Saucebase Auth

Sign-in for Saucebase: login, registration, social login, magic links, passkeys, password reset and user admin.

A module for Saucebase, the AI-ready Laravel SaaS kit. Modules are Composer packages you add to a Saucebase app; once installed, the code is yours to change.

Features

• Login and registration, as a page or a modal over the current page
• Social login with Google and GitHub built in, and any other Socialite provider you add; users link and unlink accounts themselves
• Magic links: sign in from an emailed link, no password
• Passkeys: sign in with a fingerprint, face or screen lock, through Laravel Passkeys
• Password reset and email verification
• Profile and security settings in the settings modal
• Login alerts: an email when someone signs in to the account
• Impersonation: admins sign in as a user and switch back
• User admin in the admin panel
• Vue and React

Install

New to Saucebase? Start a new app and pick auth when it asks for modules:

curl -fsSL https://install.saucebase.dev | bash

It installs PHP and Composer if they're missing. With the CLI already installed, run saucebase new my-app instead.

Already have a Saucebase app? Add it with:

php artisan saucebase:module-install auth
npm install && npm run build

Then make yourself an admin with php artisan auth:make-admin.

Manual install

If a patch doesn't apply, because your file has changed, make its change by hand:

user.patch adds the Sociable trait to your user model, for social login and connected accounts, and the PasskeyAuthenticatable trait with its PasskeyUser contract, for passkeys:

// app/Models/User.php
use Laravel\Passkeys\Contracts\PasskeyUser;
use Laravel\Passkeys\PasskeyAuthenticatable;
use Modules\Auth\Traits\Sociable;

class User extends Authenticatable implements PasskeyUser
{
    use PasskeyAuthenticatable;
    use Sociable;
}

Configuration

Most settings are in the admin panel, under Settings → Authentication: open or close registration, login as a modal, magic links and how long they last, passkeys, login alerts, and which social providers are on.

Passkeys are on by default. They are bound to the host in APP_URL and only work over HTTPS (or on localhost):

• Changing the app's domain makes every passkey stop working, and users have to add new ones.
• Serving the app on several subdomains? Publish the package config (php artisan vendor:publish --tag=passkeys-config), set relying_party_id to the parent domain and list every origin in allowed_origins.
• Passkeys derive a user handle from APP_KEY. Set PASSKEYS_USER_HANDLE_SECRET before rotating the key.
• Resetting a password keeps the account's passkeys, as most services do. Users are emailed whenever one is added, and after a suspected compromise they should review the list under Settings → Security and remove any they don't recognize.

Social login needs keys from Google or GitHub. Add them to .env:

GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

Register https://<your-app>/auth/socialite/<provider>/callback as the redirect URL with each provider.

Another provider? Any Laravel Socialite driver works, including the community ones at Socialite Providers:

1. Install the driver and add its keys to .env.
2. In modules/auth/config/services.php, add its credentials next to google and github, and list it under socialite_providers.
3. Add its icon to providerIcons.ts.
4. Switch it on in the admin panel.

Emails (reset, verification, magic links, alerts) need a working mail setup.

Demo data

php artisan modules:seed --module=auth --demo

Adds a user (chef@saucebase.dev) and a support staff account (support@saucebase.dev) that only sees user admin. Both use the DEMO_PASSWORD from .env.

License

MIT. See LICENSE.