Table of contents

AuthLaravel: Sessions, roles and Inertia pages

AuthLaravel is an access-control learning project with a Laravel backend and Vue pages delivered through Inertia. The route definitions show how authenticated users reach their dashboard and how administrators receive a different view.

Application and services

Updated 2026-10-23
1
PHP · 53.63%

PHP Node.js PHPUnit

View source README Markdown

Languages: 5Code breakdown
Documented components: 2Explore modules
Source documents: 2Read the instructions

Repository languagesPHP 53.63%5

Shares calculated from GitHub Linguist bytes.

PHP53.63%

53.63%143,951 bytes

TypeScript35.05%

35.05%94,085 bytes

Blade10.93%

10.93%29,335 bytes

JavaScript0.37%

0.37%999 bytes

Language	%	Bytes
PHP	53.63%	143,951
TypeScript	35.05%	94,085
Blade	10.93%	29,335
JavaScript	0.37%	999
CSS	0.02%	59

GitHub README Language statistics

1. Overview

1.1. Why it exists

Clean Laravel authentication template implementing JWT, session management, and role-based policies.

1.2. Best fit

Secure boilerplate foundation for Laravel API and web applications.

2. Use cases

Laravel 10 and React (Inertia) lab app for ÉTS GTI619 on roles, login throttling and password flows.

People on the left, external systems on the right; each oval is a use case backed by the files cited below.

Register an account: Registered user
RegisteredUserController stores a new user with email, username, phone and password; the form is resources/js/Pages/Auth/Register.tsx.
Log in with throttling: Registered userAdministrator
LoginRequest locks an email and IP pair after 5 failed attempts and records login_attempts, browser, OS, IP and last_login on the user row.
Reset a forgotten password: Registered userMailpit (dev mail)
The forgot-password routes send a reset link by email; in the Sail stack, Mailpit catches it and shows it on port 8025.
Change profile and password: Registered user
PUT /password goes to PasswordController, and /profile lets the user edit, update or delete the account through ProfileController.
View all users as admin: Administrator
/admin uses the AdminAuthenticated middleware, and /dashboard renders AdminDashboard.tsx with every user’s email, roles and permissions when the role is roles:admin; other roles get the plain dashboard.

2.1. Scenario: Run the lab and test role-based access

From AuthLaravel/, run ./vendor/bin/sail up -d to start the app with MariaDB, Redis and Mailpit.
Run ./vendor/bin/sail artisan migrate and db:seed to create the admin, user, residential and business accounts.
Open http://localhost/login and sign in as [email protected] to see the user table on the dashboard.
Sign in as [email protected] and open /admin; the middleware sends the user back to the dashboard.
Use Forgot password and read the reset email in Mailpit at http://localhost:8025.

Files readREADME.mdAuthLaravel/routes/web.phpAuthLaravel/routes/auth.phpAuthLaravel/app/Http/Requests/Auth/LoginRequest.phpAuthLaravel/app/Http/Middleware/AdminAuthenticated.phpAuthLaravel/database/seeders/DatabaseSeeder.phpAuthLaravel/database/migrations/2023_04_08_225131_add_roles_column_to_users.phpAuthLaravel/docker-compose.ymlAuthLaravel/composer.jsonAuthLaravel/package.json

3. Getting started

These commands come from the repository documentation. They were not run during this review.

AuthLaravel/README.md · Steps

./vendor/bin/sail up -d
npm build
./vendor/bin/sail artisan migrate
./vendor/bin/sail artisan db:seed
http://localhost/login
email: http://localhost:8025

README.md · Steps

./vendor/bin/sail up -d
npm build
./vendor/bin/sail artisan migrate
./vendor/bin/sail artisan db:seed
http://localhost/login
email: http://localhost:8025

Tasks declared in manifests

3.1. `AuthLaravel/package.json`

dev: vite
build: tsc && vite build && vite build --ssr

4. Repository references

Excerpts from the repository’s guides, in their original language. Links open the inspected source revision.

Prerequisites and first run

4.1. Requirements

README.md

Docker
Docker Compose
Node.js
NPM
PHP 8.1.2
Composer

Read the full instructions ↗

Source documentation

2 documents read from 2 candidates.

5. Features and components 2

Routes and middleware: The dashboard route uses auth and verified middleware, then tests the user’s admin role. The admin branch loads users and renders AdminDashboard; other users receive Dashboard. The /admin route has its own middleware declaration.
Pages and account actions: Inertia connects server-side route decisions to frontend pages. Profile editing delegates to ProfileController, while password-reset routes use Laravel’s password broker. Authentication and page selection are related but separate operations.

6. Architecture

Expand a component to follow its connections, or explore the full diagram.

System components Context

Browser request
- To Laravel middleware
Laravel middleware
- From Browser request
- To Role and route logic
Role and route logic
- From Laravel middleware
- To Inertia response
Inertia response
- From Role and route logic
- To Vue page
Vue page
- From Inertia response

Mermaid Interactive diagram

System overview of the components and connections verified in the repository.

