Fixed

• Session restoration detection now uses last_activity_at so continuously active sessions do not create duplicate login rows after the original login_at leaves the restoration window (#146).
• Recent active legacy rows with a null last_activity_at still fall back to login_at during restoration detection.

Fixed

• Session restoration detection now uses last_activity_at so continuously active sessions do not create duplicate login rows after the original login_at leaves the restoration window (#146)
• Recent active legacy rows with a null last_activity_at still fall back to login_at during restoration detection

What's Changed

Laravel 13 Support

• Laravel 13 compatibility by @fdemb in #140
• CI now tests PHP 8.2–8.4 against Laravel 11.x, 12.x, and 13.x
• PHP 8.2+ is now required (PHP 8.1 is EOL and was already unsupported by Laravel 11+)

Fixes

• Compatibility with immutable date casting by @SkyLundy in #137 — lastLoginAt(), lastSuccessfulLoginAt(), and previousLoginAt() now return \Carbon\CarbonInterface instead of \Illuminate\Support\Carbon, fixing a TypeError in applications that cast model dates to CarbonImmutable (the default in current Laravel starter kits)

New Contributors

• @fdemb made their first contribution in #140
• @SkyLundy made their first contribution in #137

Full Changelog: v6.0.1...v6.1.0

Added

• Laravel 13.x support (#138, #140)
• Regression test covering applications that use immutable date casting

Changed

• lastLoginAt(), lastSuccessfulLoginAt(), and previousLoginAt() now return \Carbon\CarbonInterface instead of \Illuminate\Support\Carbon, fixing a TypeError in applications that cast model dates to CarbonImmutable — the default in the current Laravel starter kits (#137)
• PHP 8.2+ is now required (PHP 8.1 is EOL, and no Laravel version supported by this package runs on it)
• Modernized the PHPUnit configuration for PHPUnit 10+ and updated the CI matrix (PHP 8.2–8.4, Laravel 11.x–13.x)

What's Changed

• Add use $tableName for the upgrade down migration by @jwpage in #135
• Fix down migration by @rappasoft in #136

New Contributors

• @jwpage made their first contribution in #135

Full Changelog: v6.0.0...v6.0.1

Fixed

• The upgrade migration's down() method now respects the configured table name (#135, #136)

Laravel Authentication Log v6.0.0 Release Notes

🎉 Major Release - Enhanced Features & Modernization

This is a major release that modernizes the package for Laravel 11.x and 12.x, adds numerous new features, and fixes several long-standing issues.

⚠️ Breaking Changes

• Laravel 10.x support dropped: This package now only supports Laravel 11.x and 12.x (Laravel 12 support was added in v5.0.0)
• PHP 8.1+ required: Minimum PHP version is now 8.1
• Database migration required: Existing installations must run the upgrade migration to add new columns

🚀 New Features

1. Suspicious Activity Detection

Automatically detect and flag suspicious login patterns including:

• Multiple failed login attempts
• Rapid location changes
• Unusual login times (configurable)

Configuration:

'suspicious' => [
    'failed_login_threshold' => 5,
    'check_unusual_times' => false,
    'usual_hours' => [9, 10, 11, 12, 13, 14, 15, 16, 17],
],

2. Session Management

Comprehensive session management capabilities:

• View active sessions
• Revoke specific sessions
• Revoke all other sessions (keep current device)
• Revoke all sessions
• Track last activity timestamp

Usage:

$user->getActiveSessions();
$user->revokeSession($sessionId);
$user->revokeAllOtherSessions($currentDeviceId);
$user->revokeAllSessions();

3. Device Fingerprinting & Management

• Unique device identification (normalized user agent to prevent false positives)
• Device trust management
• Device naming
• Browser version normalization (prevents false "new device" notifications)

Usage:

$user->getDevices();
$user->trustDevice($deviceId);
$user->untrustDevice($deviceId);
$user->isDeviceTrusted($deviceId);

4. Query Scopes

Powerful query scopes for filtering authentication logs:

• successful() - Only successful logins
• failed() - Only failed attempts
• fromIp($ip) - Filter by IP address
• recent($hours) - Recent logs
• suspicious() - Suspicious activities
• trusted() - Trusted devices only
• fromDevice($deviceId) - Specific device
• forUser($user) - Specific user
• active() - Active sessions

Usage:

AuthenticationLog::suspicious()->recent(24)->get();
$user->authentications()->failed()->recent(1)->count();

5. Statistics & Insights

Get authentication statistics for users:

• Total logins count
• Failed attempts count
• Unique devices count
• Suspicious activities count
• Comprehensive login stats array

Usage:

$stats = $user->getLoginStats();
$totalLogins = $user->getTotalLogins();
$failedAttempts = $user->getFailedAttempts();
$uniqueDevices = $user->getUniqueDevicesCount();

