Tyro Login

https://github.com/hasinhayder/tyro-login
Admin
Tyro Login provides beautiful, customizable authentication views for Laravel 12 and 13, offering...
Tokens:87,361
Snippets:694
Trust Score:9.7
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Upgrade guide structure

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

Outlines the structure of an upgrade guide, including sections for breaking changes, new features, and deprecated items, with examples of how to document each.

```markdown
## Upgrading from 2.x to 3.x

### Breaking Changes

1. **LoginController@login method signature**
   - Old: `login(Request $request)`
   - New: `login(array $credentials, bool $remember)`
   - Migration: Controllers extending LoginController must update their method signature.

2. **Route name changes**
   - Old: `tyro-login.otp.form`
   - New: `tyro-login.otp.verify`
   - Migration: Update all `route()` and `redirect()->route()` calls.

### New Features
- 2FA ignore cookie (disabled by default).
- Config: `tyro-login.two_factor.ignore_days`.

### Deprecated (removed in 4.0)
- `VerificationHelper::oldGenerateVerificationUrl()`.
```

--------------------------------

### Install tyro-login with Composer and artisan

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Install the package and run the installer to publish authentication pages. After running, visit /login to see the new pages.

```bash
composer require hasinhayder/tyro-login
php artisan tyro-login:install
```

--------------------------------

### Incorrect: Single-Directory Installation

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Shows the incorrect approach of installing the skill only to a single agent-specific directory, which prevents other agents from discovering it.

```php
// Only installs to one directory — other agents can't discover the skill
$filesystem->copyDirectory($sourcePath, '.claude/skills/tyro-login');
```

--------------------------------

### Install with social or passkey support

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Optional installer flags to enable social login via Laravel Socialite or passkey (WebAuthn) login during installation.

```bash
# With social login (Laravel Socialite)
php artisan tyro-login:install --with-social

# With passkey (WebAuthn) login
php artisan tyro-login:install --with-passkeys
```

--------------------------------

### Incorrect: Generate recovery codes on setup page load

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/two-factor.md

This example shows the wrong approach where recovery codes are generated and saved before 2FA is confirmed, wasting them if the setup is abandoned. The codes are stored encrypted as a JSON array.

```php
// Recovery codes generated on setup page load — wasted if setup abandoned
public function showSetup(): View
{
    $codes = $this->generateRecoveryCodes();
    $user->two_factor_recovery_codes = encrypt(json_encode($codes));
    $user->save(); // Saved before 2FA is confirmed
}
```

--------------------------------

### Correct: Atomic install with stage, backup, and swap

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Implements the atomic install strategy for the tyro-login:setup-ai-skill command: stage new contents in a temp directory, back up the existing target via rename, then swap. On failure it restores the backup and returns false; on success it discards the backup. Always use a staging directory and clean up stale staging/backup directories from previous failed runs.

```php
// Stage → backup → swap — atomic with rollback
protected function installTo(string $targetPath, string $sourcePath, string $label): bool
{
    $filesystem = new Filesystem;

    $staging = $targetPath.'.__installing__';
    $backup = $targetPath.'.__backup__';

    // Stage new contents in a temp directory
    $filesystem->copyDirectory($sourcePath, $staging);

    // Back up existing target via atomic rename
    @rename($targetPath, $backup);

    // Move staged install into place
    if (! @rename($staging, $targetPath)) {
        // Rollback — restore from backup
        @rename($backup, $targetPath);
        $filesystem->deleteDirectory($staging);
        return false;
    }

    // Success — discard backup
    $filesystem->deleteDirectory($backup);
    return true;
}
```

--------------------------------

### Env var prefix: TYRO_LOGIN_REGISTRATION_ENABLED

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/config-and-env.md

Incorrect example uses a generic env var name that risks collisions with other packages. Correct example uses the TYRO_LOGIN_ prefix and (bool) casting for type safety.

```php
// Too generic — likely to collide
'enabled' => env('REGISTRATION_ENABLED', true),
```

```php
// Namespaced with package prefix
'enabled' => (bool) env('TYRO_LOGIN_REGISTRATION_ENABLED', true),
```

--------------------------------

### Correct: Multi-Agent Installation with Universal Directory

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Correct multi-agent installation: installs to each selected agent's directory and always to the universal `.agents/skills/tyro-login` directory. The agent map is a constant on the command class, and agent names in the choice prompt must match the array keys exactly.

```php
// Agent-specific + universal — any agent can discover the skill
protected array $agentTargets = [
    'kilo' => '.kilo/skills/tyro-login',
    'claude' => '.claude/skills/tyro-login',
    'github copilot' => '.github/skills/tyro-login',
    'codex' => '.codex/skills/tyro-login',
    'gemini' => '.gemini/skills/tyro-login',
    'laravel boost' => '.ai/skills/tyro-login',
];

public const UNIVERSAL_SKILL_DIR = '.agents/skills/tyro-login';

// Phase 1: install to each selected agent's directory
foreach ($selectedAgents as $agent) {
    $this->installTo(base_path($this->agentTargets[$agent]), $sourcePath, ...);
}

// Phase 2: always install to universal directory
$this->installTo(base_path(self::UNIVERSAL_SKILL_DIR), $sourcePath, ...);
```

