Download the PHP package iresis/login-audit without Composer
On this page you can find all versions of the php package iresis/login-audit. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Informations about the package login-audit
Login Audit
Installation
You can install the package via Composer:
You may publish all of the package's resources at once:
Or, you may publish each resource individually:
Publishing the Configuration File
Publishing and Running the Migrations
Usage
Login Audit listens to Laravel's native authentication events (Login, Logout, Failed, OtherDeviceLogout) and records them automatically once installed — no extra wiring required in your login flow.
What gets recorded
Every login, logout, failed attempt, and "logout other devices" event is written to the login_audit_logs table, along with the resolved IP address, user agent, browser, platform, and device type. Failed attempts store the submitted email/username/login credential as identifier (never the password) and, when the credentials matched an existing user, that user's morph reference.
Successful logins also open a row in login_audit_sessions, keyed by the framework session ID, which is closed (logged_out_at) on logout. This table is the basis for the sessions/devices API below.
Configuration
Toggle what gets tracked, rename tables, swap in your own models, and set retention in config/login-audit.php:
Multi-tenant applications (tenant_id)
Both tables include a nullable, indexed tenant_id column, and both models expose a forTenant($tenantId) scope. The package does not resolve the current tenant for you — publish the config and point models.log/models.session at your own subclasses that fill tenant_id (e.g. via a creating hook or a global scope tied to your tenancy package of choice):
Then scope queries with LoginAuditLog::forTenant($tenantId)->get().
Sessions and devices
Add the HasLoginAudit trait to your authenticatable model to get convenience relations:
The same operations are available through the LoginAudit facade or by injecting Iresis\LoginAudit\LoginAudit:
revokeSession()/revokeOtherSessions() always mark the audit row as logged out. They can only force-invalidate the underlying framework session (so the device is actually kicked out on its next request) when SESSION_DRIVER=database, since that's the only driver this package can reach into from outside that session's own request lifecycle. With other drivers (file, cookie, array, redis, ...), only the audit bookkeeping is updated — build your own invalidation on top if you need it (e.g. a "logged out remotely" flag your middleware checks).
Note: Laravel regenerates the session ID during login as session-fixation protection, so the session ID stored in
login_audit_sessionsreflects the post-login ID, not the one the browser sent with its login request.
Keeping "last activity" fresh
Apply the login-audit.activity middleware alias to routes/groups where you want last_activity_at kept up to date (throttled by login-audit.activity_throttle, 60 seconds by default):
Artisan commands
Schedule pruning in routes/console.php if you want it to run automatically:
Changelog
Please see CHANGELOG for more information on what has changed recently.
Contributing
Thank you for considering contributing to Login Audit! Please review our contributing guide to get started.
Security Vulnerabilities
Please review our security policy on how to report security vulnerabilities.
Credits
- Alexander
- All Contributors
License
Login Audit is open-sourced software licensed under the MIT license.