gabrielesbaiz/nova-password-toolkit

Nova Password Toolkit

A Laravel Nova front end for gabrielesbaiz/password-toolkit.

Two things, really. A settings dashboard where you pick which dictionaries the generator draws from and tune how passwords are assembled — written straight back to your config file as readable PHP. And a field widget that drops a suggested password, a theme browser and a strength meter under any password field on the panel.

Contents

• Requirements
• Installation
• The field widget
• The settings dashboard
• Authorization
• Multiple config files
• Keeping config in step
• Translations
• Testing

Requirements

• PHP 8.2+
• Laravel 11 or 12
• Nova 5
• gabrielesbaiz/password-toolkit 2.0+

Installation

composer require gabrielesbaiz/nova-password-toolkit

Publish the config if you want to change anything in it:

php artisan vendor:publish --tag=nova-password-toolkit-config

Then say who is allowed to manage the toolkit — nothing is reachable until you do, see Authorization:

// app/Providers/NovaServiceProvider.php
use Gabrielesbaiz\NovaPasswordToolkit\NovaPasswordToolkit;

NovaPasswordToolkit::authorizeManagementUsing(
    fn ($user): bool => $user?->hasRole('Super Admin') === true,
);

The dashboard registers itself. Registering the tool as well is optional, and only puts an entry in the main menu:

// app/Providers/NovaServiceProvider.php
public function tools(): array
{
    return [
        new NovaPasswordToolkit,
    ];
}

The field widget

use Laravel\Nova\Fields\Password;

Password::make(__('Password'), 'password')
    ->withPasswordSuggestion();

That renders a strength meter, a generated password, a refresh button, a theme gallery and a copy button. Each part can be turned off, and the meter can be pointed at a specific input — worth doing on a form with more than one password field, since otherwise it finds the nearest one by walking up the DOM:

Password::make(__('Password'), 'password')
    ->withPasswordSuggestion(gallery: false, meter: true, target: 'password-input');

// Or the meter on its own.
Password::make(__('Password'), 'password')
    ->withPasswordStrengthMeter('password-input');

[!IMPORTANT] Nova's help() assigns rather than appends, so order matters. Put help() first and the widget keeps your prose; put it last and it replaces the widget entirely.

->help('Minimum eight characters.')->withPasswordSuggestion()  // both
->withPasswordSuggestion()->help('Minimum eight characters.')  // prose only

There is also a global passwordSuggestionHelp() function that renders the same markup, for call sites that predate the macro.

The settings dashboard

Available at /dashboards/password-toolkit-name-types, or through the tool's menu entry. It shows every dictionary the generator ships, grouped and searchable, plus the generation options — separator, digits, position, leetspeak. Saving writes your config file back as formatted PHP, so a change shows up as a sensible git diff rather than a serialised blob.

Authorization

Two checks, and they deliberately fail in opposite directions.

Managing rewrites a PHP file inside your config/ directory, so it is closed until you open it. The default ability, manage-password-toolkit, is one no application defines — and an undefined ability denies.

Suggesting is the help text under every password field. It is open to any authenticated user by default, because closing it would break user creation on a fresh install and a generated password is not a secret until somebody saves it.

Either can be a Gate ability:

Gate::define('manage-password-toolkit', fn ($user) => $user->isAdmin());

…or a closure, for rules that do not fit one:

NovaPasswordToolkit::authorizeManagementUsing(fn ($user) => $user?->hasRole('Super Admin') === true);
NovaPasswordToolkit::authorizeSuggestionsUsing(fn ($user) => $user !== null);

Multiple config files

An ordinary panel has one config file and needs none of this. A codebase serving several brands or tenants has one per brand and picks between them per request — which the package cannot work out on its own, so it asks:

// app/Providers/AppServiceProvider.php
NovaPasswordToolkit::resolveConfigPathUsing(
    fn (): string => config_path('password-toolkit/'.currentBrand().'.php'),
);

NovaPasswordToolkit::discoverConfigPathsUsing(
    fn (): array => File::glob(config_path('password-toolkit/*.php')),
);

The first is the file for this request. The second is every file the sync command should maintain.

[!NOTE] These are closures registered from a provider, not config values, because config:cache cannot serialise a closure — the first cached deploy would fatal.

For full control, bind the contract instead; it beats both:

$this->app->bind(ConfigPathResolver::class, MyResolver::class);

Keeping config in step

A published config file is a snapshot. When the generator adds a key in a later release your copy simply does not have it:

php artisan password-toolkit:sync-types

This walks every file the resolver knows about and adds what is missing. It never overwrites a value you have set — that is why it is additive rather than a re-publish. Worth wiring into post-update-cmd:

"post-update-cmd": [
    "@php artisan password-toolkit:sync-types --ansi"
]

Translations

English and Italian ship with the package. Override any key without restating the rest:

php artisan vendor:publish --tag=nova-password-toolkit-translations

Dictionary names are humanised from their keys and passed through __(), so translating one is a matter of adding that exact string to a lang file.

Testing

composer test
composer analyse
composer format

Credits

• Gabriele Sbaiz
• All Contributors

License

The MIT License (MIT). Please see License File for more information.