--------------------------------

### Set up passkeys

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Run the setup command for passkeys. Then add the PasskeyAuthenticatable trait and PasskeyUser contract to your User model and enable TYRO_LOGIN_PASSKEYS_ENABLED.

```bash
php artisan tyro-login:setup-passkeys
```

--------------------------------

### Correct: Breaking change documented in CHANGELOG and UPGRADE guide

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

Shows the correct approach to documenting a breaking change, with comments indicating that the change is documented in the CHANGELOG and UPGRADE guide, explaining what changed, why, and how to migrate.

```php
// Breaking change documented in CHANGELOG and UPGRADE guide
// The upgrade guide explains:
// - What changed
// - Why it changed
// - How to migrate
```

--------------------------------

### Incorrect: Boot logic in register()

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/service-provider.md

Incorrect example showing boot logic in register(), which runs too early and risks undefined services. The loadRoutesFrom() call is explicitly marked as too early for routing.

```php
// Boot logic in register() — too early, risks undefined services
public function register(): void
{
    $this->mergeConfigFrom(__DIR__ . '/../../config/tyro-login.php', 'tyro-login');
    $this->loadRoutesFrom(__DIR__ . '/../../routes/web.php'); // Too early for routing
}
```

--------------------------------

### Config key with env var: TYRO_LOGIN_OTP_EXPIRE

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/config-and-env.md

Incorrect example shows a hardcoded config value without an environment variable, forcing consumers to edit the config file per environment. Correct example uses an env var with a sensible default and (int) casting for type safety.

```php
// No env var — consumer must edit config file directly
'expire' => 60,
```

```php
// Env var with sensible default — consumer can override per environment
'expire' => (int) env('TYRO_LOGIN_OTP_EXPIRE', 10),
```

--------------------------------

### Incorrect: Hard Dependency on Tyro Package

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

This example shows a hard dependency on the Tyro package, which will crash if the package is not installed. It directly uses the Role model without checking its existence, leading to a fatal error.

```php
// Hard dependency — crashes if Tyro package is not installed
use HasinHayder\Tyro\Models\Role;

public function assignTyroRole(User $user): void
{
    $role = Role::where('slug', config('tyro-login.tyro.role_slug', 'user'))->first();
    $user->assignRole($role);
}
```

--------------------------------

### Correct: register() only merges config, boot() handles logic

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/service-provider.md

Correct example showing register() only merging config and all boot logic in boot(). The boot() method calls several private registration methods, and mergeConfigFrom() allows the consumer's config to override package defaults.

```php
// register() only merges config — nothing else
public function register(): void
{
    $this->mergeConfigFrom(__DIR__ . '/../../config/tyro-login.php', 'tyro-login');
}

// All boot logic in boot()
public function boot(): void
{
    $this->registerRoutes();
    $this->registerViews();
    $this->registerMigrations();
    $this->registerPublishing();
    $this->registerCommands();
    $this->configureAuthRedirection();
}
```

--------------------------------

### Incorrect: Direct copy with copyDirectory

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Shows the incorrect approach of directly copying the skill directory into the target, which can leave the target in a broken state if the copy fails partway. Use this as a contrast to the atomic install strategy.

```php
// Direct copy — partial failure leaves broken state
$filesystem->copyDirectory($sourcePath, $targetPath);
$this->info('Installed.');
```

--------------------------------

### Config-Driven Redirect After Registration

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Shows the incorrect hardcoded redirect and the correct config-driven approach using the 'tyro-login.redirects.after_register' config key, which defaults to '/'. When email verification or 2FA setup is required, the redirect goes to the respective notice or setup page instead.

```php
// Hardcoded redirect — consumer cannot customize
return redirect('/dashboard');
```

```php
// Config-driven redirect
return redirect(config('tyro-login.redirects.after_register', '/'));
```

--------------------------------

### Correct implementation of get and set methods

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/models-and-casts.md

This implementation uses a try-catch block in the get method to return the raw value if decryption fails, while the set method ensures all data is encrypted.

```php
// Falls back to plaintext for legacy data, encrypts on write
public function get($model, $key, $value, $attributes): ?string
{
    if (is_null($value)) {
        return null;
    }

    try {
        return Crypt::decryptString($value);
    } catch (DecryptException $e) {
        // Legacy plaintext data — will be encrypted on next write
        return $value;
    }
}

public function set($model, $key, $value, $attributes): ?string
{
    if (is_null($value)) {
        return null;
    }

    return Crypt::encryptString($value);
}
```

