LARAVEL AUTH STARTER KIT

Admin. Staff. Client.
Production auth
in minutes.

Three pre-built roles. OTP password reset. Force-change on first login. RoleMiddleware out of the box. Stop rebuilding auth from scratch.

Explore the roles → View the code

Admin Panel

Staff View

Client Portal

Total Users

Active Today

Pending

User	Role	Status
Maria Santos	admin	active
Juan dela Cruz	staff	active
Ana Reyes	client	pending

My Tasks

Completed

In Progress

Task	Client	Status
Process Request #42	Ana Reyes	done
Review Document	Bob Cruz	in progress

My Requests

Completed

Pending

Request	Submitted	Status
Document Request	Jun 1, 2024	complete
Certificate Copy	Jun 3, 2024	pending

Role system

Three roles, isolated access

Each role gets its own middleware guard, dashboard, and permission scope. Extend to more roles in minutes.

Admin

Full system access. Manages users, roles, settings, and has visibility across all data.

Manage all users & roles

Access all dashboards

System configuration

Seed via AdminUserSeeder

Staff

Employee-level access. Extended StaffInfo profile with job title, department, emergency contact.

Process assigned tasks

Full StaffInfo profile

role:staff,admin routes

Employee ID & department

Client

Public-facing user. Submits requests, tracks status, limited to their own data only.

Submit & track requests

View own records only

role:client routes

Self-registration support

What's included

Everything auth needs, already built

🛡️

RoleMiddleware

role:admin, role:staff,admin — protect any route with any role combination.

🔐

OTP Password Reset

Email OTP — no insecure link tokens that expire. 3-step flow: send → verify → reset.

🔄

Force Password Change

Set must_change_password=true on any user. Middleware handles the redirect with infinite-loop protection.

👤

StaffInfo Model

Extended employee profile: employee ID, job title, employment status, gender, emergency contact, office location.

⏱️

Auto-Timestamps

Tracks last_login_at and last_password_change_at automatically on every auth event.

🌱

Admin Seeder

One command — php artisan db:seed --class=AdminUserSeeder — and your default admin is ready.

🗑️

Soft Deletes

Users are never hard-deleted. Restore any account without data loss.

📋

6 Form Requests

📦

Drop-in Ready

Copy src/ into your app, migrate, seed, register middleware — done. No Composer package needed.

Code examples

Simple, readable API

Route Protection

OTP Reset Flow

User Model

Middleware Setup

// Admin-only
Route::middleware(['auth', 'role:admin'])->group(function () {
    Route::get('/admin/dashboard', AdminDashboardController::class);
    Route::resource('/admin/users', UserController::class);
});

// Staff AND admin
Route::middleware(['auth', 'role:staff,admin'])->group(function () {
    Route::get('/staff/tasks', StaffTaskController::class);
});

// Client only
Route::middleware(['auth', 'role:client'])->group(function () {
    Route::get('/my-requests', ClientRequestController::class);
});
      

Send OTP

User submits email. 6-digit code sent.

POST /send-otp

Verify OTP

User enters the code from email.

POST /verify-otp

Reset

New password set. Old hash replaced.

POST /reset

// Register routes
Route::post('/forgot-password/send-otp',   [PasswordResetOtpController::class, 'sendOtp']);
Route::post('/forgot-password/verify-otp', [PasswordResetOtpController::class, 'verifyOtp']);
Route::post('/forgot-password/reset',      [PasswordResetOtpController::class, 'reset']);
      

// User model attributes
$user->account_type          // 'admin' | 'staff' | 'client'
$user->status                // 'active' | 'inactive' | 'pending'
$user->must_change_password  // bool → triggers force-change
$user->last_login_at         // auto-tracked
$user->name                  // "Juan dela Cruz" — null-safe
$user->staffInfo             // StaffInfo model (staff only)

// Seed default admin
php artisan db:seed --class=AdminUserSeeder
// → admin@example.com / Admin@1234
// → must_change_password = true (auto-redirect)
      

// bootstrap/app.php (Laravel 11)
->withMiddleware(function (Middleware $middleware) {
    $middleware->alias([
        'role'           => \App\Http\Middleware\RoleMiddleware::class,
        'force.password' => \App\Http\Middleware\ForcePasswordChange::class,
    ]);
})
      

File structure

Clean, organized code

src/

Models/

User.php ← Extended user model, soft deletes, name accessor

StaffInfo.php ← Employee profile fields

Http/Controllers/Auth/

AuthenticatedSessionController.php

RegisteredUserController.php

PasswordResetOtpController.php ← OTP flow

ForcePasswordChangeController.php

Http/Middleware/

RoleMiddleware.php ← role:admin, role:staff,admin

ForcePasswordChange.php ← loop-safe redirect

Http/Requests/Auth/ ← 6 validated request classes

database/

migrations/create_users_table.php ← users + staff_infos

AdminUserSeeder.php ← default admin account

README.md ← full setup guide

Admin. Staff. Client. Production authin minutes.