Notifications

All notifications extend AuthenticationNotification and are sent by mail. Swap one per guard with notifications.classes.<type> (a subclass of AuthenticationNotification), or set it to null to disable it:

Risk alerts

Risk reactions have their own mails. deny sends SignInBlockedNotification (sign_in_blocked) — nobody was signed in; notify sends UnusualSignInNotification (unusual_sign_in) once the sign-in completes — its session is live. Neither says a session was signed out: SuspiciousSessionNotification (refresh_token_reuse) covers only refresh-token reuse, so change or silence the risk alerts through sign_in_blocked and unusual_sign_in. Both go out whenever the guard’s risk.assessor returns a level whose reaction is deny or notify (see Activity & risk). A published config that predates them — it lacks their notifications.classes keys — still sends them; set a key to null to switch one off:

'guards' => [
    'users' => [
        'model' => App\Models\User::class,
        'risk' => [
            'assessor' => NewDeviceRisk::class,
            'reactions' => ['elevated' => 'notify', 'high' => 'deny'],
        ],
        'notifications' => [
            'classes' => [
                'sign_in_blocked' => App\Notifications\SignInBlocked::class,   // extends AuthenticationNotification
                'unusual_sign_in' => null,                                        // null switches it off
            ],
        ],
    ],
],

When an admin acted

Four types can be caused by someone other than the account, through host code: password_changed (passwords()->set()), two_factor_disabled (twoFactor()->disable()), passkey_removed (passkeys()->remove()) and account_locked (lock()) — NotificationType::actorAware() is true for exactly these. Pass the admin as actor: and:

• NotificationData::$actor holds an ActorData — the actor’s morph type and key, never the model, because the encrypted delivery job serializes the notification and an admin’s attributes (password hash, 2FA secret) do not belong in the queue store or failed_jobs. ActorData::fromModel() builds it (an unsaved model throws InvalidArgumentException), is($model) compares and resolve() loads the model again — null once it is gone.
• toMail() takes the subject, intro and outro from notifications.<type>.by_actor.*; the action, code and expiry lines stay as they are. The copy says “an administrator” and never names the actor.
• The event (PasswordChanged, TwoFactorDisabled, PasskeyRemoved, AccountLocked) carries the actor model as actor.

The account itself is no actor, so the user’s own flows, the HTTP endpoints and the automatic lockout always send the base copy; without actor: nothing changes, and every other type ignores an actor. The new lines ship in English and Slovak:

A host that published the translations before these keys existed still gets them — Laravel merges a published file over the package’s lines; a locale the package does not ship falls back to app.fallback_locale until you add them. To phrase them differently, override authentication::notifications.<type>.by_actor.* in the published translations. To name the actor, swap the class (notifications.classes.password_changed) and resolve it:

use Illuminate\Notifications\Messages\MailMessage;
use RoundlyConsulting\Auth\Notifications\PasswordChangedNotification;

final class NamedPasswordChangedNotification extends PasswordChangedNotification
{
    public function toMail(object $notifiable): MailMessage
    {
        $mail = parent::toMail($notifiable);
        $admin = $this->data->actor?->resolve();   // null without an actor, or when it was deleted

        return $admin === null ? $mail : $mail->line(__('Changed by :name.', ['name' => $admin->name]));
    }
}

Delivery

• after_response (default) — a known account’s response is not measurably slower than an unknown one’s.
• queue — through an encrypted job (ShouldBeEncrypted) on notifications.connection / queue, so the plaintext link or code never sits readable in the queue store.
• sync — inline, for development.

Links

Emailed links are rendered from config only (no client-supplied redirect) with {frontend}, {app}, {guard}, {email} and {token}. The defaults put the secret in the URL fragment (#token=…), so it never reaches a server log or a Referer header — the frontend reads location.hash and POSTs the token. Do not use the log mail driver outside development.

'guards' => [
    'users' => [
        'model' => App\Models\User::class,
        'notifications' => [
            'delivery' => 'queue',       // sync|after_response|queue
            'queue' => 'mail',
            'classes' => [
                'magic_link' => App\Notifications\MagicLink::class,   // extends AuthenticationNotification
                'new_device' => null,                                  // null disables it
            ],
            'frontend_url' => 'https://app.example.com',
            'urls' => [
                'magic_link' => '{frontend}/auth/magic-link?guard={guard}#token={token}',
            ],
        ],
    ],
],

Copy and language

Copy lives in authentication::notifications.* and ships in English and Slovak (en, sk); other locales fall back to app.fallback_locale until you add them under lang/vendor/authentication/<locale>/. Publish the translations to change or add copy. Accounts get mail in their locale via preferredLocale():

php artisan vendor:publish --tag=authentication-translations

The expiry line is rendered with trans_choice() on the minutes left, so it carries plural forms (a published override without | still works), and the refresh-token-reuse :reason renders from notifications.refresh_token_reuse.reasons.* in the mail’s language.