PHPackages padosoft/laravel-rebel-demo - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. padosoft/laravel-rebel-demo ActiveProject[Authentication & Authorization](/categories/authentication) padosoft/laravel-rebel-demo =========================== Demo / integration application for the padosoft/laravel-rebel-\* enterprise authentication suite. 00PHPCI failing Since Jun 20Pushed 1mo agoCompare [ Source](https://github.com/padosoft/laravel-rebel-demo)[ Packagist](https://packagist.org/packages/padosoft/laravel-rebel-demo)[ RSS](/packages/padosoft-laravel-rebel-demo/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependenciesVersions (3)Used By (0) Laravel Rebel — Integration Demo ================================ [](#laravel-rebel--integration-demo) > Official documentation: > A real **Laravel 13** application that installs, activates and wires together the **entire `padosoft/laravel-rebel-*` suite**, and exercises every package end to end — front-end (real browser) and back-end. This is the **guarantee gate**: proof the ecosystem works together, not just in each package's own unit tests. [![Laravel Rebel Web Admin Panel](resources/screenshoots/Laravel-Rebel-Web-Panel-dasboard-dark.png)](resources/screenshoots/Laravel-Rebel-Web-Panel-dasboard-dark.png) [![Laravel 13](https://camo.githubusercontent.com/9522347b9d5391961659c8c2749dabf2056511ff9d91732ad68246e41c5fd35a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d31332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/9522347b9d5391961659c8c2749dabf2056511ff9d91732ad68246e41c5fd35a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d31332d4646324432303f7374796c653d666c61742d737175617265266c6f676f3d6c61726176656c266c6f676f436f6c6f723d7768697465) [![PHP 8.4](https://camo.githubusercontent.com/d072d1f17b6a8dc799e782e39d676d25cab3e73854efe49206d6ffcb6473abd4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e342d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://camo.githubusercontent.com/d072d1f17b6a8dc799e782e39d676d25cab3e73854efe49206d6ffcb6473abd4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e342d3737374242343f7374796c653d666c61742d737175617265266c6f676f3d706870266c6f676f436f6c6f723d7768697465) [![Playwright](https://camo.githubusercontent.com/7d0a3a6eae29b070e1641a792eb58fdcb75cd0e7910db63e1d9e64f425ed10d7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7465737465642d506c6179777269676874253230287265616c25323062726f77736572292d3245414433333f7374796c653d666c61742d737175617265266c6f676f3d706c6179777269676874)](https://camo.githubusercontent.com/7d0a3a6eae29b070e1641a792eb58fdcb75cd0e7910db63e1d9e64f425ed10d7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7465737465642d506c6179777269676874253230287265616c25323062726f77736572292d3245414433333f7374796c653d666c61742d737175617265266c6f676f3d706c6179777269676874) [![MIT](https://camo.githubusercontent.com/ac049ef4e7a0b7196b09add6ac2d4f180e544c0ac779c2b2ac2fd2723a209579/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75653f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/ac049ef4e7a0b7196b09add6ac2d4f180e544c0ac779c2b2ac2fd2723a209579/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d626c75653f7374796c653d666c61742d737175617265) --- What this app proves -------------------- [](#what-this-app-proves) Every package in the suite is installed and active in one Laravel app, sharing one database, one session and one audit trail: `core` · `email-otp` · `step-up` · `bridge-fortify` · `channels` · `channel-twilio` · `admin-api` · `admin` · `sessions` · `recovery` · `ai-guard` · `bot-protection` · `channel-vonage` · `channel-bird` · `channel-telegram` · `channel-discord` · `bridge-passkeys` · `bridge-spatie-otp` · `bridge-laragear-2fa` · `bridge-otpz` Each capability has a clickable demo on the landing page (`/`) so you can exercise it yourself. ### Verified end to