Name: Laravel Uploads
Author: ghostcompiler

Laravel Uploads manages local/cloud file storage, tracks upload metadata, generates secure tokenized preview URLs, integrates with Eloquent models, and supports real-time image optimization. It also features on-demand proxy streaming for remote URLs with zero local disk footprint.

Installation

Install the package via Composer:

composer require ghostcompiler/laravel-uploads
php artisan install:laravel-uploads
php artisan migrate

Use --force to overwrite any existing assets:

php artisan install:laravel-uploads --force

Basic Usage

Uploading a File

use GhostCompiler\LaravelUploads\Facades\Uploads;

// Store a file under configured defaults
$upload = Uploads::upload($request->file('avatar'));

// Store to a specific directory inside the storage path
$upload = Uploads::upload('avatars', $request->file('avatar'));

Uploading from a URL (Dynamic Proxy Streaming)

You can pass a remote URL string directly. The package will register the reference in the database, proxying it on-demand to hide the source URL and bypass local disk storage:

$upload = Uploads::upload('https://avatar.example.com/user123.jpg');

Resolving Secure URLs

Retrieve secure tokenized URLs to stream or preview private files:

// Generates a secure routing URL expiring in 15 minutes
$url = Uploads::url($upload, 15);

Full Documentation

For detailed guides on configuration settings, Eloquent trait integrations, custom URL resolvers, image optimization pipelines, and Artisan commands, see the:

👉 Laravel Uploads Documentation

Development And Build Environment

This package was developed using ServBay as the local development environment.

Development Tool Used

Local development tool: ServBay
Website: www.servbay.com

ServBay your development friend

Testing And Build Machine

Tested on: Mac M4
Built on: Mac M4

# Changelog All notable changes to Laravel Uploads are documented here. ## [Unreleased] ## [1.1.8] - 2026-04-27 - Changed the private file route middleware default to `[]` so host app `web` middleware cannot redirect file/image requests before streaming. ## [1.1.7] - 2026-04-27 - Regenerate private upload URLs when a cached token points to a missing or expired upload link. ## [1.1.6] - 2026-04-27 - Fixed a time-sensitive cache registry test so it passes consistently on Laravel 10. ## [1.1.5] - 2026-04-27 - Changed the default `cache.registry_ttl` to `60` minutes. ## [1.1.4] - 2026-04-27 - Changed the generated URL cache-key registry to expire instead of being stored forever. - Added `cache.registry_ttl` configuration for the internal generated URL cache-key registry. ## [1.1.3] - 2026-04-27 - Refactored upload manager internals into focused service concerns for path safety, validation, and URL generation. - Added this changelog and linked it from the README. ## [1.1.2] - 2026-04-27 - Made uploadable model URL exposure enabled by default. - Added `expose => false` as the per-field opt-out for JSON/array serialization. - Updated documentation and tests for the new exposure default. ## [1.1.1] - 2026-04-27 - Updated security guidance for current 1.x behavior. - Clarified that SVG inline preview is blocked by the controller. - Documented operational responsibilities for upload limits, throttling, cleanup scheduling, `expose`, and tenant public URL resolvers. - Kept ServBay and build-machine documentation intact. ## [1.1.0] - 2026-04-27 - Added tenant/CDN-aware public URL resolver support. - Public uploads now return disk/resolver URLs without creating private token rows. - Private uploads continue using expiring package token URLs. - Added favicon upload support through `Uploads::upload(..., ['favicon' => true])`. - Added model uploadable value hooks, including field-specific hooks. - Improved multiple uploadable value resolution. - Renamed the install command to `php artisan install:laravel-uploads`. - Shortened README while keeping core usage, security notes, and ServBay documentation. - Removed tracked `.DS_Store` files. ## [1.0.9] - 2026-04-27 - Hardened upload path validation and disk containment checks. - Switched validation decisions to server-side MIME detection. - Made model serialization safer through configurable upload URL exposure. - Added image and favicon processing safety checks. - Improved file streaming to avoid loading downloads fully into PHP memory. - Prevented upload metadata persistence when storage writes fail. [Unreleased]: https://github.com/ghostcompiler/laravel-upload/compare/v1.1.4...HEAD [1.1.4]: https://github.com/ghostcompiler/laravel-upload/compare/v1.1.3...v1.1.4 [1.1.3]: https://github.com/ghostcompiler/laravel-upload/compare/v1.1.2...v1.1.3 [1.1.2]: https://github.com/ghostcompiler/laravel-upload/compare/v1.1.1...v1.1.2 [1.1.1]: https://github.com/ghostcompiler/laravel-upload/compare/v1.1.0...v1.1.1 [1.1.0]: https://github.com/ghostcompiler/laravel-upload/compare/v1.0.9...v1.1.0 [1.0.9]: https://github.com/ghostcompiler/laravel-upload/releases/tag/v1.0.9

Laravel Uploads