#### Routes list\n\n Method   | URI                                | Action                                      | Protected \n----------|------------------------------------|---------------------------------------------|-----------\n GET,HEAD | api/auth/login                     | AuthController@token                        | No        \n POST     | api/auth/register                  | AuthController@register                     | No        \n GET,HEAD | api/auth/oauth/{provider}          | AuthController@redirectToProvider           | No        \n POST     | api/auth/oauth/callback/{provider} | AuthController@handleProviderCallback       | No        \n POST     | api/auth/password/email            | ForgotPasswordController@sendResetLinkEmail | No        \n POST     | api/auth/password/reset            | ResetPasswordController@reset               | No        \n GET,HEAD | api/auth/email/verify/{id}/{hash}  | VerificationController@verify               | No        \n POST     | api/auth/email/resend              | VerificationController@resend               | No        \n GET,HEAD | api/auth/me                        | AuthController@getUser                      | Yes       \n DELETE   | api/auth/logout                    | AuthController@logout                       | Yes       \n GET,HEAD | api/auth/token/refresh             | AuthController@refresh                      | Yes       \n GET,HEAD | api/user                           | UserController@getAll                       | Yes       \n GET,HEAD | api/user/{id}                      | UserController@get                          | Yes       \n POST     | api/user                           | UserController@post                         | Yes       \n PUT      | api/user/{id}                      | UserController@put                          | Yes       \n PATCH    | api/user/{id}                      | UserController@patch                        | Yes       \n DELETE   | api/user/{id}                      | UserController@delete                       | Yes       \n GET,HEAD | api/user_status                    | UserStatusController@getAll                 | Yes       \n GET,HEAD | api/user_status/{id}               | UserStatusController@get                    | Yes       \n GET,HEAD | api/role                           | RoleController@getAll                       | Yes       \n GET,HEAD | api/role/{id}                      | RoleController@get                          | Yes       \n GET,HEAD | api/user_role                      | UserRoleController@getAll                   | Yes       \n GET,HEAD | api/user_role/{id}                 | UserRoleController@get                      | Yes       \n POST     | api/user_role                      | UserRoleController@post                     | Yes       \n PUT      | api/user_role/{id}                 | UserRoleController@put                      | Yes       \n PATCH    | api/user_role/{id}                 | UserRoleController@patch                    | Yes       \n DELETE   | api/user_role/{id}                 | UserRoleController@delete                   | Yes       \n GET,HEAD | api/user_log                       | UserLogsController@getAll                   | Yes       \n GET,HEAD | api/user_log/{uuid}                | UserLogsController@get                      | Yes       \n GET,HEAD | api/referral                       | ReferralController@getAll                   | Yes       \n GET,HEAD | api/referral/{id}                  | ReferralController@get                      | Yes       \n\n\u003c/p\u003e\n\u003c/details\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Framizpolic%2Flaravel-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Framizpolic%2Flaravel-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Framizpolic%2Flaravel-auth/lists"}