Download the PHP package padosoft/laravel-rebel-recovery without Composer
On this page you can find all versions of the php package padosoft/laravel-rebel-recovery. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download padosoft/laravel-rebel-recovery
More information about padosoft/laravel-rebel-recovery
Files in padosoft/laravel-rebel-recovery
Package laravel-rebel-recovery
Short Description High-assurance account recovery for Laravel Rebel: single-use HMAC-hashed recovery (backup) codes, generated once at enrolment, with anti-ATO checks. Part of padosoft/laravel-rebel-*.
License MIT
Homepage https://github.com/padosoft/laravel-rebel-recovery
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-rebel-recovery
Laravel Rebel — Recovery
Official documentation: https://doc.laravel-rebel.padosoft.com
Single-use recovery codes done right. Backup codes the user can fall back to when they lose their device — generated once, stored only as keyed HMACs, verified in constant time, single-use, and easy to type. Part of the
padosoft/laravel-rebel-*suite.
Table of contents
- What it is
- Why this package
- Rebel Recovery vs the alternatives
- Installation
- Usage
- Security notes
.env.example- Testing & License
What it is
High-assurance account-recovery building blocks for Rebel. v0.1.0 ships recovery
(backup) codes: a set of one-time codes a user can use to recover access. Pair them with a
high-assurance step-up purpose (from laravel-rebel-step-up) to gate sensitive recovery flows.
Depends on padosoft/laravel-rebel-core.
Why this package
| ★ | What | In short |
|---|---|---|
| ★★★ | Hashed at rest | Codes are stored as a keyed HMAC of (salt\|code) with a key_version — never plaintext, pepper-rotation friendly. |
| ★★★ | Single-use & atomic | Verification locks the row and consumes the code; a code works exactly once. |
| ★★★ | Constant-time verify | All candidates are checked without early-exit, so timing doesn't leak which code matched. |
| ★★ | Typo-tolerant | Input is normalized (case, separators, Crockford O→0 / I·L→1), so a correct code never fails on format. |
| ★★ | Regenerate safely | Generating a new set invalidates all previous unconsumed codes. |
| ★★ | Audited & multi-tenant | Generate/complete/fail are recorded; rows are tenant-scoped. |
Rebel Recovery vs the alternatives
| Capability | Rebel Recovery | Shopify | Fortify recovery codes | Hand-rolled |
|---|---|---|---|---|
| Self-issued recovery codes for your users | ✅ | ❌ | ✅ | ➖ |
| Codes hashed at rest (you control storage) | ✅ | ❌ | ➖ (encrypted blob) | ❌ |
| Keyed HMAC + key_version (pepper rotation) | ✅ | ❌ | ❌ | ❌ |
| Constant-time verification | ✅ | ➖ | ➖ | ❌ |
| Atomic single-use (row lock) | ✅ | ➖ | ➖ | ❌ |
| Input normalization (typo-tolerant) | ✅ | ➖ | ❌ | ❌ |
| ~100-bit entropy codes | ✅ | ➖ | ➖ (~50 bits) | ➖ |
| Audited + multi-tenant (your app) | ✅ | ❌ | ❌ | ❌ |
Legend: ✅ built-in · ➖ partial / hosted-only / not exposed to you · ❌ not available.
Note: Shopify is a hosted, closed commerce platform — its own staff/customer logins may have backup codes, but it never exposes a self-hostable, HMAC-hashed, single-use recovery-code API you can issue to your application's users.
Installation
Usage
Security notes
- Never stored in plaintext: only a keyed HMAC of
(salt|code)with akey_version. - Single-use & atomic: a row lock guarantees a code can be redeemed once.
- Constant-time: the whole candidate set is checked, no early-exit timing leak.
- No built-in lockout: recovery codes are a lookup secret — put your app's brute-force
throttle in front of
verify()(and treat repeated failures as an anti-ATO signal). - Multi-tenant: rows are scoped via the core tenant scope — resolve the current tenant per request in multi-tenant deployments so codes never cross tenants.
.env.example
🔋 Vibe coding with batteries included
This package ships AI batteries — so you (and your AI agent) can extend it correctly on the first try:
CLAUDE.md— a concise AI working guide (purpose, conventions, architecture, how to extend, Definition of Done). Plain Markdown, so Claude Code, Cursor, Copilot and Codex all read it.AGENTS.md— the agent/workflow contract (branch → PR → CI → tag/release, the gates)..claude/skills/— invocable skills (at leastrebel-package-dev) encoding the suite's TDD loop, the PHPStan-level-max recipes, the security/telemetry rules, and the release discipline.
Open the repo in your AI editor and just start — the rules, guardrails and extension recipes come
with it. PRs that follow the shipped CLAUDE.md pass CI (PHPStan max + Pest + Pint) and review the
first time around.
Testing & License
License: MIT — see padosoft/laravel-rebel suite.
All versions of laravel-rebel-recovery with dependencies
illuminate/contracts Version ^12.0|^13.0
illuminate/support Version ^12.0|^13.0
spatie/laravel-package-tools Version ^1.92
padosoft/laravel-rebel-core Version ^0.1