Download the PHP package myra/starter-kit without Composer

Myra Starter Kit

A production-ready Laravel 12 + Inertia.js + Vue 3 admin dashboard starter kit with a Filament-style code generator, role-based access control, per-user data isolation, a built-in CMS, an AI writing assistant, and 55+ UI components — so you can ship admin panels with very little hand-written code.

What's New

Everything below shipped after v2.0.0. Every subsystem marked opt-in is off by default — deploying the code changes nothing until you set its flag.

v2.5.1 — latest

Runtime dependency fix: fakerphp/faker moved from require-dev to require. App code calls fake() in 24 places, and production deploys with --no-dev, so two demo pages had been returning 500 since v2.2.0. A guard test now fails CI if runtime code calls into a dev-only package. Also: ESCAPE handling under MySQL NO_BACKSLASH_ESCAPES, and inline-upload URLs no longer double the inline path segment.

v2.5.0 — Dashboards, realtime, gallery, AI

Dashboard editor — drag tiles, save a personal layout, add widgets from the catalogue

Component gallery with a live props playground

v2.4.0 — Extension, structure, tenancy, scale

• Plugin system — packages that register pages, resources, widgets, permissions and nav. A plugin that fails to load is quarantined, never fatal.
• Clusters + nested and singular resources, with server-contributed navigation.
• Multi-tenancy (opt-in, MYRA_TENANCY) — full tenant scoping on the teams tables.
• Testing helpers — InteractsWithMyra, TableProbe, SchemaProbe, ActionProbe.
• 100k+ rows — virtualised rendering, cursor pagination, sort-index guard.
• Generators: 8 → 13.

Virtualised rows and cursor pagination

v2.3.0 — Reporting, graphs & charts

• Report builder — composable definitions (source, dimensions, measures, filters) with all aggregation in SQL, never in PHP or the browser.
• 15 chart types — bar/stacked/horizontal, line, area, pie, doughnut, radar, scatter, polar, plus heatmap, funnel, gauge and sparkline as inline SVG.
• Drill-down from a chart segment into the filtered table, and cross-filtering between widgets.
• Scheduled reports (cron → render → email) and PDF export — no new composer dependency.
• Comparison periods on stat and chart widgets.

Report builder with drill-down and comparison periods

v2.2.0 / v2.2.1 — Table power features

• Saved views — named filter + column + sort presets, per user, shareable.
• Column manager with presets and persistence.
• Streaming export that never buffers the full result set; resumable import with column auto-mapping, validation preview and a partial-failure report.
• Nested AND/OR query builder with server-side column and operator whitelisting.
• Ranked global search, scoped per resource.
• Security (v2.2.1) — six unescaped LIKE call sites migrated to Sql::whereLike(); a % in a search box no longer matches every row. Relation sort columns are whitelisted.

Saved views and the column manager

v2.1.0 — Filament v5 parity

• Form fields: code (lazy CodeMirror 6), markdown, toggle-buttons, and hint() / hintAction() across every field type.
• Table columns: color, checkbox (inline edit), and summaries extended with min/max/median/range.
• Infolist: color and code entries.
• Actions: replicate, restore, force-delete, and action grouping with nested submenus.

Quality across the line

Table of Contents

• What's New
• Screen Reference — every page, screenshotted
• Highlights
• Screenshots
• Scaffolding CLI
• Security & Access Control
• Features
• Tech Stack
• Requirements
• Installation
• Default Roles
• AI Assistant
• Internationalization
• Theme System
• Project Structure
• Key URLs
• Documentation
• License

Highlights

• 🛠️ Filament-style generators — scaffold pages, full CRUD resources, or pages cloned from any of 18 feature demos, with routes, sidebar nav, and permissions auto-wired.
• 🔐 Shield RBAC — convention-based {module}.{ability} permissions synced from config, with a super-admin bypass and an editable permission matrix.
• 👤 Per-user data isolation — non-super-admins see only their own records; super-admins see everything.
• 📝 CMS — articles, pages, and categories with a Tiptap editor, server-side HTML sanitization, draft/publish workflow, and public blog.
• 🤖 AI assistant — bring-your-own-key writing assistant (OpenAI, Anthropic, OpenRouter, or self-hosted Ollama) streamed into the rich text editor.
• 🧱 Schema-driven forms & tables — declarative builders with 20+ field types, inline editing, filters, grouping, and reordering.
• 🌍 i18n, 🎨 10 theme presets + dark mode, 🔔 in-app + Firebase push notifications, and two-factor auth enforced after login.

Screenshots

50+ full screenshots (every module + all 18 demos) live in public/docs/screenshots/ and the bundled documentation.

Scaffolding CLI

Generate admin modules from the terminal — routes, sidebar nav, and Spatie permissions are wired automatically (idempotent markers; pass --print to emit snippets instead of editing files).

