Download the PHP package zipavlin/redline without Composer

Redline for Laravel

A Laravel package for self-hosted, on-page bug-reporting, with a reporting widget and dashboard.
Testers can pin comments, annotate screenshots, record videos, and view existing pins without leaving the page; developers review and resolve reports in a built-in dashboard. All data lives in your own storage (SQLite by default).

Requirements

Get started

Interactive redline:install walks you through the storage backend, auth provider, guard, mail setup, and disabled features, writes your choices to .env, publishes config and assets, and creates a first (admin) user.

Activation

The package is partially gated - know what turns on where:

• Publishing and the artisan commands (redline:install, redline:user, redline:remove) are always available.
• The dashboard (SPA at /{redline.path}, default /redline) is gated by the guard
• The API routes and widget injection are also gated by the guard (default when APP_ENV=staging)

Configuration

All settings are read from config/redline.php, which maps to these env variables:

Keep the data out of your app's git history: /storage/app/redline/ should be gitignored.

Auth providers & roles

Roles are reporter / developer / admin (plus a shared guest identity for guest-mode submissions). How roles are claimed depends on the auth provider:

Notes:

• If no admin exists, the first developer to register is auto-promoted to admin.

• With the default REDLINE_AUTH_ALLOW_SELF_ADMIN=false, public registration can never create an admin - seed the first one with:

• Authentication is a JWT (HS256) delivered as an HttpOnly redline_token cookie. State-changing cookie-authenticated requests must echo the non-HttpOnly redline_csrf cookie back in the X-Redline-CSRF header (double-submit CSRF). Cross-origin clients use Authorization: Bearer and skip CSRF.

Capabilities by role

¹ A report owner may only Reopen (resolved → in progress) or Confirm (resolved → done); developers/admins drive the main lifecycle transitions.

Using the widget

The widget appears as a floating toolbar (bottom-right by default) on every page of the activated environment. Click any mode button - on first use you are prompted for identity (name/email/role via the identity modal).

• Comment / pin - click any element to pin a comment
• Screenshot - captures the page, then lets you crop and annotate
• Video - records the current tab via getDisplayMedia (no audio; 2 min max)
• View - toggle pin visibility: all / open reports
• Identity chip - settings

Dashboard

The dashboard is a Vue SPA served at /{redline.path} (default /redline). It lists reports and report details, users and user details and simple analytics dashboard.

Artisan commands

Storage backends

Database (default) - DatabaseStorageProvider

Eloquent models on a dedicated SQLite connection at storage/app/redline/redline.db. Requires pdo_sqlite. Schema (numbered migrations 0001–0005) is created by php artisan redline:install.

JSON files - FileStorageProvider

One JSON file storage via ryangjchandler/orbit. Requires Laravel 12+. Optional dependency - install with composer require ryangjchandler/orbit when you choose this backend.

Security considerations

• Widget injection and the API are gated by the guard (APP_ENV=staging by default); publishing and artisan commands remain available for operational use.
• JWT auth cookie is HttpOnly (JS can never read it) and never returned in JSON bodies; double-submit CSRF via the redline_csrf cookie + X-Redline-CSRF header.
• Guest reporting is opt-in (REDLINE_AUTH_GUEST) with configured-origin checks and a per-IP throttle; REDLINE_ALLOWED_ORIGINS is the reverse-proxy escape hatch.
• Uploaded files are renamed to {ulid}.{ext} (original names discarded) and served only through a controller, never via public URLs.
• Report/comment bodies are sanitized with htmlpurifier.
• Public registration can never create an admin by default (REDLINE_AUTH_ALLOW_SELF_ADMIN=false).

Frontend development

All frontend source lives in the sibling redline-app repo (Vue 3 + TypeScript + Vite + Nuxt UI). To develop against this package locally:

1. In redline-app: npm ci && npm run dev (Vite dev server on :5173, serves both widget and dashboard entries as ESM).
2. In the host app set REDLINE_VITE_URL=http://localhost - the blade shells then load src/widget.ts / src/dashboard.ts directly from Vite with hot reload.

Production bundles are built in redline-app (npm run build → dist/), copied into this repo's public/ (committed), and published via php artisan vendor:publish --tag=redline-assets.

Testing

Current baseline: 251 passed, 3 skipped (the skips are Orbit-gated FileDriverGrammarTest tests that skip when ryangjchandler/orbit is not installed).

Changelog

See CHANGELOG.md.

Credits

• Žiga Pavlin

License

The MIT License (MIT). See LICENSE.md.