EloquentUserProvider

Create a new database user provider.

Retrieve a user by their unique identifier.

Fetch a user by ID from the database.

Retrieve a user by their unique identifier and "remember me" token.

Update the "remember me" token for the given user in storage.

Retrieve a user by the given credentials.

Validate a user against the given credentials.

Rehash the user's password if required and supported.

Enable cross-request caching for user lookups.

Accepts a store name (or null for the default store) rather than a pre-resolved repository so the descriptor registry can re-resolve by name on invalidation and avoid holding strong references.

A null or empty-string prefix is normalized to the feature default ('auth_users') so misconfiguration does not create hard-to-read keys with a leading colon.

The store is validated before any instance state is mutated, so a rejected store leaves the provider in its prior uncached state and does not register a descriptor or model event listeners.

Boot-only. User providers are held by cached guards; runtime use mutates the provider used by every subsequent authentication lookup.

Determine if cross-request user caching is enabled.

Clear the cached user for the given identifier.

Uses the same key resolver as retrieveById(), passing null for the user model so context-aware keys use the caller's current context.

Set the cache key resolver for all cached Eloquent user providers.

The callback receives the user identifier and provider model class. Invalidation triggered by a model event also provides the saved or deleted user; lookups and manual invalidation provide null. It should return a string that uniquely identifies the user within the current context (e.g., including tenant ID for multi-tenant apps). Called once in a service provider's boot() method — the closure is evaluated fresh on each lookup or invalidation so per-request context like tenant ID is current.

The fully qualified model class name is always included in the key automatically. The resolver only controls the identifier segment.

Boot-only. The resolver persists in a static property for the worker lifetime and runs on every cached user lookup and invalidation.

Set the cache tags resolver for all cached Eloquent user providers.

The callback receives no arguments and should return a list of tag names for the current request context. Called fresh on each cache put so it can read per-request state.

Effective tags applied to each write = static config tags (per-provider, from auth.providers.*.cache.tags) unioned with the resolver's return value.

Boot-only. The resolver persists in a static property for the worker lifetime and runs on every cached user write.

Flush all static state.

Ensure the resolved cache store supports tags in any-mode.

Auth caching only supports tag-based bulk flush via any-mode because:

• any-mode keys are independent of tags, so reads and per-user forgets stay on the plain repo (no mode branching in the hot path);
• stack caches can layer short-lived local reads over shared any-mode tag indexes without changing auth's plain-key read path;
• the dynamic tag resolver can't cause cross-context invalidation bugs since the auto-invalidation listener never touches tags.

Build the cache key for a user identifier.

Always includes the fully qualified model class name (memoized in enableCache()) so providers using different models never collide — even when two models share a basename across namespaces. The custom resolver (if set) controls the identifier segment only.

Resolve the identifier segment of a user cache key.

Resolve the cache repository to use for puts.

If static tags are configured (opt-in gate), returns a tagged repository with the union of static and dynamic tags. Otherwise returns the plain repo. Computed per-write because dynamic tags can change per request.

Uses Repository::tags() rather than reaching into the raw store via getStore()->tags() so the tagged cache inherits the repository's config and event dispatcher wiring (CachePut events etc. fire correctly on tagged writes).

Compute the effective tag set: static config tags ∪ dynamic resolver output.

The static tag config is the feature gate: if no static tags are configured, returns an empty array and the dynamic resolver is ignored. This matches where enableCache() performs the store validation — without static tags, the store was never checked for TaggableStore + any-mode support, so there's no safe way to apply dynamic tags either.

Register this provider's cache descriptor and set up model event listeners for automatic cache invalidation.

Uses a descriptor-based registry: each (storeName, prefix, modelSegment) triple is stored under a deterministic hash so duplicate configs collapse. On save/delete, the listener iterates descriptors for the model class, re-resolves each store by name via the cache manager, rebuilds the key using the current global resolver callback, and calls forget(). Nothing holds a reference to a provider instance — safe against forgetGuards() + re-resolve cycles under Swoole.

Event listener registration is guarded by the model's dispatcher being non-null — HasEvents::registerModelEvent() silently no-ops when the dispatcher isn't set, so we only mark the class as registered AFTER a successful attempt, leaving a retry window on the next enableCache() call.

Get a new query builder for the model instance.

Create a new instance of the model.

Get the hasher implementation.

Set the hasher implementation.

Boot or tests only. User providers are held by cached guards; runtime use mutates password verification for every subsequent authentication lookup.

Get the name of the Eloquent user model.

Set the name of the Eloquent user model.

Boot or tests only. User providers are held by cached guards; runtime use changes the model used by every subsequent authentication lookup.

Get the callback that modifies the query before retrieving users.

Set the callback to modify the query before retrieving users.

Boot or tests only. User providers are held by cached guards; runtime use mutates the query applied to every subsequent authentication lookup.