auth library

Classes

Auth: Authentication (Auth::user(), Auth::guard('jwt')).
AuthConfig: AUTH_* / JWT_* configuration (config/auth.php parity).
Authenticatable: Something that can be authenticated (Laravel Authenticatable).
AuthenticateMiddleware: auth / auth:token,jwt — tries each guard in order and activates the first that authenticates; otherwise 401 {"message":"Unauthenticated."}.
AuthManager: Multi-guard authentication manager (Laravel AuthManager).
AuthorizationGate: Ability registry and checker (Laravel Gate). One instance per application; forUser yields a view bound to a specific user.
AuthorizeMiddleware: Middleware can:ability,param1,param2 — route parameters are passed as their bound models (see Router.bind) or raw strings.
AuthResponse: Result of an authorization check with an optional message and code.
AuthScope: Access to the active request scope for guards.
AuthState: Per-scope authentication state: resolved users per guard, the active guard chosen by auth:a,b middleware and the current access token.
ClosureGuard<T extends Authenticatable>: A guard driven by a closure (Auth.viaRequest).
CreatePersonalAccessTokensTable: Creates personal_access_tokens with the exact Sanctum schema. Named like Sanctum's migration so a shared migrations table stays consistent.
Crypt: Symmetric encryption keyed by APP_KEY (Crypt::encryptString).
Ed25519JwtKey: Ed25519 key for EdDSA. Verification only needs publicKey; signing also needs the 32-byte seed.
Encrypter: Authenticated symmetric encryption keyed by APP_KEY (§7.6.1).
EnvironmentEncrypter: Laravel-compatible encrypted environment files (.env.encrypted), as written by php artisan env:encrypt and dartisan env:encrypt.
Gate: Authorization (Gate::allows, Gate::authorize).
Guard<T extends Authenticatable>: Resolves the user for a request (Laravel Guard).
Hash: Password hashing (Hash::make, Hash::check).
HashConfig: HASH_DRIVER / BCRYPT_ROUNDS / ARGON_* configuration (config/hashing.php parity).
HashInfo: Parsed metadata of a hash string.
HashManager: Creates and verifies password hashes off the event loop.
HmacJwtKey: Shared secret for HS256. An empty secret is refused: HMAC over an empty key signs and verifies like any other, so a JWT_SECRET that was never set would accept tokens anyone could mint (AuthManager also requires 32 bytes for the guard's secret; this is the floor for every other use of the codec).
JwtClaims: Verified claims of a token.
JwtCodec: Signs and verifies JWTs (RFC 7519) with a key ring.
JwtDenylist: Revoked token ids (jti) until their expiry.
JwtGuard<T extends Authenticatable>: Stateless bearer-JWT guard: sub is the user's identifier.
JwtKey: A signing/verification key with an optional kid for rotation.
MemoryJwtDenylist: In-memory denylist of one isolate, for tests and single-isolate tools: with APP_ISOLATES > 1 a token revoked on one isolate stays valid on the others. Applications get a shared one by default (auth.jwt).
ModelUserProvider<T extends Authenticatable>: UserProvider backed by an ORM model definition.
NewAccessToken: Result of TokenGuard.issue: the plain-text token is only available here, never again (only its hash is stored).
PersonalAccessToken: A row of personal_access_tokens (Sanctum-compatible schema).
Policy<T extends Object>: Groups authorization logic for one model type (Laravel Policy).
RequestGuard<T extends Authenticatable>: Base for guards that resolve the user from the current Request: caches per scope, so every call within one request hits the database at most once.
StatefulGuard<T extends Authenticatable>: A guard that also persists login state (session guard, T2).
TokenGuard<T extends Authenticatable>: Sanctum-style personal access token guard (BLUEPRINT_V2 §7.6.2).
UserProvider<T extends Authenticatable>: Loads users for guards (Laravel UserProvider).

Enums

EncryptionCipher: Symmetric ciphers supported by Encrypter.
HashDriver: Password hashing drivers (ADR-008). Every driver produces a self-describing string so that HashManager.check can detect the driver from its prefix.
JwtAlgorithm: Signing algorithms (BLUEPRINT_V2 §7.6.2): HMAC-SHA256 and Ed25519.

Mixins

AuthenticatableModel: Default Authenticatable implementation for models:

Extensions

RequestAuth on Request: Auth helpers on the request ($request->user(), bearerToken()).

Constants

strongDrivers → const Set<HashDriver>: Drivers whose hashes HashManager.check accepts across a driver switch even with verify enabled (ADR-024).

Functions

bearerTokenOf(Request request) → String?: Extracts the Authorization: Bearer <token> value, if any.
constantTimeBytesEquals(List<int> x, List<int> y) → bool: Byte-wise constant-time comparison.
constantTimeEquals(String a, String b) → bool: Compares two strings without leaking their common-prefix length through timing (BLUEPRINT_V2 §7.6.5).
crc32b(List<int> bytes) → String: PHP hash('crc32b', $data): CRC-32 (IEEE 802.3, as zlib) as 8 lowercase hex digits. Sanctum appends it to token secrets so leaked tokens can be recognised by secret scanners.
equalizeLoginTiming(Map<String, Object?> credentials) → Future<void>: When no user matched credentials, hashes their password against a dummy hash so failed logins for unknown and known accounts take the same time (user enumeration mitigation, BLUEPRINT_V2 §9.2 item 9).
parseDbDateTime(Object? value) → DateTime?: Parses a timestamp column value (driver-specific: DateTime, ISO string or epoch milliseconds).
secureRandomString(int length) → String: Cryptographically random token of length URL-safe alphanumeric chars (Laravel Str::random).

Typedefs

GateAfterHook = FutureOr<Object?> Function(Authenticatable? user, String ability, AuthResponse result, List<Object?> args): after hook: may override the result by returning non-null.
GateBeforeHook = FutureOr<Object?> Function(Authenticatable? user, String ability, List<Object?> args): before hook: a non-null result short-circuits the check.
GateCallback = FutureOr<Object?> Function(Authenticatable? user, List<Object?> args): Ability callback: returns bool, AuthResponse or null (= no opinion in before/after hooks, deny in abilities).

Exceptions / Errors

AuthenticationException: 401 — no authenticated user for the attempted guards.
AuthorizationException: 403 — the user may not perform the ability (Gate.authorize).
DecryptException: Raised when a payload is malformed, was tampered with or was encrypted with an unknown key.
EncryptException: Raised for invalid keys.
HashException: Raised for driver mismatches and malformed hashes.
JwtException: Raised for malformed, expired, not-yet-valid or badly signed tokens.

Classes

Enums

Mixins

Extensions

Constants

Functions

Typedefs

Exceptions / Errors

daravel package

auth library