--------------------------------

### Correct Social Callback with Ordered State Machine

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/social-login.md

This example shows the correct implementation of a social callback using an ordered state machine. It pulls the action from the session, then delegates to handleSocialUser which checks for an existing social account, links existing users, and handles new user registration with proper checks for registration enabled and auto-registration. It also regenerates the session and handles post-login redirects.

```php
// Ordered state machine — each case is explicit and isolated
public function callback(Request $request, string $provider): RedirectResponse
{
    // ... get social user ...

    $action = $request->session()->pull('tyro-login.social.action', 'login');

    return $this->handleSocialUser($request, $socialUser, $provider, $action);
}

protected function handleSocialUser(Request $request, SocialiteUser $socialUser, string $provider, string $action): RedirectResponse
{
    // Case 1: User already has this social account linked
    $socialAccount = SocialAccount::findByProvider($provider, $socialUser->getId());
    if ($socialAccount) {
        $this->updateSocialAccount($socialAccount, $socialUser);
        $this->markEmailAsVerified($socialAccount->user);
        Auth::login($socialAccount->user);
        $request->session()->regenerate();
        return $this->handlePostLoginRedirect($request, $socialAccount->user);
    }

    // Case 2: Existing user with this email — link social account
    $userModel = config('tyro-login.user_model');
    $user = $userModel::where('email', $socialUser->getEmail())->first();
    if ($user) {
        if (config('tyro-login.social.link_existing_accounts', true)) {
            $this->createSocialAccount($user, $socialUser, $provider);
            $this->markEmailAsVerified($user);
            Auth::login($user);
            $request->session()->regenerate();
            return $this->handlePostLoginRedirect($request, $user);
        }
        // Linking disabled — tell user to log in with password
        return redirect()->route('tyro-login.login')
            ->withErrors(['social' => 'An account with this email already exists.']);
    }

    // Case 3: No existing user — check if auto-registration is allowed
    if (! $this->shouldCreateMissingUser($action)) {
        return redirect()->route('tyro-login.login')
            ->withErrors(['social' => 'No account found.']);
    }

    if (! config('tyro-login.registration.enabled', true)) {
        return redirect()->route('tyro-login.login')
            ->withErrors(['social' => 'Registration is currently disabled.']);
    }

    $user = $this->createUser($socialUser);
    $this->createSocialAccount($user, $socialUser, $provider);
    $this->assignTyroRole($user);

    Auth::login($user);
    $request->session()->regenerate();
    return $this->handlePostLoginRedirect($request, $user, config('tyro-login.redirects.after_register'));
}
```

--------------------------------

### Incorrect: Hard Tyro dependency

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Incorrect approach that directly uses the Tyro Role model, causing registration to fail if Tyro is not installed.

```php
// Hard Tyro dependency — registration fails if Tyro is not installed
use HasinHayder\Tyro\Models\Role;

$role = Role::where('slug', 'user')->first();
$user->assignRole($role);
```

--------------------------------

### Correct: Soft Check with class_exists()

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

This example demonstrates the correct way to assign a default role with soft checks. It verifies the config toggle, class existence, and method existence before proceeding, and wraps the logic in a try/catch to handle database errors gracefully.

```php
// Soft check — gracefully skips when Tyro package is not installed
public function assignTyroRole($user): void
{
    if (! config('tyro-login.tyro.assign_default_role', true)) {
        return;
    }

    if (! class_exists('HasinHayder\\Tyro\\Models\\Role')) {
        return;
    }

    if (! method_exists($user, 'assignRole')) {
        return;
    }

    $roleSlug = config('tyro-login.tyro.default_role_slug', 'user');

    try {
        $roleModel = 'HasinHayder\\Tyro\\Models\\Role';
        $role = $roleModel::where('slug', $roleSlug)->first();

        if ($role) {
            $user->assignRole($role);
        }
    } catch (\Exception $e) {
        report($e);
    }
}
```

--------------------------------

### Enable TOTP 2FA

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Enable TOTP 2FA for authenticator apps. Set TYRO_LOGIN_2FA_ALLOW_SKIP=false to force setup after login and restrict to specific roles.

```env
TYRO_LOGIN_2FA_ENABLED=true
TYRO_LOGIN_2FA_ALLOW_SKIP=false   # force setup after login
TYRO_LOGIN_2FA_FORCED_ROLES=admin,superadmin
```

--------------------------------

### Correct: Separate GET and POST routes for login

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/routes.md

Correct approach: separate GET route for form display and POST route for submission. GET routes return View responses and cannot have side effects; POST routes always redirect on success and redirect back with errors on failure.

```php
// Separate routes for display and submission
Route::get('login', [LoginController::class, 'showLoginForm'])->name('tyro-login.login');
Route::post('login', [LoginController::class, 'login']);
```

--------------------------------

### Incorrect: Obfuscated Collection Pipeline

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/framework-mindset.md

Shown as an incorrect example: uses a magic number (15) and unclear intent. Avoid this style; prefer explicit types and named constants.

```php
// What does this do? Why 15? What's the context?
$items = collect($data)->map(function ($item) {
    return $item * 15;
})->filter()->values();
```

--------------------------------

### Incorrect: Inconsistent Output Formatting

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Shows inconsistent output formatting without visual hierarchy. Use as a contrast to the standardized prefixes shown in the correct example.

```php
// Inconsistent formatting — no visual hierarchy
$this->info('User verified');
$this->error('User not found');
$this->line('Operation completed');
```

--------------------------------

### Correct: Inline styles (rendered by all email clients)

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/email-templates.md

This example shows the correct approach of using inline styles on each element. Inline styles are reliably rendered across all email clients, ensuring the visual design is preserved.

```html
{{-- Inline styles — rendered by all email clients --}}
<a href="{{ $url }}"
   style="display: inline-block; background-color: #007bff; color: #ffffff;
          text-decoration: none; padding: 12px 24px; border-radius: 4px;
          font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;">
    Click Here
</a>
```

