Download the PHP package padosoft/laravel-invitations without Composer
On this page you can find all versions of the php package padosoft/laravel-invitations. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download padosoft/laravel-invitations
More information about padosoft/laravel-invitations
Files in padosoft/laravel-invitations
Package laravel-invitations
Short Description Enterprise invite-by-code, referral, rewards, waitlist & anti-abuse system for Laravel — multi-tenant, concurrency-safe, idempotent, GDPR-ready.
License MIT
Homepage https://github.com/padosoft/laravel-invitations
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-invitations
⚠️ Active development toward
v1.0.0. The engine is production‑proven (extracted from a shipping app) and fully tested; the public API may still shift before thev1.0.0tag.
📖 Full documentation: doc.laravel-invitations.padosoft.com — deep, academic guides on atomic redemption, multi‑tenancy, anti‑abuse, K‑factor analytics, the tri‑surface API, GDPR, and the architecture decision records.
🚀 AI vibe‑coding pack included
This repo ships a complete AI pair‑programming kit: CLAUDE.md (engineering invariants
- quality gates),
docs/. Point Claude Code, Cursor, or Copilot at the repo and they inherit the package's rules (atomic redemption, tenant scoping, fail‑open fraud, GRANT‑never‑REVOKE) automatically.
Why this package
Every Laravel invite/referral package on the market stops at "generate a code, mark it used." None of them solve the problems that actually bite in production:
- They over‑redeem under load. The popular packages increment a use‑counter with a check‑then‑write and no lock — two concurrent redemptions both pass the "1 seat left" check. That's a free‑code / over‑capacity bug at best.
- They're single‑tenant. Codes are globally unique, so two customers can never share an intuitive code, and rows leak across tenant boundaries.
- They store invitee emails forever with no erasure path — a GDPR liability.
- They have no events, no fraud controls, no analytics, and no API/MCP surface.
padosoft/laravel-invitations is built the other way around: correctness, multi‑tenancy, privacy and
observability first.
✨ Highlights
- 🎟️ Invite codes — random, vanity, and cryptographically signed (Crockford Base32, no confusable characters), with expiry, max‑uses and per‑user limits.
- ⚛️ Atomic, idempotent, concurrency‑safe redemption — a single conditional
UPDATE … WHERE current_uses < max_usesthat flips state in the same statement, backed by aUNIQUE(code_id, redeemer_id)index.current_usescan never exceedmax_uses; a replay is a no‑op, never a double‑grant — even under a thundering herd. - 🏢 Multi‑tenant by design — every table is tenant‑scoped; two tenants can share the same human code. Single‑tenant apps get a zero‑config default.
- 🎁 Referral graph + double‑sided rewards with a DB‑backed idempotency key (no double‑grants).
- 📨 Email invitations — idempotent send/accept lifecycle, "who accepted vs. who didn't".
- 🛡️ Fail‑open anti‑abuse — weighted velocity / disposable‑email / honeypot / blacklist scoring
that surfaces a generic
rate_limited(never a probing oracle) and stores HMAC‑hashed PII only. A detector fault never blocks a real user; seat safety is the atomic claim's job. - 🔑 Per‑invite entitlement grants — an invite can grant a role and project access on redemption, across one or several tenants. GRANT‑never‑REVOKE: it only ever raises access.
- 📈 Virality analytics — K‑factor, acceptance / conversion rates, time‑to‑redeem percentiles, reconciled against the canonical rows (not a drifting rollup).
- 🔔 Events on every lifecycle transition.
- 🔒 GDPR — in‑place PII anonymization that preserves aggregates + a scheduled prune command.
- 🧩 Tri‑surface — the same core is reachable from PHP (services + Artisan), a REST API (RBAC‑gated, publishable routes), and MCP tools.
- 🤝 Vendor‑neutral — works on plain Fortify/Breeze;
spatie/laravel-permission,laravel/fortifyandlaravel/mcpare optional, first‑class integrations.
