---
name: user-type-auth-generator
description: Create a new user type in this Laravel project and configure its authentication behavior. Use when asked to add user types with auth identifier choices (email or phone) and login method choices (password or OTP), including updates to requests, auth service usage, routes, and user type config.
---

# User Type Auth Generator

## Overview
Add a new user type and wire its authentication flow end-to-end. Support combinations of identifier (`email` or `phone`) and auth method (`password` or `otp`).

## Inputs Required
Collect these before editing:
- `name`: user type name (example: `Manager`)
- `scope`: `user` or `dashboard`
- `identifier`: `email` or `phone`
- `auth_method`: `password` or `otp`

## Auth Matrix
Use this matrix to decide request/service behavior:
- `identifier=email` + `auth_method=password`
  - login with email + password
  - OTP verification optional unless explicitly required
- `identifier=email` + `auth_method=otp`
  - login/register with email
  - require OTP send/verify flow for auth completion
- `identifier=phone` + `auth_method=password`
  - login with phone + `phone_code` + password
  - OTP optional unless explicitly required
- `identifier=phone` + `auth_method=otp`
  - login/register with phone + `phone_code`
  - require OTP send/verify flow for auth completion

## Workflow
1. Generate baseline user type scaffolding.
- Run:
```bash
php artisan make:user-type {name} {scope} --auth-type={identifier}
```

2. Verify generated files.
- Controllers in expected namespace by scope.
- Route file in expected location by scope.
- Middleware + profile resource generated.
- `config/user_types.php`, `UserTypeEnum`, and `bootstrap/app.php` updated.

3. Apply auth method rules.
- For `password` mode:
  - ensure login request requires password.
  - keep password reset endpoints active.
  - do not force OTP verification for login unless requested.
- For `otp` mode:
  - ensure send/verify endpoints and request validation are required in auth flow.
  - ensure auth service branch sends OTP to configured identifier.

4. Validate identifier rules.
- `email`: enforce email validation and uniqueness for user type.
- `phone`: enforce phone numeric format, valid `phone_code`, and country phone length rules.

5. Route and middleware review.
- Ensure route middleware stack matches scope/user type expectations.
- Ensure protected routes use `auth:api` + user type middleware.

6. Verify and document.
- Run PHP syntax checks for touched files.
- Update README/docs when command usage or auth behavior is changed.

## Implementation Notes
- Keep controllers thin; prefer using existing `AuthService` behavior.
- Put validation logic in FormRequest classes.
- For phone auth, always validate against country phone constraints.
- Keep changes additive and backward-compatible.