Static architecture view for AuthLaravel — Static preview. The interactive diagram replaces it after Mermaid loads.

flowchart LR
node_visitor(("Browser user"))

subgraph group_client["Inertia client"]
  node_inertia_middleware["Inertia request props"]
  node_client_app["Inertia application<br/>[app.tsx]"]
  node_auth_pages["Authentication pages<br/>[Login.tsx]"]
  node_profile_page["Profile screen<br/>[Edit.tsx]"]
  node_role_pages["Role dashboards and customer lists"]
end

subgraph group_routing["Request routing"]
  node_web_routes["Web routes<br/>[web.php]"]
  node_auth_routes["Auth routes<br/>[auth.php]"]
  node_http_kernel["HTTP middleware<br/>[Kernel.php]"]
end

subgraph group_account["Account services"]
  node_profile["Profile management"]
  node_email_verification["Email verification"]
  node_verification_notice["Verification prompts"]
  node_verification_email["Verification email"]
  node_provider_login["Provider sign-in"]
end

subgraph group_identity["Identity and access"]
  node_login["Login handler"]
  node_login_request["Login validation<br/>[LoginRequest.php]"]
  node_registration["Registration handler"]
  node_role_guard["Admin role guard"]
  node_user["User identity model<br/>[User.php]"]
  node_user_store[("User persistence<br/>[User.php]")]
end

node_visitor -.->|"requests pages"| node_web_routes
node_web_routes -->|"loads routes"| node_auth_routes
node_login -->|"authenticates with"| node_login_request
node_login_request -->|"uses identity"| node_user
node_registration -->|"creates account"| node_user
node_profile -->|"updates account"| node_user
node_client_app -->|"resolves pages"| node_auth_pages
node_client_app -->|"resolves pages"| node_profile_page
node_client_app -->|"resolves pages"| node_role_pages
node_user -.->|"persists records"| node_user_store
node_visitor -.->|"uses role pages"| node_role_pages
group_routing --> group_identity
group_routing --> group_account
class node_web_routes,node_auth_routes,node_http_kernel,node_visitor toneBlue
class node_login,node_login_request,node_registration,node_role_guard,node_user,node_user_store toneAmber
class node_profile,node_email_verification,node_verification_notice,node_verification_email,node_provider_login toneMint
class node_inertia_middleware,node_client_app,node_auth_pages,node_profile_page,node_role_pages toneRose

A Laravel and Inertia application for account access and role-based administration. Web routes connect login, registration, profiles, email verification, password recovery and optional provider sign-in to the shared user model and Inertia screens.

Components: 20
Connections: 19
Evidence-backed links: 16/19

Text version of the diagram

The diagram merges parallel links between groups, so it shows 13 of 19. Full list:

Browser user → Web routes (requests pages)
Web routes → Auth routes (loads routes)
Auth routes → Login handler (routes login)
Auth routes → Registration handler (routes registration)
Login handler → Login validation (authenticates with)
Login validation → User identity model (uses identity)
Registration handler → User identity model (creates account)
Web routes → Profile management (routes profile)
Profile management → User identity model (updates account)
Auth routes → Email verification (routes verification)
Auth routes → Verification prompts (routes prompt)
Auth routes → Verification email (routes notification)
Inertia application → Authentication pages (resolves pages)
Inertia application → Profile screen (resolves pages)
Inertia application → Role dashboards and customer lists (resolves pages)
User identity model → User persistence (persists records)
Auth routes → Provider sign-in (optional sign-in)
HTTP middleware → Admin role guard (registers middleware)
Browser user → Role dashboards and customer lists (uses role pages)

Follow one path through the code

Compare /dashboard with /admin in routes/web.php. Both select an administrative page, but their middleware differs. Authorization should be checked on the underlying data operations as well as on page navigation.

7. Technical dossier

Built from the source at commit 2ec4e5d (121 files). Each item comes from a pattern match in the code, so open the linked file before relying on it.

7.1. Layers and modules

Folders are sorted into layers by name, from the user interface down to data access. Because the sorting uses names only, the diagram says nothing about calls between layers.

Mermaid Layered view

flowchart TB
  subgraph L_presentation["Presentation"]
    direction TB
    presentation_0["AuthLaravel/resources<br/>34 files"]
    presentation_1["AuthLaravel<br/>1 file"]
    presentation_2["AuthLaravel/Console<br/>1 file"]
    presentation_3["AuthLaravel/public<br/>1 file"]
  end
  subgraph L_interface["Entry points and API"]
    direction TB
    interface_0["AuthLaravel/Http<br/>27 files"]
    interface_1["AuthLaravel/routes<br/>5 files"]
    interface_2["AuthLaravel/bootstrap<br/>1 file"]
    interface_3["AuthLaravel/config<br/>1 file"]
  end
  subgraph L_application["Application services"]
    direction TB
    application_0["AuthLaravel/Exceptions<br/>1 file"]
    application_1["AuthLaravel/config<br/>1 file"]
  end
  subgraph L_domain["Domain and business rules"]
    direction TB
    domain_0["AuthLaravel/resources<br/>3 files"]
    domain_1["AuthLaravel/Models<br/>1 file"]
  end
  subgraph L_infrastructure["Data and infrastructure"]
    direction TB
    infrastructure_0["AuthLaravel/database<br/>10 files"]
    infrastructure_1["AuthLaravel/Providers<br/>5 files"]
    infrastructure_2["AuthLaravel/config<br/>2 files"]
  end
  subgraph L_core["Core source"]
    direction TB
    core_0["AuthLaravel/config<br/>11 files"]
    core_1["AuthLaravel<br/>3 files"]
    core_2["AuthLaravel/resources<br/>1 file"]
  end
  subgraph L_tests["Tests"]
    direction TB
    tests_0["AuthLaravel<br/>12 files"]
  end
  subgraph L_hosting["Build, CI and hosting"]
    direction TB
    hosting_0["AuthLaravel<br/>1 file"]
  end
  L_presentation ~~~ L_interface
  L_interface ~~~ L_application
  L_application ~~~ L_domain
  L_domain ~~~ L_infrastructure
  L_infrastructure ~~~ L_core
  L_core ~~~ L_tests
  L_core ~~~ L_hosting

