Download the PHP package padosoft/laravel-rebel-bridge-spatie-otp without Composer
On this page you can find all versions of the php package padosoft/laravel-rebel-bridge-spatie-otp. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download padosoft/laravel-rebel-bridge-spatie-otp
More information about padosoft/laravel-rebel-bridge-spatie-otp
Files in padosoft/laravel-rebel-bridge-spatie-otp
Package laravel-rebel-bridge-spatie-otp
Short Description Bridge between spatie/laravel-one-time-passwords and Laravel Rebel: exposes email/SMS OTP as an AAL2 step-up driver with full audit telemetry. Part of padosoft/laravel-rebel-*.
License MIT
Homepage https://github.com/padosoft/laravel-rebel-bridge-spatie-otp
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-rebel-bridge-spatie-otp
Official documentation: https://doc.laravel-rebel.padosoft.com
laravel-rebel-bridge-spatie-otp
AAL2 step-up authentication for Laravel apps already using spatie/laravel-one-time-passwords.
Part of the Laravel Rebel enterprise-auth suite.
What this package does
This bridge exposes spatie/laravel-one-time-passwords as a step-up driver in the
Laravel Rebel DriverRegistry. Once registered, the Rebel step-up manager can challenge
users with a one-time password (delivered by Spatie's notification system — email, SMS, or any
custom channel) as a second factor to confirm a sensitive action ("step-up authentication").
In plain English: when a user wants to do something risky (delete their account, make a large transfer, change their email), your app asks them to prove they're still present by typing a fresh 6-digit code that was just sent to their inbox or phone. This package wires up the existing Spatie OTP you've already installed to do exactly that.
Glossary
| Term | Meaning |
|---|---|
| OTP | One-Time Password — a short numeric code valid for a single use and a short time window. |
| Step-up | Asking an already-authenticated user to prove presence again before a sensitive action. |
| AAL | Authenticator Assurance Level (NIST 800-63). AAL1 = password only; AAL2 = password + second factor. |
| AMR | Authentication Methods References — a list of methods used, e.g. ['otp']. |
| Phishing-resistant | A factor that cannot be captured and replayed by a phishing site (e.g. passkey/WebAuthn). OTP is NOT phishing-resistant. |
| DriverRegistry | Rebel's runtime registry of available step-up drivers; each driver declares its key and assurance level. |
| AuditLogger | Core Rebel contract that records auth events to rebel_auth_events for the compliance panel. |
| HasOneTimePasswords | Spatie's PHP trait — add this to your User model to enable OTP delivery. |
How it works (step by step)
The OTP code never appears in the audit log (only the event type, channel, and subject identity).
Installation
1. Require the packages
spatie/laravel-one-time-passwordsis a suggested dependency. This bridge installs cleanly without it — the driver simply stays unregistered until Spatie is present.
2. Add the Spatie migration and config
3. Add the trait to your User model
4. (Optional) Publish the Rebel bridge config
Configuration
File: config/rebel-bridge-spatie-otp.php
| Key | Type | Default | Description |
|---|---|---|---|
drivers.spatie_otp |
bool | true |
Enable or disable the spatie_otp step-up driver. |
audit_channel |
string | 'otp' |
Channel label in audit events (rebel_auth_events.channel). Change to 'email' or 'sms' to match your Spatie delivery method. |
You can also control the driver via the REBEL_SPATIE_OTP_DRIVER_ENABLED and
REBEL_SPATIE_OTP_AUDIT_CHANNEL environment variables.
Usage examples
Example 1 — Protect a sensitive route with step-up middleware
Configure the purpose policy (e.g. in config/rebel-step-up.php):
Example 2 — Start a step-up challenge manually
Example 3 — Verify the user's input
Example 4 — Test your controller with a fake broker
In your feature tests, swap the broker for a fully in-memory fake — no mail, no DB:
Example 5 — Disable the driver temporarily
In .env:
Or in code (e.g. in a feature flag service provider):
Assurance declaration
| Property | Value |
|---|---|
| Driver key | spatie_otp |
| AAL | Aal::Aal2 |
| Phishing-resistant | No |
| AMR | ['otp'] |
Audit events
Every step-up operation emits an event to rebel_auth_events via AuditLogger. The OTP code is
never logged.
| Event type | When |
|---|---|
stepup.spatie_otp.started |
start() called, OTP sent successfully |
stepup.spatie_otp.verified |
verify() returned true (correct code) |
stepup.spatie_otp.failed |
verify() returned false (wrong / expired / rate-limited) |
Each event carries: subjectType, subjectId, channel (configurable), provider: 'spatie_otp',
purpose, aal: Aal2, amr: ['otp'].
Competitor card-battle
How does Rebel's spatie OTP bridge compare to rolling your own, or using alternative SaaS providers?
| Feature | Laravel Rebel + Spatie OTP | Roll-your-own OTP | Twilio Verify | Shopify MFA |
|---|---|---|---|---|
| Offline testable (FakeOtpBroker) | ✅ | ❌ Requires mail/DB | ❌ Requires API | ❌ SaaS only |
| AAL/AMR compliance metadata | ✅ | ❌ DIY | ❌ Not exposed | ❌ Not exposed |
| Audit trail to DB (rebel_auth_events) | ✅ | ❌ DIY | ❌ | ❌ |
| Purpose-scoped step-up policies | ✅ | ❌ | ❌ | ❌ |
| Config-gated driver toggle | ✅ | ❌ | N/A | N/A |
| Zero hard dep (installs without Spatie) | ✅ | N/A | N/A | N/A |
| Fail-closed on broker Throwable | ✅ | ❌ Depends on impl | ❌ | ❌ |
| Custom delivery channel (email/SMS) | ✅ via Spatie notification | ❌ DIY | ✅ | ❌ |
| Open-source & self-hosted | ✅ | ✅ | ❌ | ❌ |
| Seam pattern (swappable broker) | ✅ | ❌ | ❌ | ❌ |
🔋 Vibe coding with batteries included
This package ships everything you need to start building immediately:
CLAUDE.md— AI session guide (design notes, key decisions, session startup checklist).AGENTS.md— operative rules for every contributor (human or AI): branching, CI gates, DoD..claude/skills/rebel-package-dev/SKILL.md— the dev loop (TDD, PHPStan-max recipes, security rules, Spatie-specific gotchas).Testing\FakeOneTimePasswordBroker— fully in-memory offline test double.config/rebel-bridge-spatie-otp.php— documented config file.- CI matrix — PHP 8.3/8.4/8.5 × Laravel 12/13, quality job (Pint + PHPStan level max).
Requirements
| Dependency | Version |
|---|---|
| PHP | ^8.3 |
| Laravel | ^12 or ^13 |
| padosoft/laravel-rebel-core | ^0.1 |
| padosoft/laravel-rebel-step-up | ^0.1 |
| spatie/laravel-one-time-passwords | ^1.0 (suggested) |
License
MIT — see LICENSE.
All versions of laravel-rebel-bridge-spatie-otp with dependencies
illuminate/contracts Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
padosoft/laravel-rebel-core Version ^0.1
padosoft/laravel-rebel-step-up Version ^0.1
spatie/laravel-package-tools Version ^1.92