About

Filament Privacy Blur provides visual privacy protection for sensitive data in Filament admin panels. It helps prevent accidental exposure during screen sharing, shoulder surfing, or working in public spaces.

What It Does

• Visual Blur — CSS-based blur that requires user interaction to reveal
• Data Masking — Server-side redaction using configurable strategies (email, phone, NIK, etc.)
• Interactive Reveal — Click-to-reveal or hover-to-reveal with automatic re-blur
• Global Reveal Toggle — Eye icon in topbar to reveal all authorized fields instantly
• Authorization-First — Full integration with Laravel Gates, Policies, and permissions
• Audit Logging — Optional tracking of reveal actions with user, IP, and context
• Export Safety — Automatic masking during Filament exports

What It Does NOT Do

This is a visual privacy layer only. It does NOT provide:

• Data encryption at rest or in transit
• Backend access control or API-level data redaction
• Database-level security
• Protection against determined attackers with developer tools

Blur modes keep original data in the DOM. For highly sensitive fields, use mask mode (server-side redaction) or implement data masking at your model/API layer.

Why This Package Exists

When building Filament admin panels, you often need to display sensitive data (emails, salaries, phone numbers) while reducing the risk of accidental exposure during:

• Screen sharing in meetings or presentations
• Working in public spaces (cafes, coworking spaces)
• Pair programming sessions
• Client demonstrations

This package provides a convenient, authorization-aware way to add visual privacy without manually implementing blur logic for every field.

Features

• 🔒 7 Privacy Modes — blur, blur_click, blur_hover, blur_auth, mask, hybrid, disabled
• 👆 Interactive Reveal — Click-to-reveal (auto re-blurs after 5s) or hover-to-reveal
• 👁️ Global Reveal Toggle — Topbar button to reveal all authorized fields instantly
• 🎭 8 Mask Strategies — email, phone, NIK, full name, API key, address, currency, generic
• 🛡️ Authorization-First — Secure-by-default using Laravel Gates, Policies, and abilities
• 📊 Audit Logging — Track reveal actions with user, IP address, user agent, and resource context
• 📤 Export Safety — Automatic masking during Filament exports
• 🎛️ Per-Panel Config — Exclude specific panels or customize settings per panel

Requirements

• PHP: 8.2 or higher
• Laravel: 11 or higher
• Filament: v4.x or v5.x

Installation

Publish the configuration file:

Publish and run the migration (for audit logging):

Setup

Register the plugin in your Filament panel provider:

Plugin Configuration Options

Quick Start

Blur a Table Column

Mask a Table Column

Reveal with Authorization

Protect Form Inputs

Protect Infolist Entries

Never Reveal (Maximum Security)

How It Works

The package makes privacy decisions server-side and renders HTML data attributes that guide frontend behavior:

• Server-side decisions — Authorization, mode, and reveal capability are determined server-side
• Client-side execution — Alpine.js respects server-rendered attributes and cannot override them
• Secure-by-default — Fields with ->private() but no explicit authorization will blur for everyone and allow NO reveal
• Blur vs Mask — Blur modes keep original data in DOM (hidden by CSS), mask modes replace data server-side

Authorization

This package is ability-first — it prioritizes Laravel's built-in authorization system.

Recommended: Ability-Based Authorization

Use revealIfCan() with Laravel Gates or Policies:

Custom Closure Authorization

Permission-Based Authorization

Role-Based Authorization (Optional)

Force Blur for Specific Roles

Users in these roles will always see blur, even if authorized via other means.

Secure-by-Default in Practice

Privacy Modes

blur — Always Blurred

• Authorized: Plain text
• Unauthorized: 🔒 Blurred, no reveal
• Raw data in DOM: Yes

blur_click — Click to Reveal (Default)

• Authorized: 🔒 Blurred, click to reveal (auto re-blurs after 5s)
• Unauthorized: 🔒 Blurred, no click
• Raw data in DOM: Yes

blur_hover — Hover to Reveal

• Authorized: 🔒 Blurred, hover to reveal
• Unauthorized: 🔒 Blurred, no hover
• Raw data in DOM: Yes

blur_auth — Blur for Unauthorized Only

• Authorized: Plain text
• Unauthorized: 🔒 Blurred, no reveal
• Raw data in DOM: Yes

mask — Server-Side Masking

• Authorized: Plain text
• Unauthorized: 🎭 Masked text (e.g., j***[email protected])
• Raw data in DOM: No

hybrid — Maximum Protection

• Authorized: 🎭 Masked text
• Unauthorized: 🎭 Masked + 🔒 blurred
• Raw data in DOM: Masked only

disabled — No Privacy

• All users: Plain text
• Privacy effect: None

Mode Behavior Table

Global Reveal Toggle

The global reveal toggle appears as an eye icon button in the Filament topbar.