Modules and their main layer
Module	Layer	Files	Types	Extensions
`AuthLaravel/resources`	Presentation	38	0	.tsx .ts .php
`AuthLaravel/Http`	Entry points and API	27	27	.php
`AuthLaravel/config`	Core source	15	0	.php
`AuthLaravel/database`	Data and infrastructure	10	6	.php
`AuthLaravel/Providers`	Data and infrastructure	5	5	.php
`AuthLaravel/routes`	Entry points and API	5	0	.php
`AuthLaravel`	Core source	4	0	.js .xml
`AuthLaravel/Console`	Presentation	1	1	.php
`AuthLaravel/Exceptions`	Application services	1	1	.php
`AuthLaravel/Models`	Domain and business rules	1	1	.php
`AuthLaravel/bootstrap`	Entry points and API	1	0	.php
`AuthLaravel/public`	Presentation	1	0	.php

7.2. C4 model

From system context to code declarations. Each level reflects the available source evidence.

UML 1 · System context

The widest C4 view: who uses the project and which outside systems and data stores it relies on. Rendered with uml-mcp.

PlantUML source

@startuml
!include <C4/C4_Context>
LAYOUT_LEFT_RIGHT()
Person(P_http, "HTTP client")
System(SYS, "AuthLaravel", "AuthLaravel is an access-control learning project with a Laravel back…")
System_Ext(E0, "AWS")
SystemDb(D0, "Eloquent ORM")
Rel(P_http, SYS, "Uses")
Rel(SYS, E0, "Calls")
Rel(SYS, D0, "Reads and writes")
@enduml

UML 2 · Containers

One level closer: the parts that run separately inside the project, their main language and how calls flow between them. Rendered with uml-mcp.

PlantUML source

@startuml
!include <C4/C4_Container>
LAYOUT_LEFT_RIGHT()
Person(P_http, "HTTP client")
System_Boundary(SYS, "AuthLaravel") {
  Container(APP, "AuthLaravel", "PHP")
  ContainerDb(DB0, "Eloquent ORM", "")
}
System_Ext(E0, "AWS")
Rel(P_http, APP, "Uses")
Rel(APP, DB0, "Reads and writes")
Rel(APP, E0, "Calls")
@enduml

UML 3 · Components and layers

Modules grouped by source-layer classification. Boundaries show organization, not runtime isolation or call relationships. Rendered with uml-mcp.

PlantUML source

@startuml
!include <C4/C4_Component>
LAYOUT_TOP_DOWN()
System_Boundary(SYS, "AuthLaravel") {
Boundary(L0, "Presentation", "layer") {
Component(M0_0, "AuthLaravel/resources", "React, PHP, .css", "34 files")
Component(M0_1, "AuthLaravel", ".xml", "1 files")
Component(M0_2, "AuthLaravel/Console", "PHP", "1 files")
Component(M0_3, "AuthLaravel/public", "PHP", "1 files")
}
Boundary(L1, "Entry points and API", "layer") {
Component(M1_0, "AuthLaravel/Http", "PHP", "27 files")
Component(M1_1, "AuthLaravel/routes", "PHP", "5 files")
Component(M1_2, "AuthLaravel/bootstrap", "PHP", "1 files")
Component(M1_3, "AuthLaravel/config", "PHP", "1 files")
}
Boundary(L2, "Application services", "layer") {
Component(M2_0, "AuthLaravel/Exceptions", "PHP", "1 files")
Component(M2_1, "AuthLaravel/config", "PHP", "1 files")
}
Boundary(L3, "Domain and business rules", "layer") {
Component(M3_0, "AuthLaravel/resources", "TypeScript", "3 files")
Component(M3_1, "AuthLaravel/Models", "PHP", "1 files")
}
Boundary(L4, "Data and infrastructure", "layer") {
Component(M4_0, "AuthLaravel/database", "PHP", "10 files")
Component(M4_1, "AuthLaravel/Providers", "PHP", "5 files")
Component(M4_2, "AuthLaravel/config", "PHP", "2 files")
}
Boundary(L5, "Core source", "layer") {
Component(M5_0, "AuthLaravel/config", "PHP", "11 files")
Component(M5_1, "AuthLaravel", "JavaScript", "3 files")
Component(M5_2, "AuthLaravel/resources", "TypeScript", "1 files")
}
Boundary(L6, "Tests", "layer") {
Component(M6_0, "AuthLaravel", "PHP", "12 files")
}
Boundary(L7, "Build, CI and hosting", "layer") {
Component(M7_0, "AuthLaravel", ".yml", "1 files")
}
}
@enduml

UML 4 · Code

Selected declarations, fields and methods grouped by source file. No inheritance or call edges are inferred. Rendered with uml-mcp.