--------------------------------

### Incorrect Instance Method for URL Generation

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/verification.md

An example of an instance method that requires controller instantiation, which is discouraged for cross-controller access.

```php
// Instance method — requires controller instantiation to call from other controllers
public function generateVerificationUrl($user): string
{
    // ...
}
```

--------------------------------

### Correct: Auto-login with 2FA awareness

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Correct auto-login flow that checks the 2FA configuration. If 2FA is enabled, stores the user ID and remember flag in the session and redirects to the 2FA setup route; otherwise logs in the user and redirects to the post-registration route.

```php
// Auto-login with 2FA awareness
if (config('tyro-login.registration.auto_login', true)) {
    if (config('tyro-login.two_factor.enabled', false)) {
        $request->session()->put('login.id', $user->id);
        $request->session()->put('login.remember', true);
        return redirect()->route('tyro-login.two-factor.setup');
    }

    Auth::login($user);
}

return redirect(config('tyro-login.redirects.after_register', '/'));
```

--------------------------------

### Command Signature with --force Flag

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Example signature for a command that offers a --force flag to skip confirmation for scripted use. The command name follows the 'tyro-login:' prefix pattern.

```php
protected $signature = 'tyro-login:magic-links {--flush} {--force}';
```

--------------------------------

### Incorrect implementation of get method

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/models-and-casts.md

This approach fails because it attempts to decrypt all data, causing a DecryptException when encountering legacy plaintext.

```php
// Always encrypts — but what about legacy plaintext data?
public function get($model, $key, $value, $attributes)
{
    return Crypt::decryptString($value);
}
```

--------------------------------

### Incorrect Social Callback with Mixed Concerns

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/social-login.md

This example shows a problematic callback method that interleaves account creation, linking, and login logic. It directly queries the user by email, creates a new user if none exists, and updates the social account without checking for existing social links or respecting registration settings. Use this as a counterexample to avoid.

```php
// Mixed concerns — account creation, linking, and login interleaved
public function callback(string $provider): RedirectResponse|View
{
    $driver = static::PROVIDER_DRIVER_MAP[$provider] ?? $provider;
    $providerUser = Socialite::driver($driver)->user();
    $user = User::where('email', $providerUser->getEmail())->first();

    if (! $user) {
        $user = User::create([
            'name' => $providerUser->getName(),
            'email' => $providerUser->getEmail(),
        ]);
    }

    SocialAccount::updateOrCreate([...]);
    Auth::login($user);
    return redirect()->intended(route('tyro-login.dashboard'));
}
```

--------------------------------

### Correct Configurable User Model

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/invitation.md

This implementation retrieves the user model from the configuration, defaulting to 'App\Models\User' if not specified, ensuring compatibility with any consumer setup.

```php
// Configurable user model — works with any consumer setup
public static function getReferredUsers(int $userId)
{
    $userModel = config('tyro-login.user_model', 'App\Models\User');
    $referredUserIds = $invitationLink->referrals()->pluck('referred_user_id');
    return $userModel::whereIn('id', $referredUserIds)->get();
}
```

--------------------------------

### Incorrect: Social Login Without Suspension Check

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/suspension.md

Incorrect example showing a social login handler that lacks a suspension check, allowing suspended users to bypass the restriction.

```php
// Suspension checked in password login but not in social login
public function handleSocialUser(...)
{
    $user = $this->createUser($providerUser);
    // No suspension check — suspended user logs in via Google
    Auth::login($user, $remember);
    return redirect()->intended(route('tyro-login.dashboard'));
}
```

--------------------------------

### Incorrect: No Feature Config Check

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Shows a command's handle() method without a feature config check, which runs even when the feature is disabled. Use as a contrast to the correct example that checks the config toggle first.

```php
// No feature check — command runs even when feature is disabled
public function handle(): void
{
    $links = Cache::get('tyro-login.magic-links', []);
    // ... processes empty data or errors
}
```

--------------------------------

### Incorrect: Auto-login without 2FA check

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Incorrect approach that logs in the user without checking the 2FA configuration, bypassing the 2FA setup flow for new users.

```php
// Auto-login without checking 2FA — bypasses 2FA setup for new users
Auth::login($user);
return redirect(config('tyro-login.redirects.after_register', '/'));
```

--------------------------------

### Correct: Social Login With Suspension Check

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/suspension.md

Correct example applying the suspension check in the social login handler, redirecting suspended users with an error message.

```php
// Suspension check applied consistently across all flows
public function handleSocialUser(...)
{
    $user = User::where('email', $providerUser->getEmail())->first();

    if ($user && $this->isUserSuspended($user)) {
        return redirect()->route('tyro-login.login')
            ->withErrors(['email' => __('Your account has been suspended. Please contact support.')]);
    }

    // ... create or link social account, then login
}
```

--------------------------------

### Incorrect Static Method with Session Dependency

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/controllers.md

Incorrect example of a static method that accesses session state, which breaks when called statically. The session is not available in a static context.

```php
// Static method that accesses session — breaks when called statically
public static function generateVerificationUrl($user): string
{
    $prefix = session()->get('locale'); // Session not available in static context
    return URL::signedRoute('tyro-login.verification.verify', [...]);
}
```