When Does the Toggle Appear?

• Shows: When at least one field on the page can be globally revealed
• Hides: When no globally revealable fields exist on the current page

This happens automatically via Alpine.js — no configuration needed.

What Can Be Globally Revealed?

The toggle can only reveal fields that:

1. The current user is authorized to view (via revealIfCan(), permission(), etc.)
2. The field is NOT marked as revealNever()
3. The field is NOT in hiddenFromRoles() for the current user
4. The privacy mode supports global reveal (blur_click, blur_hover)

What Cannot Be Globally Revealed?

The toggle will NEVER reveal:

• ❌ Unauthorized fields (user lacks ability/permission)
• ❌ revealNever() fields
• ❌ mask mode fields (masked server-side, no blur to remove)
• ❌ hybrid mode fields
• ❌ Fields where user is in hiddenFromRoles()

Security Guarantee

The global reveal toggle cannot bypass authorization. Only fields where the server explicitly sets data-privacy-can-globally-reveal="true" will be revealed. The frontend Alpine.js code only respects server decisions.

Mask Strategies

Using Mask Strategies

Audit Logging

When enabled, the package logs reveal actions to the privacy_reveal_logs table.

When Does Audit Logging Happen?

Audit logging occurs when:

1. Audit is enabled at plugin level (->enableAudit())
2. Audit is not disabled for the specific field (->withoutAuditReveal())
3. A reveal action is performed (click, hover, or global toggle)
4. The user is authorized to perform the reveal

Stored Audit Fields

Enabling Audit Logging

Per-Field Audit Control

Export Safety

Why Visual Blur is Not Safe for Exports

CSS blur only affects visual rendering in the browser. When exporting data to CSV/Excel, the original data is included unless explicitly masked.

How Export Context is Handled

The package automatically detects Filament export contexts and:

1. Replaces blur with masking — blur_click fields are masked using the configured strategy
2. Preserves mask strategies — Custom masking strategies are applied during export
3. Protects sensitive data — Original values are never included in exports

Export Behavior Examples

Security Limitations

Important: What This Package Does NOT Provide

1. Not Encryption — Blur modes keep original data in the DOM
2. Not Backend Access Control — Does not replace API authentication
3. Not API-Level Redaction — Does not protect JSON API endpoints
4. Not Database Security — Does not encrypt data at rest

Recommended Usage by Data Sensitivity

For Highly Sensitive Data

Consider implementing backend data redaction:

• Mask data in model accessors
• Use API resources with conditional field inclusion
• Implement field-level encryption in your database
• Use Laravel's Hidden attribute on Eloquent models

API Reference

Column/Entry/Field Macros

private()

Enable privacy with default settings (equivalent to privacyMode('blur_click')):

privacyMode(string $mode)

Set the privacy mode:

Available modes: 'blur', 'blur_click', 'blur_hover', 'blur_auth', 'mask', 'hybrid', 'disabled'

revealOnClick() / revealOnHover()

Convenience methods for common modes:

revealNever()

Prevent all reveal methods:

blurAmount(int $amount)

Set CSS blur intensity (1-10):

maskUsing(string|Closure $strategy)

Set masking strategy:

Authorization Methods

revealIfCan(string $ability, Model $record = null)

Authorize via Laravel Gate or Policy (recommended):

authorizeRevealWith(string $ability, Model $record = null)

Alias for revealIfCan() with explicit semantics:

authorizeRevealUsing(Closure $callback)

Custom authorization closure:

permission(string $permission)

Require specific permission:

visibleToPermissions(array $permissions)

Require any of the specified permissions:

visibleToRoles(array $roles)

Require any of the specified roles:

hiddenFromRoles(array $roles)

Force blur for specific roles:

Audit Methods

auditReveal(bool $enabled = true)

Enable audit for this field:

withoutAuditReveal()

Disable audit for this field:

Plugin Configuration Methods

defaultMode(string $mode)

Set default privacy mode:

blurAmount(int $amount)

Set default blur intensity:

exceptColumns(array $columns)

Exclude specific columns:

exceptResources(array $resources)

Exclude specific resources:

exceptPanels(array $panels)

Exclude specific panels:

enableAudit()

Enable audit logging globally:

showGlobalRevealToggle() / hideGlobalRevealToggle()

Control toggle visibility:

Configuration

After publishing, edit config/filament-privacy-blur.php:

Compatibility

Package Integration

Contributing

1. Install dependencies:

2. Run tests:

3. Run static analysis:

4. Run code style checks:

5. Fix code style:

Development Standards

• PHPStan — Static analysis at Level 4
• Laravel Pint — Laravel code style fixer
• Pest — Testing framework

Changelog

Please see CHANGELOG for recent changes.

License

The MIT License (MIT). Please see License File for more information.