PlantUML source

@startuml
skinparam backgroundColor transparent
skinparam shadowing false
skinparam roundCorner 10
skinparam defaultFontName Arial
skinparam defaultFontSize 13
skinparam ArrowColor #4e6070
skinparam ArrowFontColor #3d4f5f
skinparam titleFontSize 14
skinparam actorBorderColor #006a62
skinparam actorBackgroundColor #e9f3f4
skinparam usecaseBorderColor #006a62
skinparam usecaseBackgroundColor #e9f3f4
skinparam componentBorderColor #006a62
skinparam componentBackgroundColor #e9f3f4
skinparam interfaceBorderColor #006a62
skinparam interfaceBackgroundColor #ffffff
skinparam nodeBorderColor #4e6070
skinparam nodeBackgroundColor #f4f8fb
skinparam databaseBorderColor #006a62
skinparam databaseBackgroundColor #ffffff
skinparam cloudBorderColor #4e6070
skinparam cloudBackgroundColor #f0f5fa
skinparam artifactBorderColor #006a62
skinparam artifactBackgroundColor #ffffff
skinparam rectangleBorderColor #b0c2d3
skinparam activityBorderColor #006a62
skinparam activityBackgroundColor #e9f3f4
skinparam partitionBorderColor #b0c2d3
skinparam stereotypeCBackgroundColor #ffffff
top to bottom direction
hide empty members
package "AuthLaravel" {
package "AuthLaravel/app/Http/Requests/Auth/LoginRequest.php" as F0 {
class "LoginRequest" as T0_0 {
  authorize()
  rules()
  authenticate()
  ensureIsNotRateLimited()
  throttleKey()
  prepareForValidation()
}
}
package "AuthLaravel/database/migrations/2023_04_08_230444_add_2fa_column_to_users.php" as F1 {
class "Add2FAColumnToUsers" as T1_0 {
  up()
  down()
}
}
package "AuthLaravel/app/Http/Middleware/HandleInertiaRequests.php" as F2 {
class "HandleInertiaRequests" as T2_0 {
  version()
  share()
}
}
package "AuthLaravel/database/factories/UserFactory.php" as F3 {
class "UserFactory" as T3_0 {
  definition()
  unverified()
}
}
package "AuthLaravel/app/Models/User.php" as F4 {
class "User" as T4_0 {
  name
  username
  email
  phone
  roles
  permissions
  password
  provider
}
}
}
@enduml

7.3. Data flow

The calls from the GitDiagram graph, in the order you meet them from the entry points. GitDiagram generates the graph with AI; the file paths it cites were checked against the repository tree.

Mermaid Sequence diagram

sequenceDiagram
  autonumber
  participant P0 as HTTP middleware
  participant P1 as Admin role guard
  participant P2 as Inertia application
  participant P3 as Authentication pages
  participant P4 as Profile screen
  participant P5 as Role dashboards and customer li…
  participant P6 as Browser user
  participant P7 as Web routes
  participant P8 as Auth routes
  participant P9 as Profile management
  participant P10 as Login handler
  participant P11 as Registration handler
  participant P12 as Email verification
  participant P13 as Verification prompts
  participant P14 as Verification email
  participant P15 as Provider sign-in
  participant P16 as User identity model
  participant P17 as Login validation
  P0->>P1: registers middleware
  P2->>P3: resolves pages
  P2->>P4: resolves pages
  P2->>P5: resolves pages
  P6--)P7: requests pages
  P6--)P5: uses role pages
  P7->>P8: loads routes
  P7->>P9: routes profile
  P8->>P10: routes login
  P8->>P11: routes registration
  P8->>P12: routes verification
  P8->>P13: routes prompt
  P8->>P14: routes notification
  P8--)P15: optional sign-in
  P9->>P16: updates account
  P10->>P17: authenticates with

Steps as text

HTTP middleware to Admin role guard registers middleware
Inertia application to Authentication pages resolves pages
Inertia application to Profile screen resolves pages
Inertia application to Role dashboards and customer lists resolves pages
Browser user to Web routes requests pages
Browser user to Role dashboards and customer lists uses role pages
Web routes to Auth routes loads routes
Web routes to Profile management routes profile
Auth routes to Login handler routes login
Auth routes to Registration handler routes registration
Auth routes to Email verification routes verification
Auth routes to Verification prompts routes prompt
Auth routes to Verification email routes notification
Auth routes to Provider sign-in optional sign-in
Profile management to User identity model updates account
Login handler to Login validation authenticates with
Registration handler to User identity model creates account
User identity model to User persistence persists records
Login validation to User identity model uses identity

7.4. Public interface

Outside code can use everything listed here. The project also declares 41 public types.

UML Use cases

Each actor is a kind of caller, linked to what it can ask the project to do. Rendered with uml-mcp.