--------------------------------

### Incorrect: assignTyroRole() throws on integration failure

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

This example lets a failed role assignment throw an exception, breaking the entire registration flow. Avoid this; wrap optional integrations in try/catch.

```php
// Integration failure throws — breaks the entire registration flow
public function assignTyroRole($user): void
{
    $role = Role::where('slug', 'user')->first();
    $user->assignRole($role);
}
```

--------------------------------

### Incorrect: Styles in head (stripped by Gmail, Outlook web)

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/email-templates.md

This example shows the incorrect approach of placing CSS in a `<style>` block within the `<head>`. Most email clients strip these styles, resulting in plain-text fallback and broken visual design.

```html
{{-- Styles in head — stripped by Gmail, Outlook web --}}
<head>
    <style>
        .button { background-color: #007bff; color: white; }
    </style>
</head>
<body>
    <a href="{{ $url }}" class="button">Click Here</a>
</body>
```

--------------------------------

### Incorrect: GET logout route without CSRF protection

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/security.md

Shows a GET logout route that is vulnerable to img-src CSRF because GET requests are not CSRF-protected. The logout method only calls Auth::logout() and redirects, with no session invalidation or token regeneration.

```php
// GET logout — no CSRF protection, vulnerable to img-src CSRF
Route::get('logout', [LoginController::class, 'logout'])->name('tyro-login.logout');

public function logout(): RedirectResponse
{
    Auth::logout();
    return redirect()->route('tyro-login.login');
}
```

--------------------------------

### boot() Strict Order: Incorrect vs Correct

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/service-provider.md

Contrasts an arbitrary boot() order with the required strict order: routes, views, migrations, publishing, commands, then auth redirection. Routes must be registered first because everything else may reference route names; auth redirection must be last because the middleware needs all routes registered.

```php
// Arbitrary order — publishing before routes, commands mixed in
public function boot(): void
{
    $this->registerPublishing();
    $this->registerCommands();
    $this->registerRoutes();
    $this->registerViews();
}
```

```php
// Strict order: publishing → routes → views → commands → migrations → auth
public function boot(): void
{
    $this->registerRoutes();
    $this->registerViews();
    $this->registerMigrations();
    $this->registerPublishing();
    $this->registerCommands();
    $this->configureAuthRedirection();
}
```

--------------------------------

### Incorrect: GET for Logout in Laravel

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/routes.md

Shows the incorrect approach of using GET for logout, which is vulnerable to CSRF and accidental state changes via browser prefetching. Use this as a contrast to the POST-only approach.

```php
// GET for logout — browser prefetching could log the user out
Route::get('logout', [LoginController::class, 'logout'])->name('tyro-login.logout');
```

--------------------------------

### Configure layout and background image

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Choose one of 10 layouts via the TYRO_LOGIN_LAYOUT env var. TYRO_LOGIN_BACKGROUND_IMAGE sets a background image for split/fullscreen layouts.

```env
TYRO_LOGIN_LAYOUT=centered        # or: split-left, split-right, fullscreen, card,
                                  #     youtube-video, animated-birds, aurora-waves,
                                  #     particle-network, tidal
TYRO_LOGIN_BACKGROUND_IMAGE=https://your-app.com/bg.jpg   # for split/fullscreen layouts
```

--------------------------------

### Correct: POST-only logout with CSRF protection

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/security.md

Uses Route::match(['get', 'post']) to accept both methods but only performs logout on POST, which is CSRF-protected. On POST, it logs out, invalidates the session, and regenerates the token; GET requests simply redirect without state change.

```php
// POST-only logout — Laravel's CSRF middleware protects it
Route::match(['get', 'post'], 'logout', [LoginController::class, 'logout'])->name('tyro-login.logout');

public function logout(Request $request): RedirectResponse
{
    if ($request->isMethod('post')) {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        return redirect()->route('tyro-login.login');
    }

    // GET requests redirect away — no state change
    return redirect()->route('tyro-login.login');
}
```

--------------------------------

### Correct: Email build method with plain-text fallback

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/email-templates.md

Demonstrates the correct way to include both HTML and plain-text views using the text() method.

```php
// HTML + plain text — renders in any email client
public function build(): self
{
    return $this->view('tyro-login::emails.otp')
        ->text('tyro-login::emails.plain.otp');
}
```

--------------------------------

### Incorrect Captcha Generation

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/captcha.md

Example of using rand() which is predictable and insecure for captcha generation.

```php
// Predictable numbers — attacker can guess captcha answers
$num1 = rand($min, $max);
$num2 = rand($min, $max);
$isAddition = (bool) rand(0, 1);
```

--------------------------------

### Correct: POST-Only for State Mutations in Laravel

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/routes.md

Shows the correct approach for POST-only state mutations. The route accepts GET and POST but the controller processes only POST; GET requests are redirected away or shown a confirmation page. Use this pattern for logout, login submit, register submit, OTP verification, 2FA confirmation, and password reset token.

```php
// POST-only for mutations — GET shows confirmation form or 405
Route::match(['get', 'post'], 'logout', [LoginController::class, 'logout'])->name('tyro-login.logout')
    ->middleware('auth');

// Controller processes only POST
public function logout(Request $request): RedirectResponse
{
    if ($request->isMethod('post')) {
        // ... process logout
    }
    // GET requests show a confirmation page or redirect away
    return redirect()->route('tyro-login.login');
}
```

