Account management

  1. Home
  2. Docs
  3. Account management

Documentation

Overview Installation Configuration Layout Menu Components Plugins Scaffolding Dashboard Authentication Authorization Account management Notifications Activity log API tokens Real-time Commands Translations Demo pages Deployment Contributing

Account Management

The profile scaffold is a complete, Jetstream-style account page — not just a name/email form. It's tabbed: Profile, Change password, Sessions, and a Danger zone.

php artisan adminlte:scaffold profile
php artisan migrate          # adds the nullable `avatar` column to users
php artisan storage:link     # so uploaded avatars are publicly served

What it publishes

Artifact Destination
add_profile_fields_to_users_table migration (avatar column) database/migrations/
UpdateProfileRequest, UpdatePasswordRequest app/Http/Requests/AdminLte/
ProfileController app/Http/Controllers/AdminLte/
Tabbed account view resources/views/adminlte/profile/
ProfileTest tests/Feature/AdminLte/
Routes profile.* in the managed /admin group

Routes:

Verb URI Name Purpose
GET /admin/profile adminlte.profile.show Account page
PUT /admin/profile adminlte.profile.update Update name / email
PUT /admin/profile/password adminlte.profile.password.update Change password
POST /admin/profile/avatar adminlte.profile.avatar.update Upload avatar
PUT /admin/profile/other-sessions adminlte.profile.sessions.logout-others Log out other devices
DELETE /admin/profile adminlte.profile.destroy Delete account

Features

  • Profile — name + email via UpdateProfileRequest. When the email changes and the User implements MustVerifyEmail, verification is re-triggered.
  • Avatar — image upload (max 2 MB) to the public disk under avatars/. The path is set directly on the model, so you don't need to add avatar to the User $fillable. Requires php artisan storage:link.
  • Change password — current-password check + confirmed new password (UpdatePasswordRequest uses the current_password rule and Password::defaults()).
  • Sessions — lists the user's active sessions and offers "log out other devices" (Auth::logoutOtherDevices). Requires the database session driver (SESSION_DRIVER=database + a sessions table); with any other driver the tab shows a notice instead.
  • Danger zone — password-confirmed account deletion (also removes the avatar file and logs the user out).

Notes

  • The account routes live in the auth-protected /admin group.
  • See authentication.md for the related auth-hardening features (login throttling, email verification, password confirmation).