PlantUML source

@startuml
skinparam backgroundColor transparent
skinparam shadowing false
skinparam roundCorner 10
skinparam defaultFontName Arial
skinparam defaultFontSize 13
skinparam ArrowColor #4e6070
skinparam ArrowFontColor #3d4f5f
skinparam titleFontSize 14
skinparam actorBorderColor #006a62
skinparam actorBackgroundColor #e9f3f4
skinparam usecaseBorderColor #006a62
skinparam usecaseBackgroundColor #e9f3f4
skinparam componentBorderColor #006a62
skinparam componentBackgroundColor #e9f3f4
skinparam interfaceBorderColor #006a62
skinparam interfaceBackgroundColor #ffffff
skinparam nodeBorderColor #4e6070
skinparam nodeBackgroundColor #f4f8fb
skinparam databaseBorderColor #006a62
skinparam databaseBackgroundColor #ffffff
skinparam cloudBorderColor #4e6070
skinparam cloudBackgroundColor #f0f5fa
skinparam artifactBorderColor #006a62
skinparam artifactBackgroundColor #ffffff
skinparam rectangleBorderColor #b0c2d3
skinparam activityBorderColor #006a62
skinparam activityBackgroundColor #e9f3f4
skinparam partitionBorderColor #b0c2d3
skinparam stereotypeCBackgroundColor #ffffff
left to right direction
actor "HTTP client" as A_http
rectangle "AuthLaravel" {
  usecase "GET/POST /forgot-password (4 routes)" as U0
  usecase "GET/POST /reset-password (3 routes)" as U1
  usecase "DELETE/GET/PATCH /profile (3 routes)" as U2
  usecase "GET/POST /register (2 routes)" as U3
  usecase "GET/POST /login (2 routes)" as U4
  usecase "GET /verify-email (2 routes)" as U5
}
A_http --> U0
A_http --> U1
A_http --> U2
A_http --> U3
A_http --> U4
A_http --> U5
@enduml

HTTP routes 27

Mermaid Route map by prefix

flowchart LR
  api(["HTTP API"])
  g0["/forgot-password"]
  api --> g0
  g0r0["GET forgot-password"]
  g0 --> g0r0
  g0r1["POST forgot-password"]
  g0 --> g0r1
  g0r2["GET /forgot-password"]
  g0 --> g0r2
  g0r3["POST /forgot-password"]
  g0 --> g0r3
  g1["/reset-password"]
  api --> g1
  g1r0["GET reset-password/'token'"]
  g1 --> g1r0
  g1r1["POST reset-password"]
  g1 --> g1r1
  g1r2["GET /reset-password/'token'"]
  g1 --> g1r2
  g1r3["POST /reset-password"]
  g1 --> g1r3
  g2["/profile"]
  api --> g2
  g2r0["GET /profile"]
  g2 --> g2r0
  g2r1["PATCH /profile"]
  g2 --> g2r1
  g2r2["DELETE /profile"]
  g2 --> g2r2
  g3["/auth"]
  api --> g3
  g3r0["GET /auth/redirect"]
  g3 --> g3r0
  g3r1["GET /auth/callback"]
  g3 --> g3r1
  g4["/confirm-password"]
  api --> g4
  g4r0["GET confirm-password"]
  g4 --> g4r0
  g4r1["POST confirm-password"]
  g4 --> g4r1
  g5["/login"]
  api --> g5
  g5r0["GET login"]
  g5 --> g5r0
  g5r1["POST login"]
  g5 --> g5r1
  g6["/register"]
  api --> g6
  g6r0["GET register"]
  g6 --> g6r0
  g6r1["POST register"]
  g6 --> g6r1
  g7["/verify-email"]
  api --> g7
  g7r0["GET verify-email"]
  g7 --> g7r0
  g7r1["GET verify-email/'id'/'hash'"]
  g7 --> g7r1
  g8["/"]
  api --> g8
  g8r0["GET /"]
  g8 --> g8r0
  g9["/admin"]
  api --> g9
  g9r0["GET /admin"]
  g9 --> g9r0
  more["+4 groups"]
  api --> more

Method	Path	Source
GET	`register`	`AuthLaravel/routes/auth.php:15`
POST	`register`	`AuthLaravel/routes/auth.php:18`
GET	`login`	`AuthLaravel/routes/auth.php:20`
POST	`login`	`AuthLaravel/routes/auth.php:23`
GET	`forgot-password`	`AuthLaravel/routes/auth.php:25`
POST	`forgot-password`	`AuthLaravel/routes/auth.php:28`
GET	`reset-password/{token}`	`AuthLaravel/routes/auth.php:31`
POST	`reset-password`	`AuthLaravel/routes/auth.php:34`

Show 16 more routes

GET	`verify-email`	`AuthLaravel/routes/auth.php:39`
GET	`verify-email/{id}/{hash}`	`AuthLaravel/routes/auth.php:42`
POST	`email/verification-notification`	`AuthLaravel/routes/auth.php:46`
GET	`confirm-password`	`AuthLaravel/routes/auth.php:50`
POST	`confirm-password`	`AuthLaravel/routes/auth.php:53`
PUT	`password`	`AuthLaravel/routes/auth.php:55`
POST	`logout`	`AuthLaravel/routes/auth.php:57`
GET	`/`	`AuthLaravel/routes/web.php:20`
GET	`/dashboard`	`AuthLaravel/routes/web.php:29`
GET	`/profile`	`AuthLaravel/routes/web.php:39`
PATCH	`/profile`	`AuthLaravel/routes/web.php:40`
DELETE	`/profile`	`AuthLaravel/routes/web.php:41`
GET	`/forgot-password`	`AuthLaravel/routes/web.php:44`
GET	`/admin` ops	`AuthLaravel/routes/web.php:48`
POST	`/forgot-password`	`AuthLaravel/routes/web.php:59`
GET	`/reset-password/{token}`	`AuthLaravel/routes/web.php:72`

3 more routes are in the code. Routes marked ops expose health, status or admin endpoints; restrict them in production.