--------------------------------

### Correct: Controller reads from config

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/config-and-env.md

Shows the correct pattern where a controller reads from the config file using config('tyro-login.layout', 'centered'), making the config file the single source of truth. This is the recommended approach for controllers, commands, mailables, and views.

```php
// Controller reads from config — config file is the single source of truth
public function showLoginForm()
{
    $layout = config('tyro-login.layout', 'centered');
    // ...
}
```

--------------------------------

### Correct Config-driven User Model Relationship

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/models-and-casts.md

Using the configuration key allows the package to remain agnostic of the specific User model class used by the consumer.

```php
// Config-driven User model — works with any consumer setup
public function user(): BelongsTo
{
    return $this->belongsTo(config('tyro-login.user_model'));
}
```

--------------------------------

### Enable passkeys

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Enable passkey (WebAuthn) login after adding the required trait and contract to your User model.

```env
TYRO_LOGIN_PASSKEYS_ENABLED=true
```

--------------------------------

### Login view overriding sections

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/views-and-themes.md

Example view that extends the base layout and overrides specific sections using @section and @push.

```blade
{{-- login.blade.php — overrides specific sections --}}
@extends('tyro-login::layouts.auth')

@section('title', __('Login'))

@section('content')
    {{-- Login form --}}
@endsection

@push('styles')
    {{-- Page-specific styles --}}
@endpush
```

--------------------------------

### Publish views, emails, or all with tyro-login:publish

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Publish views, email templates, or everything for customization. Use the --views flag to publish views, --emails to publish email templates, or run without flags to publish all.

```bash
php artisan tyro-login:publish --views
php artisan tyro-login:publish --emails
php artisan tyro-login:publish
```

--------------------------------

### Incorrect: Flat config keys

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/config-and-env.md

Shows an incorrect flat configuration structure that becomes unmanageable as the package grows. Flat keys prevent iteration and organization.

```php
// Flat keys — unmanageable at scale
'social_google_enabled' => true,
'social_facebook_enabled' => true,
'social_twitter_enabled' => true,
```

--------------------------------

### Correct magicLogin method with full auth pipeline

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/magic-login.md

Correct implementation that runs the full authentication pipeline: logs in the user, checks suspension, handles 2FA challenge if enabled, and redirects to the intended route. Uses session keys 'login.id' and 'login.remember' for 2FA.

```php
// Full auth pipeline — suspension check, 2FA challenge, session regeneration
public function magicLogin(Request $request): RedirectResponse
{
    // ... validate hash and mark as used ...

    Auth::login($user);

    if ($this->isUserSuspended($user)) {
        Auth::logout();
        return redirect()->route('tyro-login.login')
            ->withErrors(['login' => config('tyro-login.suspension.message')]);
    }

    if (config('tyro-login.two_factor.enabled', false)) {
        if (filled($user->two_factor_confirmed_at)) {
            Auth::logout();
            $request->session()->put('login.id', $user->id);
            $request->session()->put('login.remember', false);
            return redirect()->route('tyro-login.two-factor.challenge');
        }
        // ... check 2FA setup / skip / ignore ...
    }

    return redirect()->intended(config('tyro-login.redirects.after_login', '/'));
}
```

--------------------------------

### Publish Tyro Login configuration

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Publishes the package configuration file for customization. All options are env-configurable, and this command makes the config available for further customization.

```bash
php artisan tyro-login:publish --config
```

--------------------------------

### Correct: Configurable User model in login method

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/framework-mindset.md

Shows the correct approach: use a configurable User model via config('tyro-login.user_model') and rely on Laravel's authentication system. This supports unknown consumer environments.

```php
// Uses configurable User model and relies on Laravel's authentication system
public function login(Request $request)
{
    $userModel = config('tyro-login.user_model');
    $user = $userModel::where('email', $request->email)->first();
    // ...
}
```

--------------------------------

### Incorrect Inline Referral Tracking

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/invitation.md

An example of anti-pattern referral tracking implemented directly within a controller, which leads to duplicated logic and testing difficulties.

```php
// Inline referral tracking in controller — duplicated logic, hard to test
public function register(Request $request): RedirectResponse
{
    $user = $userModel::create([...]);
    $hash = $request->input('invite');
    if ($hash) {
        $link = InvitationLink::where('hash', $hash)->first();
        if ($link && $link->user_id !== $user->id) {
            $existing = InvitationReferral::where('referred_user_id', $user->id)->first();
            if (! $existing) {
                InvitationReferral::create([
                    'invitation_link_id' => $link->id,
                    'referred_user_id' => $user->id,
                ]);
            }
        }
    }
}
```

--------------------------------

### Enable magic links

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Enable magic link authentication.

```env
TYRO_LOGIN_ENABLE_MAGIC_LINKS=true
```

--------------------------------

### Incorrect Resend Logic Reusing Old Tokens

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/verification.md

An example of insecure resend logic that reuses existing tokens, potentially leaving compromised links active.

```php
// Resends old token — compromised link is still valid
public function resend(Request $request): RedirectResponse
{
    $oldUrl = Cache::get('tyro-login:email-verify:old');
    Mail::to($user)->send(new VerifyEmailMail($oldUrl));
}
```

