Laravel Enso

Hit the ground running when building your new Laravel SPA project with boilerplate and extra functionality out of the box!

^{click on the photo to view a short demo in compatible browsers}

For the v1.x / adminlte version, take a look at the adminlte branch.

Official Documentation

The documentation is available here. Note that most sections have short demo clips.

Take It For A Spin

You may try out a live demo installation by visiting laravel-enso.com and logging in with admin@laravel-enso.com and password.

Installation Steps

Download the project with git clone https://github.com/laravel-enso/Enso.git
Run in the project folder composer install
Configure .env file. Run php artisan key:generate
Run php artisan migrate
Login into the project with user: admin@laravel-enso.com, password: password
(optional) Setup the configuration files as needed, in config/enso/*.php
(optional) npm install / npm run dev / hmr /...

Enjoy!

With Enso you get

A solid starting project, based on Laravel 5.5, VueJS 2, Bulma, integrated themes from Bulmaswatch, all the VueJS goodies such as VueEx and VueRouter, Datatables and more, with features like:

Customizable and powerful datatables:
- server side, with multi-argument,
- full column search
- customizable column visibility
- state save for each table, for certain options and preferences, with the option to reset everything to default
- automatic action buttons generation, depending on user permissions
- custom action buttons as needed
- responsive priority setting for columns, when used on smaller screens
- beautiful tag rendering for boolean flag columns
- easy display of flag/type columns values
- server-side excel export for every table
- sublime snippet for table template
Vue select - server side builder with parameter conditioning, including pivot parameters, built as a wrapper for Vue-multiselect
Advanced owners / roles / permissions structure
Log management - view, download, clear
User action logger, so you can keep track of who's done what
User impersonation for easy support and debugging
Application interface tutorials based on the awesome Intro.js
Localisation support
Charts component with server side data builder, based on Chart.js
Comments component with support for tagging users
Documents component with upload, download and inline view
Ability to track who created, updated and deleted models, using traits
File uploader and file management library
Avatar functionality for all users
Ability to track the different versions of a model through its lifetime
Front-end date-picker and time-picker, based on Flatpickr
Server-side type-ahead
User application-wide preferences - every user has the ability to choose his theme (from 10 variants), set the menu style, app language and more
Queueable jobs
Push notifications - working out of the box (requires Pusher)
Automatic breadcrumbs generation
Application-wide timestamp formatting customization through the configuration file
many more helpers and hidden gems

fully working in less than 5 minutes!

Under the Hood

Authentication

the standard Laravel authentication is used, via email & password

Stateful vs Stateless

Since we wanted to log data about our users and their requests, as well as check various permissions, the concept of a 'truly' stateless and secure API backend becomes impossible.

From a security standpoint we did not feel that a RESTful would not be more secure but probably even less safe.

Finally, from our own internal tests we concluded that we had no performance issues related to having the application stateful, especially since we don't aim to build applications of Twitter's scale.

In conclusion, even though at a point during the development we had the back-end set up as an API using JWT, in the end we designed it stateful since session is stored in the DB or in files, depending on your chosen setup.

Session management

since Enso is built on top of a Laravel back-end, we are using the provided session management

Security

since Laravel is using HttpOnly cookies and an additional CSRF token, this should provide protection against both XSS and CSRF attacks
remember that when working with VueJS, the v-html directive is XSS vulnerable, so it should be used only with sanitized/safe data

Authorization

application wide, checking user status: active/inactive. The check is made for every request, via a middleware. The inactive status prevents the user from logging in and making requests. If an user becomes inactive while he's still logged in, at his next request he'll be logged out and redirected to the login page with a notification
application-section wide, via the menu's visibility, depending on the user's role. The users that don't have access to a certain menu, can't see it. This level doesn't block access to the routes, it just affects the visibility of the menus
application-section wide, depending on permitted access to routes, which is tied to the user's role and the associated permissions for that role. The check is made for each request, via a middleware. If the user is not allowed on a route a 403 response is given back and a laravel.log entry is made.
content specific, via gates & policies. The check is made locally, when and where gates & policies are used

Middleware & Middleware Groups

for the routes within the application, the 'core' middleware group is applied
the 'core' group contains the middleware below, presented in the order they're applied:
- verify-active-state - checks users's status (active/inactive)
- action-logger - logs for each request the user's id, route, url, the HTTP verb and the timestamps
- verify-route-access - authorizes the access to a route
- impersonate - starts and stops the impersonation of a user, when needed
- set-language - sets the user's chosen language (localisation)

Owners, Roles & Users

users represent the operators using the application
roles are collections of permissions
owners are user groups, and can represent departments, types, and even companies
an owner can have many users
an owner can have many roles
an user has just one owner and just one role
the role of a user may only be one of the roles available for its owner
users have an active or inactive status, where inactive users cannot login or make requests in the application (but can set/reset their password)

Preferences

The mechanism allows saving and loading of the user's preferences for several aspects of the application.

the preferences can be updated from the right-hand sidebar. From there the user can also reset the preferences to default.
the user's preferences are stored in the preferences table, under value column, in JSON format.
list of preferences
- lang - the user's language
- theme - the currently selected theme

Translations

Are loaded at application load, and refreshed as needed

Environment

config
- within the configuration enso folder config/enso you'll find configuration files for the various laravel-enso packages
- inside 'config.php' various options may be set, such as the folders used for storing uploads, avatars, etc. the caching duration and the timestamps format when displaying them, the app version displayed in the footer and more

Telemetry

the implicit login event that Laravel fires on a user's login triggers a listener that stores the user's ip, user-agent and timestamps inside the logins table

Exceptions

when needed, the exceptions thrown are as specific as possible.
a pseudo generic exception, EnsoException, is also available. \EnsoException is also a Facade.
since requests are supposed to be ajax, JSON responses are given back

Thanks

Built with with ❤️, crafted on Laravel 5.5, Bulma 0.6, Vuejs 2.5 and:

DataTables, Bulmaswatch, Chart.js, Font awesome, Toastr.js, Nprogress.js, Intro.js, Vue-multiselect, Flatpickr, Bulma-Extensions

Special thanks to Taylor Otwell, Jeffrey Way, Evan You, Allan Jardine and Jeremy Thomas.

Contributions

are welcome. Pull requests are great, but issues are good too.

License

This package is released under the MIT license.

Cinerar / Enso