7.5. Private interface

These names are internal by the language’s conventions: a leading underscore, private, static or pub(crate).

private / internal method: 5

schedule AuthLaravel/app/Console/Kernel.php:13
commands AuthLaravel/app/Console/Kernel.php:22
redirectTo AuthLaravel/app/Http/Middleware/Authenticate.php:13

7.6. Services

7.7. Entities and data model 1

Entity	Kind	First fields
`User`	ORM model	`name, username, email, phone, roles, permissions, password, provider`

7.8. Business logic

Once UI code and the services and entities above are set aside, these classes have the most methods.

LoginRequest Entry points and API, 8 methods: authorize, rules, authenticate, ensureIsNotRateLimited, throttleKey, prepareForValidation
Add2FAColumnToUsers Data and infrastructure, 2 methods: up, down
HandleInertiaRequests Entry points and API, 2 methods: version, share
UserFactory Data and infrastructure, 2 methods: definition, unverified

7.9. Database and persistence

Eloquent ORM 12 files

Tables and collections 4

users password_reset_tokens failed_jobs personal_access_tokens

8 migrations

Data containers

mariadb:10 redis:alpine

7.10. External integrations

HTTP clients

axios

Hosts named in the code

fonts.bunny.net 2 files AuthLaravel/resources/views/app.blade.php:10
envoyer.io 1 files AuthLaravel/resources/views/welcome.blade.php:114
forge.laravel.com 1 files AuthLaravel/resources/views/welcome.blade.php:114
laracasts.com 1 files AuthLaravel/resources/views/welcome.blade.php:63
laravel-news.com 1 files AuthLaravel/resources/views/welcome.blade.php:83
laravel.com 1 files AuthLaravel/resources/views/welcome.blade.php:43
nova.laravel.com 1 files AuthLaravel/resources/views/welcome.blade.php:114
sqs.us-east-1.amazonaws.com 1 files AuthLaravel/config/queue.php:58
static.vecteezy.com 1 files AuthLaravel/resources/js/Pages/Dashboard.tsx:44
tailwindui.com 1 files AuthLaravel/resources/js/Pages/Welcome.tsx:41

7.11. Stack and dependencies

PHP AuthLaravel/composer.json 7 runtime, 8 dev

PHP ^8.1

Open the manifest

Node.js AuthLaravel/package.json 5 runtime, 19 dev

Open the manifest

External dependencies

39 declared packages (12 runtime, 27 development) in AuthLaravel/composer.json, AuthLaravel/package.json.

Package table 39

External dependencies
Package	Version	Scope	Purpose	Registry
`guzzlehttp/guzzle`	`^7.2`	runtime	Guzzle is a PHP HTTP client library	packagist.org
`inertiajs/inertia-laravel`	`^0.6.3`	runtime	The Laravel adapter for Inertia.js.	packagist.org
`laravel/framework`	`^10.0`	runtime	Web framework	packagist.org
`laravel/sanctum`	`^3.2`	runtime	Authentication and security	packagist.org
`laravel/socialite`	`^5.6`	runtime	Laravel wrapper around OAuth 1 & OAuth 2 libraries.	packagist.org
`laravel/tinker`	`^2.8`	runtime	Powerful REPL for the Laravel framework.	packagist.org
`tightenco/ziggy`	`^1.0`	runtime	Use your Laravel named routes in JavaScript.	packagist.org
`fakerphp/faker`	`^1.9.1`	development	Testing	packagist.org
`laravel/breeze`	`^1.20`	development	Minimal Laravel authentication scaffolding with Blade and Tailwind.	packagist.org
`laravel/pint`	`^1.0`	development	An opinionated code formatter for PHP.	packagist.org
`laravel/sail`	`^1.21`	development	Docker files for running a basic Laravel application.	packagist.org
`mockery/mockery`	`^1.4.4`	development	Testing	packagist.org
`nunomaduro/collision`	`^7.0`	development	Cli error handling for console/command-line PHP applications.	packagist.org
`phpunit/phpunit`	`^10.0`	development	Testing	packagist.org
`spatie/laravel-ignition`	`^2.0`	development	A beautiful error page for Laravel applications.	packagist.org
`react-google-recaptcha`	`^2.1.0`	runtime	User interface	npmjs.com
`react-password-strength-bar`	`^0.4.1`	runtime	User interface	npmjs.com
`react-three-fiber`	`^6.0.13`	runtime	User interface	npmjs.com
`three`	`^0.151.3`	runtime	Graphics, imaging and 3D	npmjs.com
`three.js`	`^0.77.1`	runtime	Graphics, imaging and 3D	npmjs.com
`@headlessui/react`	`^1.4.2`	development	A set of completely unstyled, fully accessible UI components for React, designed to integrate beautifully with Tailwind CSS.	npmjs.com
`@inertiajs/react`	`^1.0.0`	development	The React adapter for Inertia.js	npmjs.com
`@tailwindcss/forms`	`^0.5.3`	development	User interface	npmjs.com
`@types/node`	`^18.13.0`	development	Type checking	npmjs.com
`@types/react`	`^18.0.28`	development	Type checking	npmjs.com
`@types/react-dom`	`^18.0.10`	development	Type checking	npmjs.com
`@types/react-google-recaptcha`	`^2.1.5`	development	Type checking	npmjs.com
`@types/three`	`^0.150.1`	development	Type checking	npmjs.com
`@types/ziggy-js`	`^1.3.2`	development	Type checking	npmjs.com
`@vitejs/plugin-react`	`^3.0.0`	development	The default Vite plugin for React projects	npmjs.com
`autoprefixer`	`^10.4.12`	development	Build tooling	npmjs.com
`axios`	`^1.1.2`	development	HTTP client	npmjs.com
`laravel-vite-plugin`	`^0.7.2`	development	Laravel plugin for Vite.	npmjs.com
`postcss`	`^8.4.18`	development	Build tooling	npmjs.com
`react`	`^18.2.0`	development	User interface	npmjs.com
`react-dom`	`^18.2.0`	development	User interface	npmjs.com
`tailwindcss`	`^3.2.1`	development	User interface	npmjs.com
`typescript`	`^5.0.2`	development	Type checking	npmjs.com
`vite`	`^4.0.0`	development	Build tooling	npmjs.com