end (in a real browser + back-end) [](#verified-end-to-end-in-a-real-browser--back-end) FlowPackages exercisedWhat is asserted**Passwordless email-OTP login** (`/account/login`)core, email-otpstart → real email with code → verify → done; identifier is HMAC'd; `email_otp.requested`/`verified` land in the audit**Web Admin Panel** (`/admin/rebel`)admin, admin-api, corefail-closed Gate, panel shell + assets load, widgets call the API, **Audit Explorer shows live cross-package events****Admin API** (`/rebel/admin/api/v1/*`)admin-api`401` without an admin session (fail-closed), `200` with one**Fortify password login** (`/login`)bridge-fortifyFortify auth succeeds and its `login.succeeded` / `logout` events are **mapped into the Rebel audit****Recovery codes** (`/demo/recovery`)recovery10 single-use codes; a code verifies once, reuse is rejected, `remaining` decrements**Sessions & refresh rotation** (`/demo/sessions`)sessionsa refresh token rotates; presenting the **old token is flagged as reuse** (theft signal)**Step-up policy** (`/demo/stepup`)step-upthe `checkout-credit-order` purpose loads with its assurance + **PSD2/SCA dynamic linking** on**AI anomaly detection** (`/demo/ai-guard`)ai-guardthe deterministic detector runs over the live audit window and reports cases raised**9 extras hub** (`/demo/extras`)bot-protection, channel-vonage/bird/telegram/discord, bridge-passkeys/spatie-otp/laragear-2fa/otpzlive DriverRegistry dump, DeliveryChannelRegistry, ProviderRegistry; Turnstile test-key form (passes live + offline); otpz bridge OTP email end-to-end> `channels` + `channel-twilio` boot and register in this app; the Twilio provider is verified against the **real Twilio Verify API** by its own opt-in live test suite (it sends a real SMS, so it is intentionally not fired on every demo run). ### Extras hub — 9 new packages (`/demo/extras`) [](#extras-hub--9-new-packages-demoextras) CapabilityPackageLive vs configure-to-enable**Bot-protection (Turnstile)**`bot-protection`**Live** — Cloudflare official test keys (sitekey `1x00000000000000000000AA`) always pass; `bot.check.passed` recorded in audit**Vonage SMS/Voice channel**`channel-vonage`Configure-to-enable: set `VONAGE_API_KEY` + `VONAGE_API_SECRET`**Bird SMS channel**`channel-bird`Configure-to-enable: set `BIRD_ACCESS_KEY`**Telegram delivery channel**`channel-telegram`Configure-to-enable: set `TELEGRAM_BOT_TOKEN`**Discord delivery channel**`channel-discord`Configure-to-enable: set `DISCORD_WEBHOOK_URL`**Passkeys step-up driver**`bridge-passkeys` + `spatie/laravel-passkeys`**Live** — driver registered (AAL2 phishing-resistant); full enrollment needs a real WebAuthn device**Spatie OTP step-up driver**`bridge-spatie-otp` + `spatie/laravel-one-time-passwords`**Live** — driver registered + exercised via the bridge OTP form (sends OTP email to Mailtrap)**Laragear TOTP step-up driver**`bridge-laragear-2fa` + `laragear/two-factor`**Live** — driver registered (AAL2 TOTP); enrollment (QR scan) not wired in this demo; see bridge-bug note**Otpz email OTP step-up driver**`bridge-otpz` + `benbjurstrom/otpz`**Live** — driver registered + exercised end-to-end (sends email OTP via Mailtrap, verified in the browser)The hub renders the **live registries** — every step-up driver, delivery channel and verification provider actually registered in this boot — plus the Turnstile bot-protection check and the otpz bridge OTP form: [![Extras hub: live step-up driver / delivery channel / verification provider registries, bot-protection and otpz step-up](resources/screenshoots/demo-admin-bridge-and-channles.png)](resources/screenshoots/demo-admin-bridge-and-channles.png) ### The Audit Explorer, live [](#the-audit-explorer-live) The admin panel reads the unified audit log written by *every* package. After clicking through the demos you can see OTP, recovery, session and Fortify events