Registration

Registration is owned by RegisteredUserController. Your app fills the view seam by binding RegisterView and the action seam by binding CreateUser; the package owns the event dispatch, sign-in, and session regeneration.

Routes

Route name	Verb	Path	Middleware
identity.register	GET	auth/register	web, guest:identity
identity.register.store	POST	auth/register	web, guest:identity, throttle:5,1

GET identity.register renders through the bound RegisterView contract. If none is bound, hitting the route throws MissingAuthViewException.

The registration flow (POST identity.register.store)

The store action is throttled to 5 requests per minute, then runs the following steps:

1. The full request input is collected, with email lowercased.
2. The bound CreateUser action is invoked with that input array and must return the created Authenticatable.
3. Laravel’s Illuminate\Auth\Events\Registered event is fired for the new user (this is what triggers the email verification notification when your user model implements MustVerifyEmail).
4. The user is logged in on the identity guard.
5. The session is regenerated.

Response

• A JSON request (wantsJson) receives an empty 201 response.
• A browser request is redirected via redirect()->intended(...) to config('oidc.login.home') (default /dashboard).

Validation lives in your action

The controller lowercases email and, when the input carries a password, checks it against the realm’s password policy before your action runs. Every other rule is yours — enforce it inside your CreateUser action (or a form request that feeds it), exactly where your app’s persistence and password hashing already live. This keeps the package out of your user model’s shape:

use Bambamboole\LaravelOidc\Server\Shared\Users\CreateUser;
use Illuminate\Support\Facades\Validator;

class CreateNewUser implements CreateUser
{
    public function __invoke(array $input): User
    {
        Validator::make($input, [
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'unique:users'],
            'password' => ['required', 'confirmed'],
        ])->validate();

        return User::create([
            'name' => $input['name'],
            'email' => $input['email'],
            'password' => Hash::make($input['password']),
        ]);
    }
}

Bind it in a service provider:

$this->app->bind(CreateUser::class, App\Actions\CreateNewUser::class);

After registration

When your user model implements MustVerifyEmail, the Registered event sends the verification notification and the user is redirected/gated through the email verification flow before reaching protected pages.