6. Rate Limiting for Notifications

Prevent notification spam with configurable rate limiting:

• Configurable max attempts per time period
• Separate limits for new device and failed login notifications
• Automatic rate limit decay

Configuration:

'new-device' => [
    'rate_limit' => 3,
    'rate_limit_decay' => 60, // minutes
],

7. Middleware for Device Trust

Restrict access to trusted devices only:

Usage:

Route::middleware(['auth', \Rappasoft\LaravelAuthenticationLog\Middleware\RequireTrustedDevice::class])
    ->group(function () {
        // Protected routes
    });

8. Export Functionality

Export authentication logs to CSV or JSON:

Usage:

php artisan authentication-log:export --format=csv --path=storage/app/logs.csv
php artisan authentication-log:export --format=json

9. Webhook Support

Send webhooks for authentication events:

• Login events
• Failed login events
• New device events
• Suspicious activity events

Configuration:

'webhooks' => [
    [
        'url' => 'https://example.com/webhook',
        'events' => ['login', 'failed', 'new_device', 'suspicious'],
        'headers' => [
            'Authorization' => 'Bearer your-token',
        ],
    ],
],

10. Enhanced Notifications

• Support for Vonage (formerly Nexmo) SMS notifications
• Custom notification templates
• Improved email templates with better error handling

11. Configurable New User Threshold

Prevent false positives for new users connecting from multiple devices/locations:

Configuration:

'new-device' => [
    'new_user_threshold_minutes' => 1, // Default: 1 minute
],

12. Session Restoration Prevention

Fixes #13

Automatically prevents session restorations (page refreshes, remember me cookies) from creating duplicate log entries. Updates last_activity_at instead of creating new entries.

Configuration:

'prevent_session_restoration_logging' => true,
'session_restoration_window_minutes' => 5,

🐛 Bug Fixes

Fixed Issue #40 - Browser Version Updates Triggering False Notifications

Fixes #40

Browser version updates (e.g., Safari 14.1.2 → 15.1) no longer trigger false "new device" notifications. Device fingerprinting now normalizes user agent strings by removing version numbers.

Fixed Issue #13 - Session Restoration Logging

Fixes #13

Session restorations (page refreshes, remember me cookies) no longer create duplicate log entries. The package now detects and handles session restorations automatically.

Fixed Issue #48, #87, #111 - SQL Server Duplicate ORDER BY Error

Fixes #48, #87, #111

Fixed SQL Server error "A column has been specified more than once in the order by list" by removing duplicate orderByDesc('login_at') calls. The authentications() relationship already orders by login_at DESC, so additional ordering was unnecessary.

Fixed Issue #33, #58 - Model Exception for Models Without Trait

Fixes #33, #58

All listeners now check if the authenticatable model implements the AuthenticationLoggable trait before processing, preventing BadMethodCallException errors when using multiple authenticatable models where only some have the trait.

Fixed Issue #82 - Duplicate Log Entries

Fixes #82

Duplicate log entries issue resolved by session restoration prevention (same fix as Issue #13).

✅ Pull Requests Implemented

PR #15 - Notification After Failed Login on New Device

Closes #15

The package now sends new device notifications when a successful login occurs after a failed login attempt on an unknown device.

PR #52 - Optimize Other Devices Logout Listener

Closes #52

Already implemented. The listener filters to only active sessions using whereNull('logout_at').

PR #57 - Use Null Safe/Chaining Operator

Closes #57

Already implemented. The codebase uses null-safe operators (?->) instead of optional().

PR #80 - Added PHPDocs for IDE Autocompletion

Closes #80

Already implemented. The AuthenticationLog model includes PHPDoc comments for all properties including new fields.

PR #85 - Configurable New User Threshold

Closes #85

Added new_user_threshold_minutes configuration option to reduce false positives for users connecting from multiple devices/locations shortly after registration.

PR #92 - Configurable Listeners

Closes #92

Already implemented. The config file includes configurable listeners for all authentication events.

PR #94 - Check Trait Implementation

Closes #94

Already implemented. All listeners check if the user model implements the AuthenticationLoggable trait before processing.

PR #100 - Laravel 11 Support

Closes #100

Package now supports Laravel 11.x and 12.x.

PR #115 - Check if GeoIP is Installed

Closes #115

Config defaults now check if geoip function exists before enabling location tracking, preventing errors when the geoip package is not installed.

PR #120 - Laravel 12 Support & Arabic Translation

Closes #120

Laravel 12 support added and Arabic translation (ar.json) included.

PR #125 - Test Configuration Updates

Closes #125

Test configuration updated for Laravel 11+ support.

PR #127 - Spanish Translation & Blade Fixes

Closes #127

Spanish translation (es_ES.json) exists and blade templates use the null coalescing operator (??) for state/country fields.