Component keywords (clone the matching demo): form-builder, rich-text-editor, repeater-field, conditional-fields, wizard, field-types, global-search, data-table, bulk-actions, advanced-filters, inline-editing, grouping, import-export, action-modals, soft-deletes, infolist, relation-manager, widgets, reordering.

Newly generated permissions appear in the Roles matrix immediately, so a super-admin can grant a new page to any role with one click.

Other commands:

Security & Access Control

• Two-factor authentication enforced after login — 2FA users must pass the TOTP/recovery challenge before reaching any protected route (middleware-gated, throttled).
• Account state enforcement — suspended/pending users cannot log in and are logged out mid-session.
• Shield RBAC — permissions declared in config/shield.php; super-admin bypasses all checks via Gate::before.
• Role assignment guards — only super-admins can assign admin/super-admin; disabled roles are unassignable; the same rules apply to CSV import.
• Role protections — super-admins/admins are hidden from lower roles, admins can't manage other admins, and roles have super-admin-controlled active/visible toggles.
• Per-user data isolation — OwnedByUser global scope on content models; media scoped to the uploader; public pages explicitly exempt.
• Hardening — server-side HTML sanitization (defense-in-depth with client DOMPurify), SVG uploads blocked, CSV formula-injection escaping, whitelisted sort columns + capped pagination, Content-Security-Policy + HSTS in production, and a production-safe seeder.
• Editable login tagline + server-enforced sign-up toggle.

Features

Core

• User Management — CRUD, soft deletes, status management, role assignment, impersonation, bulk actions, CSV export
• Roles & Permissions — Spatie RBAC with permission matrix, role cloning, active/visible toggles, grouped permissions
• Dashboard — stats, user-growth charts, activity feed, role/status breakdowns, configurable widgets
• Activity Log — full audit trail with CSV export
• Media Manager — uploads via Spatie Media Library, scoped per uploader
• System Health — database, cache, disk, and environment checks
• Backups — on-demand DB + file backups (Spatie Backup)
• API Tokens — Laravel Sanctum token creation/revocation

Content

• Articles, Pages, Categories — Tiptap rich text, featured images, SEO meta, draft → published → archived workflow, public blog at /blog
• Homepage Builder — configurable hero, features, testimonials, pricing, CTA, navbar, and footer

Communication

• Email Templates — database-driven with variable substitution + test sends
• Email Log — audit trail with export
• Push Notifications — Firebase Cloud Messaging (web push)
• In-App Notifications — real-time bell with read/unread tracking and per-user preferences

Developer Experience

• Scaffolding CLI, Command Palette (Cmd/Ctrl+K), 20+ interactive feature demos, full TypeScript coverage, XLSX/CSV export, image editor, and schema-driven form/table/infolist/widget builders

Tech Stack

Requirements

• PHP 8.4+
• Node.js 18+
• MySQL / PostgreSQL / SQLite
• Composer 2+

Installation

Clone the repository and install dependencies — everything needed is committed, so it installs with no private access or tokens:

Visit http://localhost:8000 and sign in with the admin account you created in step 4.

Quickest start (SQLite, zero DB config): set DB_CONNECTION=sqlite in .env, run touch database/database.sqlite, then php artisan app:install.

For production, build assets instead of composer dev: npm run build, and set APP_ENV=production, APP_DEBUG=false, SESSION_ENCRYPT=true, SESSION_SECURE_COOKIE=true in .env.

Default Roles

The seeder creates five roles:

44 permissions across 17 modules are grouped by prefix (users, roles, pages, articles, …) in the permission matrix. Generated modules add their own automatically.

AI Assistant

Configure a provider under Settings → AI (master toggle, provider, API key, model, base URL, temperature, max tokens):

The rich text editor gains a Sparkles menu: generate, improve, fix grammar, shorten, lengthen, summarize, and change tone — streamed via Server-Sent Events.

Internationalization

vue-i18n with lazy-loaded locales (en, ms, zh) and a header language switcher. Add a locale by dropping a JSON file in resources/js/i18n/locales/ and registering it in resources/js/i18n/index.ts.

Theme System

10 shadcn color presets (Zinc, Slate, Stone, Red, Rose, Orange, Green, Blue, Violet, Yellow) selectable from Settings → Appearance, plus custom sidebar colors, logo/favicon upload, dark mode, and per-mode oklch values applied at runtime across admin and public pages.

Project Structure

Key URLs

Documentation

Comprehensive docs ship with the project at public/docs/index.html (served at /docs): the form/table builders, every artisan command, RBAC/Shield, data isolation, role protections, the notification system, and all admin modules — with screenshots throughout.

License

MIT License. See LICENSE for details.