Download the PHP package gabrielesbaiz/nova-password-toolkit without Composer

Nova Password Toolkit

A Laravel Nova front end for gabrielesbaiz/password-toolkit.

Two things, really. A settings dashboard where you pick which dictionaries the generator draws from and tune how passwords are assembled — written straight back to your config file as readable PHP. And a field widget that drops a suggested password, a theme browser and a strength meter under any password field on the panel.

Contents

• Requirements
• Installation
• The field widget
• The settings dashboard
• Authorization
• Multiple config files
• Keeping config in step
• Translations
• Testing

Requirements

• PHP 8.2+
• Laravel 11 or 12
• Nova 5
• gabrielesbaiz/password-toolkit 2.0+

Installation

Publish the config if you want to change anything in it:

Then say who is allowed to manage the toolkit — nothing is reachable until you do, see Authorization:

The dashboard registers itself. Registering the tool as well is optional, and only puts an entry in the main menu:

The field widget

That renders a strength meter, a generated password, a refresh button, a theme gallery and a copy button. Each part can be turned off, and the meter can be pointed at a specific input — worth doing on a form with more than one password field, since otherwise it finds the nearest one by walking up the DOM:

[!IMPORTANT] Nova's help() assigns rather than appends, so order matters. Put help() first and the widget keeps your prose; put it last and it replaces the widget entirely.

There is also a global passwordSuggestionHelp() function that renders the same markup, for call sites that predate the macro.

The settings dashboard

Available at /dashboards/password-toolkit-name-types, or through the tool's menu entry. It shows every dictionary the generator ships, grouped and searchable, plus the generation options — separator, digits, position, leetspeak. Saving writes your config file back as formatted PHP, so a change shows up as a sensible git diff rather than a serialised blob.

Authorization

Two checks, and they deliberately fail in opposite directions.

Managing rewrites a PHP file inside your config/ directory, so it is closed until you open it. The default ability, manage-password-toolkit, is one no application defines — and an undefined ability denies.

Suggesting is the help text under every password field. It is open to any authenticated user by default, because closing it would break user creation on a fresh install and a generated password is not a secret until somebody saves it.

Either can be a Gate ability:

…or a closure, for rules that do not fit one:

Multiple config files

An ordinary panel has one config file and needs none of this. A codebase serving several brands or tenants has one per brand and picks between them per request — which the package cannot work out on its own, so it asks:

The first is the file for this request. The second is every file the sync command should maintain.

[!NOTE] These are closures registered from a provider, not config values, because config:cache cannot serialise a closure — the first cached deploy would fatal.

For full control, bind the contract instead; it beats both:

Keeping config in step

A published config file is a snapshot. When the generator adds a key in a later release your copy simply does not have it:

This walks every file the resolver knows about and adds what is missing. It never overwrites a value you have set — that is why it is additive rather than a re-publish. Worth wiring into post-update-cmd:

Translations

English and Italian ship with the package. Override any key without restating the rest:

Dictionary names are humanised from their keys and passed through __(), so translating one is a matter of adding that exact string to a lang file.

Testing

Credits

• Gabriele Sbaiz
• All Contributors

License

The MIT License (MIT). Please see License File for more information.