📝 Pull Requests No Longer Applicable

PR #70 - Laravel 10 Support

Closes #70

No longer applicable. Package v4.0.0 dropped Laravel 10 support and now only supports Laravel 11.x and 12.x.

📚 Documentation

• Comprehensive upgrade guide added
• All new features documented
• Configuration examples updated
• Usage examples for all new features

🧪 Testing

• 76 tests passing (146 assertions)
• Comprehensive test coverage for all new features
• Tests for session restoration prevention
• Tests for device fingerprinting normalization
• Tests for suspicious activity detection
• Tests for all query scopes and statistics

📦 Installation & Upgrade

New Installation

composer require rappasoft/laravel-authentication-log
php artisan vendor:publish --provider="Rappasoft\LaravelAuthenticationLog\LaravelAuthenticationLogServiceProvider"
php artisan migrate

Upgrading from v5.x or Earlier

composer update rappasoft/laravel-authentication-log
php artisan vendor:publish --provider="Rappasoft\LaravelAuthenticationLog\LaravelAuthenticationLogServiceProvider" --tag="authentication-log-migrations"
php artisan migrate

The upgrade migration will safely add new columns to your existing authentication_log table without data loss.

🙏 Credits

Thank you to all contributors who submitted issues, pull requests, and feedback that made this release possible!

📖 Full Documentation

See the documentation for complete usage instructions and examples.

Note: This release includes breaking changes. Please review the upgrade guide before upgrading from v5.x or earlier.

Added

• Suspicious activity detection with configurable thresholds
• Comprehensive session management (view, revoke sessions)
• Device fingerprinting with browser version normalization
• Device trust management (trust/untrust devices)
• Query scopes for filtering authentication logs (successful, failed, suspicious, trusted, active, etc.)
• Statistics and insights methods (getLoginStats, getTotalLogins, etc.)
• Rate limiting for notifications (prevent spam)
• Middleware for device trust (RequireTrustedDevice)
• Export functionality (CSV/JSON export command)
• Webhook support for authentication events
• Configurable new user threshold (prevent false positives)
• Session restoration prevention (fixes duplicate log entries from page refreshes)
• Arabic translation (ar.json)
• Enhanced notifications with Vonage support

Fixed

• Issue #40: Browser version updates no longer trigger false "new device" notifications
• Issue #13: Session restorations no longer create duplicate log entries

Changed

• Dropped Laravel 10.x support (now only supports Laravel 11.x and 12.x)
• PHP 8.1+ required
• Config defaults now check for geoip function existence
• Improved device fingerprinting to normalize user agent strings

Implemented Pull Requests

• PR #15: Notification after failed login on new device
• PR #52: Optimize Other Devices Logout Listener
• PR #57: Use null safe/chaining operator
• PR #80: Added PHPDocs for IDE autocompletion
• PR #85: Configurable new user threshold
• PR #92: Configurable listeners
• PR #94: Check trait implementation
• PR #100: Laravel 11 support
• PR #115: Check if geoip is installed
• PR #120: Laravel 12 support & Arabic translation
• PR #125: Test configuration updates
• PR #127: Spanish translation & blade fixes

What's Changed

• Laravel 12.x Compatibility by @laravel-shift in #116

Full Changelog: v4.0.0...v5.0.0

• Laravel 12 Support

4.0.0 - 2024-03-28

• Laravel 11 Support (#100)
• Add config listeners (#92)
• Use real user IP behind Cloudflare
• Check for AuthenticationLoggable trait on event (#94)
• Added PHPDocs to allow autocompletion in IDE (#80)
• Fixes the down method for php artisan migrate:rollback (#93)

• Laravel 11 Support (https://github.com/rappasoft/laravel-authentication-log/pull/100)
• Add config listeners (https://github.com/rappasoft/laravel-authentication-log/pull/92)
• Use real user IP behind Cloudflare
• Check for AuthenticationLoggable trait on event (https://github.com/rappasoft/laravel-authentication-log/pull/94)
• Added PHPDocs to allow autocompletion in IDE (https://github.com/rappasoft/laravel-authentication-log/pull/80)
• Fixes the down method for php artisan migrate:rollback (https://github.com/rappasoft/laravel-authentication-log/pull/93)

• Laravel 10 Support - #70
• Use null safe/chaining operator - #57
• Optimize Other Devices Logout Listener - #52

• Laravel 10 Support - https://github.com/rappasoft/laravel-authentication-log/pull/70
• Use null safe/chaining operator - https://github.com/rappasoft/laravel-authentication-log/pull/57
• Optimize Other Devices Logout Listener - https://github.com/rappasoft/laravel-authentication-log/pull/52

Changed

• Added missing hasTranslations() - #30
• Improve translation strings - #31

Added

• Added latestAuthentication relationship - #24

Changed

• Fixed issue with PHP 7.4 - #22