7.12. CI/CD pipeline

No CI/CD pipeline in the repository. The code is built and run by hand, as described above.

7.13. Deployment

Mermaid Deployment diagram

flowchart LR
  repo[("GitHub repository")]
  local["Local machine<br/>PHP · Node.js"]
  repo -->|"clone and run"| local

UML Deployment

The outer node is where the code runs. Each base image points to what it builds, solid arrows lead to databases and dashed ones to outside services. Rendered with uml-mcp.

PlantUML source

@startuml
skinparam backgroundColor transparent
skinparam shadowing false
skinparam roundCorner 10
skinparam defaultFontName Arial
skinparam defaultFontSize 13
skinparam ArrowColor #4e6070
skinparam ArrowFontColor #3d4f5f
skinparam titleFontSize 14
skinparam actorBorderColor #006a62
skinparam actorBackgroundColor #e9f3f4
skinparam usecaseBorderColor #006a62
skinparam usecaseBackgroundColor #e9f3f4
skinparam componentBorderColor #006a62
skinparam componentBackgroundColor #e9f3f4
skinparam interfaceBorderColor #006a62
skinparam interfaceBackgroundColor #ffffff
skinparam nodeBorderColor #4e6070
skinparam nodeBackgroundColor #f4f8fb
skinparam databaseBorderColor #006a62
skinparam databaseBackgroundColor #ffffff
skinparam cloudBorderColor #4e6070
skinparam cloudBackgroundColor #f0f5fa
skinparam artifactBorderColor #006a62
skinparam artifactBackgroundColor #ffffff
skinparam rectangleBorderColor #b0c2d3
skinparam activityBorderColor #006a62
skinparam activityBackgroundColor #e9f3f4
skinparam partitionBorderColor #b0c2d3
skinparam stereotypeCBackgroundColor #ffffff
node "Docker Compose stack" as H {
  artifact "AuthLaravel" as APP
}
database "Eloquent ORM" as DB0
APP --> DB0
cloud "AWS" as E0
APP ..> E0
cloud "WebSocket" as E1
APP ..> E1
@enduml

Where it runs

Docker Compose stack

7.14. Monitoring

What the code logs, measures and exposes to tell whether it is working.

Container health checks

7.15. Security

Controls

Supply chain

Environment variables 93

The page lists names without their values and underlines the ones that look like secrets.

AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY DB_PASSWORD REDIS_PASSWORD ABLY_KEY APP_KEY DB_FOREIGN_KEYS MAILGUN_SECRET MAIL_PASSWORD MEMCACHED_PASSWORD POSTMARK_TOKEN PUSHER_APP_KEY PUSHER_APP_SECRET LOG_LEVEL APP_NAME AWS_DEFAULT_REGION

7.16. Testing

Test files: 12
Source files: 109
Test cases, about: 24
Unit tests: 11
Integration tests: 1

PHPUnit

No measured coverage report in the analyzed sources.

Where the tests are

AuthLaravel/tests/Feature/Auth 6 AuthLaravel/tests 3 AuthLaravel/tests/Feature 2 AuthLaravel/tests/Unit 1

8. Types and file structure

43 declared types, with 12 in the base-relationship overview.