--------------------------------

### Enable social login

Source: https://github.com/hasinhayder/tyro-login/blob/main/README.md

Enable social login with Google and GitHub. Add client credentials to config/services.php.

```env
TYRO_LOGIN_SOCIAL_ENABLED=true
TYRO_LOGIN_SOCIAL_GOOGLE=true
TYRO_LOGIN_SOCIAL_GITHUB=true
# add client credentials to config/services.php
```

--------------------------------

### Incorrect: HTML-only email build method

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/email-templates.md

Shows the incorrect approach of returning only an HTML view, which may appear blank in plain-text readers.

```php
// HTML only — plain-text readers see nothing
public function build(): self
{
    return $this->view('tyro-login::emails.otp');
}
```

--------------------------------

### Incorrect SocialAccount model with business logic

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/models-and-casts.md

An example of an anti-pattern where business logic is embedded directly within the model, preventing clean overrides by consuming applications.

```php
// Business logic in model — consumer cannot use a different approach
class SocialAccount extends Model
{
    public function linkUser(User $user): void
    {
        $this->user()->associate($user);
        $this->save();
        // ...
    }
}
```

--------------------------------

### Correct documented config block

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/config-and-env.md

Shows a fully documented config block with comments explaining each setting, valid options, and security implications.

```php
/*
|--------------------------------------------------------------------------
| Brute Force Lockout Protection
|--------------------------------------------------------------------------
|
| Controls the number of failed login attempts before the user is locked
| out. The duration is in minutes. Set max_attempts to 0 to disable
| lockout (not recommended for production).
|
| show_attempts_left: When enabled, displays remaining attempts on the
| login form. This helps legitimate users but also helps attackers.
| Disable in production if you want to avoid leaking information.
|
*/
'lockout' => [
    'max_attempts' => (int) env('TYRO_LOGIN_LOCKOUT_MAX_ATTEMPTS', 5),
    'duration' => (int) env('TYRO_LOGIN_LOCKOUT_DURATION', 60),
    'show_attempts_left' => (bool) env('TYRO_LOGIN_SHOW_ATTEMPTS_LEFT', true),
],
```

--------------------------------

### Configure User Model for User Creation

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Shows the incorrect hardcoded User model and the correct config-driven approach using config('tyro-login.user_model', 'App\Models\User'). Defaults to 'App\Models\User' if config is not set.

```php
// Hardcoded User model — breaks with custom user models
$user = User::create([
    'name' => $validated['name'],
    'email' => $validated['email'],
    'password' => Hash::make($validated['password']),
]);
```

```php
// Config-driven model — works with any consumer setup
$userModel = config('tyro-login.user_model', 'App\\Models\\User');

$user = $userModel::create([
    'name' => $validated['name'],
    'email' => $validated['email'],
    'password' => Hash::make($validated['password']),
]);
```

--------------------------------

### Incorrect: New Default Applied to All Consumers

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

This snippet shows a login method that always redirects to the dashboard, breaking existing installations that expect the old 'intended' redirect behavior.

```php
// New default applied to all consumers — breaks existing installations
public function login(Request $request): RedirectResponse|View
{
    if (Auth::attempt($credentials)) {
        $request->session()->regenerate();
        // Old behavior: redirect to intended
        // New behavior: always redirect to dashboard — breaks existing redirects
        return redirect()->route('tyro-login.dashboard');
    }
}
```

--------------------------------

### Incorrect: Assumes isSuspended() exists on User model

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/integration-boundaries.md

This example crashes if the User model does not have the isSuspended() method, which is provided by an optional trait. Avoid this pattern; use method_exists() instead.

```php
// Assumes the User model has isSuspended() — crashes if it doesn't
public function isUserSuspended($user): bool
{
    return $user->isSuspended();
}
```

--------------------------------

### Correct: Soft dependency with suggest and runtime detection

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/framework-mindset.md

Shows the correct approach: laravel/socialite is listed under 'suggest' instead of 'require', and the controller uses class_exists() to detect the package at runtime, aborting with a clear error if missing. This keeps the package lightweight and optional.

```json
{
    "require": {
        "illuminate/support": "^12.0||^13.0",
        "illuminate/view": "...",
        "illuminate/routing": "..."
    },
    "suggest": {
        "laravel/socialite": "Required for OAuth social login providers."
    }
}
```

```php
// Runtime detection in controller
public function redirect($provider)
{
    if (! class_exists('Laravel\Socialite\Facades\Socialite')) {
        abort(400, 'Socialite is not installed. Install laravel/socialite to use social login.');
    }
    // ...
}
```

--------------------------------

### Correct: Session-based multi-step state

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/controllers.md

Correct approach: store partial authentication state in the session. OTP flow uses the tyro-login.otp.* namespace; 2FA/setup flow uses the login.* namespace shared across controllers. Store only minimal state and clear it on completion.

```php
// Session-based state — persists across the multi-step flow
// OTP flow uses tyro-login.otp.* namespace:
$request->session()->put('tyro-login.otp.user_id', $user->id);
$request->session()->put('tyro-login.otp.remember', $remember);

// 2FA/Setup flow uses login.* namespace (shared across controllers):
$request->session()->put('login.id', $user->id);
$request->session()->put('login.remember', $remember);
```

