Download the PHP package bijon/laravel-auth without Composer

bijon/laravel-auth

Authentication integrations for Laravel: Google OAuth2 and CAPTCHA verification (Cloudflare Turnstile, Google reCAPTCHA v3), built for Laravel 12/13 apps — especially Vue 3 SPAs using Sanctum cookie auth.

Features

• Google OAuth2 — hand-rolled on the Laravel HTTP client (no Socialite dependency): authorization URL generation, redirect/callback conveniences, code exchange, userinfo, token refresh, and revocation.
• Provider-based CAPTCHA — one system, multiple providers: Cloudflare Turnstile and Google reCAPTCHA v3 (score + action checks) built in, custom providers via Captcha::extend(). The active provider is auto-detected from your env vars.
• Provider-agnostic API — a route middleware (captcha), a validation rule (string 'captcha' or new CaptchaRule), and a unified CaptchaResponse DTO, identical whichever provider is configured. The turnstile middleware/rule aliases keep working.
• Services only — the package ships no routes, controllers, or views. Your app stays in control of its endpoints and its User model.
• Events, not persistence — listen to GoogleLoginSucceeded and do your own find-or-create + login. The package never touches your database.
• CSRF-safe OAuth state — session-backed state is generated and validated automatically, with an explicit override for stateless setups.
• DI-first — interfaces bound as container singletons; GoogleOAuth and Turnstile facades are optional sugar.

Requirements

• PHP ^8.3
• Laravel (illuminate components) ^12.0 | ^13.0

Installation

The service provider, facades, middleware alias, and validation rule are registered via package auto-discovery. Publish the config:

Set your environment variables:

Quick start — Google OAuth

The package returns typed DTOs and fires events; your app writes the routes and owns the User model:

Listen to the event to find-or-create your user and log them in:

Quick start — Captcha

Set the env vars for either Turnstile or reCAPTCHA v3 — the package detects which one you configured. Then guard any route with the middleware:

Or compose it into validation:

Or call the service directly — the Captcha facade always talks to the detected provider:

Captcha::detect(), Captcha::siteKey(), and Captcha::inputName() give your frontend everything it needs without hardcoding a provider. Existing Turnstile integrations (turnstile middleware/rule, Turnstile facade) keep working unchanged.

Frontend bootstrap in one line

Instead of wiring those pieces up separately, drop the whole frontend config into your blade layout with the @captchaConfig directive:

Pass an array to merge extra data into the JSON (your keys win over the defaults):

The directive is equivalent to @json(\Bijon\LaravelAuth\Facades\Captcha::frontendConfig()), which you can still call directly — frontendConfig(array $extra = []) accepts the same merge argument. It returns null (the directive prints literal null, still valid JSON) when no captcha provider is configured — even when $extra is non-empty, since no provider means there is no widget to render. Otherwise:

Your SPA can then render the active widget without knowing which provider is behind it:

params carries provider-specific extras (for reCAPTCHA v3, the action — laravel-auth.recaptcha.action, defaulting to login). Each provider's script URL can be overridden with a script_url config key.

Documentation

Testing

License

MIT — see LICENSE.