Type diagram

classDiagram
direction TB
class t1fe773fc7ae3["Kernel"] {
  schedule()
  commands()
}
class tfe51bb4928b0["Handler"] {
  register()
}
class tf7ff8a2cab05["AuthenticatedSessionController"] {
  create()
  store()
  destroy()
  getBrowser()
}
class tbe9d5f7c0639["ConfirmablePasswordController"] {
  show()
  store()
}
class t50bb69bc248b["EmailVerificationNotificationController"] {
  store()
}
class t16728102d86c["EmailVerificationPromptController"] {
  __invoke()
}
class t927bbb823adb["NewPasswordController"] {
  create()
  store()
}
class ta16a6063a87f["PasswordController"] {
  update()
}
class t0154a8c3ca84["PasswordResetLinkController"] {
  create()
  store()
}
class t50ceb4a72206["ProviderController"] {
  redirect()
  callback()
}
class t2737b9fd1b1c["RegisteredUserController"] {
  create()
  store()
  getBrowser()
  getOS()
}
class t23933425e397["VerifyEmailController"] {
  __invoke()
}
class bce885b56bfe5["ConsoleKernel"] {
  <<unresolved_base>>
}
t1fe773fc7ae3 ..> bce885b56bfe5 : declared base
class b0f719e4b7646["ExceptionHandler"] {
  <<unresolved_base>>
}
tfe51bb4928b0 ..> b0f719e4b7646 : declared base
class b72f3a4384884["Controller"] {
  <<unresolved_base>>
}
tf7ff8a2cab05 ..> b72f3a4384884 : declared base
class bac0ac8cfc274["Controller"] {
  <<unresolved_base>>
}
tbe9d5f7c0639 ..> bac0ac8cfc274 : declared base
class b6a845f286ec8["Controller"] {
  <<unresolved_base>>
}
t50bb69bc248b ..> b6a845f286ec8 : declared base
class b066194bb3cef["Controller"] {
  <<unresolved_base>>
}
t16728102d86c ..> b066194bb3cef : declared base
class bdaab95927f7e["Controller"] {
  <<unresolved_base>>
}
t927bbb823adb ..> bdaab95927f7e : declared base
class b74cef29cd3a3["Controller"] {
  <<unresolved_base>>
}
ta16a6063a87f ..> b74cef29cd3a3 : declared base
class bbf0594294b45["Controller"] {
  <<unresolved_base>>
}
t0154a8c3ca84 ..> bbf0594294b45 : declared base
class bf47dba55be58["Controller"] {
  <<unresolved_base>>
}
t50ceb4a72206 ..> bf47dba55be58 : declared base
class b134294c7cccc["Controller"] {
  <<unresolved_base>>
}
t2737b9fd1b1c ..> b134294c7cccc : declared base
class b8b1b484f3c15["Controller"] {
  <<unresolved_base>>
}
t23933425e397 ..> b8b1b484f3c15 : declared base

Unresolved bases remain labelled; full signatures are not reconstructed.

9. Reference

120 / 120 eligible files read (148 in the tree); 0 oversized, 0 failed reads and 0 syntax diagnostics.

What the scan covers

Known dependency/build folders, credential files and binaries are excluded. The scan covers READMEs, recognized manifests and parser-supported source files.

Linguist statistics cover the whole repository and may include other languages.

11. Files to read 3

12. Glossary

Repository

The versioned source files, configuration, and history of a project.

README

The repository’s entry document, usually covering its purpose and initial setup.

Dependency

A library, tool, or service that another component needs to build or run.

HTTP

A request-and-response protocol used by browsers and web services. A method, path, headers, and optional body describe a request.

Session

State kept across related requests, often to track a signed-in user. Authentication and permission checks remain separate concerns.

CLI

A text interface in which commands and arguments select operations. Exit codes let scripts detect success or failure.

Build

The steps that turn source files and dependencies into a runnable program or distributable artifact.

GPU

A processor designed for parallel workloads, including graphics rendering and many numerical operations.

Backend

An implementation behind a shared interface. Depending on context, it can mean a server-side service or a graphics, input, or storage implementation.

Firmware

Software running on a device or microcontroller to control its hardware and communication.

13. References

antoinebou12. (2026, November 5). AuthLaravel. [Software repository] github.com.
antoinebou12. (2026, November 5). AuthLaravel: README. [Repository documentation] github.com.
antoinebou12. (2026, November 5). AuthLaravel/routes/web.php. [Source file] github.com.
antoinebou12. (2026, November 5). AuthLaravel/composer.json. [Source file] github.com.
antoinebou12. (2026, November 5). AuthLaravel/package.json. [Source file] github.com.
Boucher, A. (2026, October 23). AuthLaravel: Sessions, roles and Inertia pages. [Project article] antoineboucher.info.

Sources without a publication date show the date they were last checked, November 5, 2026. File links retain the inspected revision where available.

1. Overview

1.1. Why it exists

1.2. Best fit

2. Use cases

2.1. Scenario: Run the lab and test role-based access

3. Getting started

3.1. AuthLaravel/package.json

4. Repository references

4.1. Requirements

5. Features and components 2

6. Architecture

7. Technical dossier

7.1. Layers and modules

7.2. C4 model

7.3. Data flow

7.4. Public interface

HTTP routes 27

7.5. Private interface

7.6. Services

Controller 12

Provider 5

Handler 1

7.7. Entities and data model 1

7.8. Business logic

7.9. Database and persistence

Tables and collections 4

Data containers

7.10. External integrations

HTTP clients

Hosts named in the code

7.11. Stack and dependencies

External dependencies

7.12. CI/CD pipeline

7.13. Deployment

Where it runs

7.14. Monitoring

Container health checks

7.15. Security

Controls

Supply chain

Environment variables 93

7.16. Testing

Where the tests are

8. Types and file structure

9. Reference

11. Files to read 3

12. Glossary

13. References

3.1. `AuthLaravel/package.json`