side by side: [![Audit Explorer with live cross-package events](resources/screenshoots/demo-admin-audit-explorer.png)](resources/screenshoots/demo-admin-audit-explorer.png) --- Web Admin Panel --------------- [](#web-admin-panel) `laravel-rebel-admin` ships a self-hosted security-operations dashboard (the dark UI above): security overview, OTP/step-up funnels, channel performance, provider health, an audit explorer, device & session trust, risk rules, anomaly cases, an AI copilot and a compliance center — tenant-aware and **fail-closed** (you must pass the `rebel-admin` Gate). In this demo `/demo/login-as-admin` signs you in as the seeded admin so you can open `/admin/rebel`. --- Screenshots ----------- [](#screenshots) The demo end to end — the landing page, both sign-in paths, the email-OTP step-up, and the live web admin panel. **Demo home** — every capability, with auth state [![](resources/screenshoots/demo-admin-home.png)](resources/screenshoots/demo-admin-home.png)**Sign in (Fortify password)** [![](resources/screenshoots/demo-admin-signin.png)](resources/screenshoots/demo-admin-signin.png)**Passwordless email-OTP login** [![](resources/screenshoots/demo-admin-password-otp.png)](resources/screenshoots/demo-admin-password-otp.png)**Step-up: a sensitive action is guarded** [![](resources/screenshoots/demo-stepup.png)](resources/screenshoots/demo-stepup.png)**Step-up: email-OTP challenge** [![](resources/screenshoots/demo-stepup-emailOTP.png)](resources/screenshoots/demo-stepup-emailOTP.png)**Step-up: confirmed → action unlocked** [![](resources/screenshoots/demo-stepup-emailOTP-confirmed.png)](resources/screenshoots/demo-stepup-emailOTP-confirmed.png)**Web Admin Panel — Security Overview** [![](resources/screenshoots/Laravel-Rebel-Web-Panel-dasboard-dark.png)](resources/screenshoots/Laravel-Rebel-Web-Panel-dasboard-dark.png)**Web Admin Panel — Audit Explorer (live events)** [![](resources/screenshoots/demo-admin-audit-explorer.png)](resources/screenshoots/demo-admin-audit-explorer.png)**Extras hub — 9 new packages (live registries)** [![](resources/screenshoots/demo-admin-bridge-and-channles.png)](resources/screenshoots/demo-admin-bridge-and-channles.png)**Demo home — every capability** [![](resources/screenshoots/demo-admin-home.png)](resources/screenshoots/demo-admin-home.png)--- Run it in 3 minutes ------------------- [](#run-it-in-3-minutes) ``` git clone https://github.com/padosoft/laravel-rebel-demo cd laravel-rebel-demo composer install cp .env.example .env php artisan key:generate # SQLite is the default; create the file then migrate + seed php artisan migrate --seed # publish the suite's config, migrations and the admin panel assets php artisan vendor:publish --provider="Padosoft\Rebel\Admin\RebelAdminServiceProvider" --force php artisan serve ``` Open and click through the demos. ### Start clean (recommended if anything looks off) [](#start-clean-recommended-if-anything-looks-off) If you pulled updates, added packages, or see **404s / stale routes / a login you can't get past**, you almost certainly have a stale cache or an un-seeded DB. Reset to a known-good state and **restart the server**: ``` cd laravel-rebel-demo composer update # pull the latest rebel-* releases php artisan optimize:clear # clear cached routes/config/views (the usual cause of 404s) php artisan migrate:fresh --seed # recreate the schema + seed users and risk rules php artisan vendor:publish --provider="Padosoft\Rebel\Admin\RebelAdminServiceProvider" --tag=rebel-admin-assets --force php artisan serve # http://127.0.0.1:8000 ``` > **Always restart `php artisan serve` after changing routes/packages** — a long-running dev server keeps serving the old route table. ### Credentials & email [](#credentials--email) - Seeded users: **`admin@demo.test`** (admin) and **`demo.customer@example.com`** — both with password **`password`**. - Email goes to **Mailtrap** when `MAIL_MAILER=smtp` (set the `MAIL_*` values in `.env`); the OTP, step-up and password-reset messages all land in your Mailtrap inbox. Prefer no mailbox? set `MAIL_MAILER=log` and read the code from `storage/logs/laravel.log`. --- Rebel vs Shopify — the whole suite, side by side ------------------------------------------------ [](#rebel-vs-shopify--the-whole-suite-side-by-side) This demo exists because Rebel does, self-hosted in your own app, what hosted platforms keep behind a black box. How the suite compares to **Shopify**'s customer auth and to plain Laravel: Capability (all live in this demo)**Laravel Rebel**ShopifyFortify onlySanctum/PassportPasswordless email-OTP login✅✅❌❌Risk-based step-up per action✅❌❌❌**PSD2/SCA dynamic linking**✅❌❌❌Refresh-token rotation + **reuse detection**✅❌❌❌Single-use, hashed recovery codes✅✅➖❌Unified, HMAC'd audit trail✅➖❌❌Self-hosted **web admin panel** over your data✅➖ (hosted)❌❌Anomaly detection + advisory AI✅➖❌❌**Self-hosted, you own the data**✅❌✅✅Multi-tenant for *your* app✅❌❌❌**Bot-protection (Turnstile/reCAPTCHA/hCaptcha)**✅➖ (hosted)❌❌**Passkey / WebAuthn step-up**✅➖➖❌**TOTP 2FA step-up (laragear, spatie, otpz)**✅❌➖❌**Multi-channel delivery (SMS, Telegram, Discord, Voice)**✅❌❌❌> ✅ built-in · ➖ partial / hosted-only / opaque · ❌ not available. Shopify is a great hosted product, but it's a closed black box you can't self-host, extend, audit or run multi-tenant. Rebel gives you the same capabilities — and several Shopify doesn't have — in your own Laravel app. --- 🔋 Vibe coding with batteries included ------------------------------------- [](#-vibe-coding-with-batteries-included) This app ships **AI batteries** — so you (and your AI agent) can extend the demo correctly on the first try: - **`CLAUDE.md`** — a concise AI working guide (what the demo is, conventions, how it wires the whole `padosoft/laravel-rebel-*` suite, where the extension points are, Definition of Done). Plain Markdown, so Claude Code, Cursor, Copilot and Codex all read it. - **`.claude/skills/`** — invocable skills (at least `rebel-package-dev`) encoding the suite's TDD loop, the **PHPStan-level-max** recipes, the security/telemetry rules, and the release discipline used across the packages this app installs. Open the repo in your AI editor and just start — the rules, guardrails and extension recipes come with it. --- License ------- [](#license) MIT — see [LICENSE](LICENSE). Built by [Padosoft](https://www.padosoft.com). ### Health Score 21 — LowBetter than 17% of packages Maintenance61 Regular maintenance activity Popularity0 Limited adoption so far Community8 Small or concentrated contributor base Maturity14 Early-stage or recently created project Bus Factor1 Top contributor holds 92.9% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://avatars.githubusercontent.com/u/10467699?v=4)[Lorenzo](/maintainers/lopadova)[@lopadova](https://github.com/lopadova) --- Top Contributors [![lopadova](https://avatars.githubusercontent.com/u/10467699?v=4)](https://github.com/lopadova "lopadova (13 commits)")[![imgbot[bot]](https://avatars.githubusercontent.com/in/4706?v=4)](https://github.com/imgbot[bot] "imgbot[bot] (1 commits)") ### Embed Badge ![Health badge](/badges/padosoft-laravel-rebel-demo/health.svg) ``` [![Health](https://phpackages.com/badges/padosoft-laravel-rebel-demo/health.svg)](https://phpackages.com/packages/padosoft-laravel-rebel-demo) ``` ### Alternatives [vitalybaev/laravel5-dkim Laravel 5/6 package for signing outgoing messages with DKIM. 3163.1k](/packages/vitalybaev-laravel5-dkim)[firemultimedia/mautic-multi-captcha-bundle This plugin brings Google's reCAPTCHA, hCaptcha, and Cloudflare Turnstile integration to mautic. 141.3k](/packages/firemultimedia-mautic-multi-captcha-bundle) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)