--------------------------------

### Incorrect: Hard dependency on laravel/socialite

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/framework-mindset.md

Shows the wrong approach of requiring laravel/socialite in composer.json, forcing all consumers to install it even if they don't use social login. This increases package weight and conflict risk.

```json
{
    "require": {
        "laravel/socialite": "^5.0"
    }
}
```

--------------------------------

### Correct: Validate input before authentication with lockout handling

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/security.md

Shows the recommended pattern: validate credentials first, then attempt authentication. On failure, it increments attempts, checks for lockout, and redirects to a lockout route if needed. Validation errors are returned with withErrors().

```php
// Validate first — malformed input is rejected before authentication
public function login(Request $request): RedirectResponse|View
{
    $credentials = $request->validate([
        'email' => ['required', 'string', 'max:255'],
        'password' => ['required', 'string'],
    ]);

    if (Auth::attempt($credentials, $request->boolean('remember'))) {
        $request->session()->regenerate();
        return redirect()->intended(route('tyro-login.dashboard'));
    }

    $this->incrementAttempts($request);

    if ($this->shouldLockout($request)) {
        $this->lockoutUser($request);
        return redirect()->route('tyro-login.lockout');
    }

    return back()->withErrors(['email' => __('Invalid credentials.')]);
}
```

--------------------------------

### Incorrect: Unbound 2FA ignore cookie

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/two-factor.md

This example shows an insecure implementation where the ignore cookie is not tied to a specific user, allowing it to be transferred between browsers. It uses a hardcoded 30-day duration and should not be used in production.

```php
// Cookie with no user binding — can be transferred between browsers
public function ignore(Request $request): RedirectResponse
{
    return redirect()->route('tyro-login.dashboard')
        ->cookie('tyro_2fa_ignore', 'true', 60 * 24 * 30);
}
```

--------------------------------

### Correct: Config-gated registration with redirect and 403 abort

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/registration.md

Correct implementation that checks the config key `tyro-login.registration.enabled` (defaults to `true`) in both the form display and submission methods. When disabled, the form redirects to login and the submission aborts with 403 to prevent bypass via direct POST.

```php
// Config-gated — redirects to login when disabled
public function showRegistrationForm(): View|RedirectResponse
{
    if (! config('tyro-login.registration.enabled', true)) {
        return redirect()->route('tyro-login.login');
    }
    // ... show form
}

public function register(Request $request): RedirectResponse
{
    if (! config('tyro-login.registration.enabled', true)) {
        abort(403, 'Registration is disabled.');
    }
    // ... process registration
}
```

--------------------------------

### Correct: Config-Driven Subject with Fallback

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/mailables.md

Shows a build method that reads the subject from config with a fallback, allowing consumers to customize the subject without overriding the mailable. Uses the config key 'tyro-login.emails.verify_email.subject'.

```php
// Config-driven subject with fallback — consumer changes it in config
public function build(): self
{
    $subject = config('tyro-login.emails.verify_email.subject', 'Verify Your Email Address');
    return $this->subject($subject)
        ->view('tyro-login::emails.verify-email');
}
```

--------------------------------

### Command Signature Prefix: Incorrect vs Correct

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/commands.md

Shows the incorrect and correct command signature patterns. The incorrect version lacks the 'tyro-login:' prefix and risks collisions with other packages. The correct version uses the required 'tyro-login:' prefix as part of the public API.

```php
// Unprefixed — collision risk with other packages
protected $signature = 'user:verify {identifier}';
```

```php
// Pakage-prefixed — no collision
protected $signature = 'tyro-login:verify-user {identifier}';
```

--------------------------------

### Correct Static Method with Parameter Dependencies

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/controllers.md

Correct static method that accepts all dependencies as parameters and has no request or session dependency. It is a pure utility method that can be called without instantiating the controller.

```php
// Static method — no request/session dependency
public static function generateVerificationUrl(string $userId, string $hash): string
{
    return URL::signedRoute('tyro-login.verification.verify', [
        'id' => $userId,
        'hash' => $hash,
    ]);
}
```

--------------------------------

### Implement Soft Failure for Referral Tracking

Source: https://github.com/hasinhayder/tyro-login/blob/main/skills/tyro-login/rules/invitation.md

Shows how to wrap referral tracking in a try/catch block to ensure that registration succeeds even if the invitation system encounters an error.

```php
// Unhandled exception — breaks registration if invitation system has issues
InvitationHelper::trackReferral($hash, $user->id);
```

```php
// Try/catch with logging — registration always succeeds
try {
    InvitationHelper::trackReferral($invitationHash, $user->id);
} catch (\Exception $e) {
    Log::error('[Tyro-Login] Failed to track invitation referral', [
        'user_id' => $user->id,
        'invitation_hash' => $invitationHash,
        'error' => $e->getMessage(),
        'trace' => $e->getTraceAsString(),
    ]);
}
```

--------------------------------

### Run tests with composer test

Source: https://github.com/hasinhayder/tyro-login/blob/main/CONTRIBUTING.md

Run the test suite before submitting a pull request.

```bash
composer test
```
Tokens:
Raw