How it compares
| Capability | laravel‑invitations | doorman | mateusjunges/invite‑codes | pdazcom/referrals | taldres/waitlist |
|---|---|---|---|---|---|
| Invite codes (max‑uses) | ✅ | ✅ | ✅ | — | — |
| Concurrency‑safe redemption | ✅ | ❌ | ❌ | — | — |
| Idempotent replay | ✅ | ❌ | ❌ | ⚠️ | ⚠️ |
| Multi‑tenant scoping | ✅ | ❌ | ❌ | ❌ | ❌ |
| Vanity / signed codes | ✅ | ❌ | ⚠️ | — | ⚠️ |
| Email invitations | ✅ | ✅ | ⚠️ | ❌ | ⚠️ |
| Referral graph + double‑sided rewards | ✅ | ❌ | ❌ | ⚠️ referrer‑only | ❌ |
| Anti‑abuse / fraud | ✅ | ❌ | ❌ | ⚠️ self‑ref only | ❌ |
| Per‑invite role/entitlement grant | ✅ | ❌ | ❌ | ❌ | ❌ |
| Virality analytics (K‑factor) | ✅ | ❌ | ❌ | ❌ | ❌ |
| GDPR erasure | ✅ | ❌ | ❌ | ❌ | ✅ |
| Events / hooks | ✅ | ❌ | ✅ | ✅ | ✅ |
| HTTP API + MCP surface | ✅ | ❌ | ❌ | ❌ | ❌ |
Requirements
- PHP
^8.3 - Laravel
^12.0 | ^13.0
Installation
Make your user model invitation‑aware:
Publish the config (optional):
Quick start
Generate codes (PHP):
Redeem a code — atomic, idempotent, fraud‑gated:
Over the REST API (routes auto‑register; attach your own auth/RBAC via config):
Over MCP — register the bundled tools on your server:
Architecture
* Provisioners are pluggable: the SpatiePermissionProvisioner (role grant) ships by default; a host
adds its own under the invitations.provisioners tag.
Host integration seams
The engine never hard‑codes your app. Three small seams keep it vendor‑neutral:
| Seam | Default | Override when… |
|---|---|---|
Contracts\TenantResolver |
single‑tenant ('default') |
you're multi‑tenant — bind your own resolver |
Contracts\Provisioner (tag invitations.provisioners) |
SpatiePermissionProvisioner (role) |
you grant more on redemption (e.g. team/project membership) |
Contracts\InvitedAccount |
InteractsWithInvitations trait |
your user model stores email differently |
Events
CodeRedeemed (fired once, on a fresh claim — never on an idempotent replay), InvitationSent,
InvitationAccepted. Listen to grant perks, send a welcome, or update your own projections.
GDPR
PII (ip / fingerprint / recipient) is stored hashed or anonymizable. The scheduled sweep anonymizes
rows past the retention window in place — current_uses, funnel counts and K‑factor are untouched:
Configuration
All knobs live in config/invitations.php and are env‑overridable — code alphabet/length, signing key,
PII retention, anti‑abuse thresholds/velocity/blocklists, and the route prefix + per‑surface middleware
(attach your RBAC gate to invitations.routes.admin_middleware).
Web admin panel
padosoft/laravel-invitations-admin ships a
polished React + Tailwind admin SPA over this package's API — a virality dashboard plus campaigns,
codes, invitations (who accepted vs. who didn't), referral graph, reward ledger, waitlist and
anti‑abuse review. Default‑OFF, host‑gated, prebuilt assets (no JS toolchain to install). For apps that
already run their own React SPA, the screens can be adapted natively instead of cross‑mounting.
Testing
License
MIT © Padosoft. See LICENSE.
All versions of laravel-invitations with dependencies
illuminate/contracts Version ^12.0|^13.0
illuminate/database Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
spatie/laravel-package-tools Version ^1.92