Verified - User verification

ram0ng1

Verified - User verification for Flarum v2

Enhance your community's credibility with Verified, an extension designed to provide a premium verification experience. Inspired by modern design standards, it integrates seamlessly into the Avocado aesthetic while maintaining full compatibility with the Flarum core.

⚡ Features

Verified Badges: Elegant verification marks on profiles, discussions, and post headers.
Request System: A dedicated form for users to request verification.
Admin Management: Easily approve or revoke verification status from the admin panel.
Avocado Optimization: Deep integration with the Avocado theme, featuring glassmorphism and refined typography.
Real-time Ready: Fully compatible with flarum/realtime.

📸 Screenshots

Admin Panel & Management

Admin Management
Full administrative control over verification requests.

Request Experience (Avocado Theme)

The user-facing verification request form.

Premium request modal with glassmorphism effects.

Comparison: Avocado vs. Default Flarum

Home Feed Home Avocado | (Standard View)
Discussion Discussion Avocado Discussion Default
User Profile

📥 Installation

Install via Composer:

composer require ramon/verified

⚙️ Configuration

Enable the extension in your admin panel.
Set up permissions for who can request and who can manage verification.
(Optional) Customize the appearance in the Avocado theme settings.

🔗 Links

Packagist: ramon/verified
Website: https://ramonguilherme.com.br
Github: https://github.com/ram0ng1/verified

Feedback, bug reports, and PRs are very welcome!

GreXXL

ram0ng1 thanks for another extension? Does this integrate with flarum/gdpr? I think it would be important that data gets deleted when a user is requesting erasure / anonymization.

ram0ng1

GreXXL

That will be the next implementation.
Thanks for the heads up! 🙂

Wlork

ram0ng1

Maybe I'm straying too far from the original idea, but it would be nice if we could verify a member during registration. And once the administrator or moderator approves him, the member can use the forum.

ram0ng1

Wlork No, I don't think it's moving away from the main topic at all. I believe the feature is valid for implementation.

For now, I'll focus on implementing the suggestion this GreXXL, which is very important since it involves sensitive documents.

I'll be back soon with more updates.

Wlork

ram0ng1 No, I don't think it's moving away from the main topic at all. I believe the feature is valid for implementation.

Oh, great ! 🙂

ram0ng1 For now, I'll focus on implementing the suggestion this GreXXL, which is very important since it involves sensitive documents.

I understand, that's normal.

Mirzaagha

LEGEND 😍 Thank you @ram0ng1

Mirzaagha

There is an issue. I created verified as a group. Using fof\badge. The system automatically added users who collected certain indicators to the verified group. And the verified icon was visible. How can I do this here. I would be happy if you update this topic 🙂

Mirzaagha

You can connect to any group in Flarum and manage the group with fof/badges. You just need to make sure the group is not visible anywhere. 🙄

ram0ng1

Mirzaagha I didn't understand, could you explain in more detail?

Mirzaagha

For example, I have set up Fof/badges. There I set a condition that if a user has opened 100 discussions, I will automatically give him verified.

I did this with Flarum's groups. For example, I opened a verified user group. I also set Fof/badges so that if the user's discussions > 100, I would automatically add him to the verified group.

ram0ng1

Mirzaagha

No, it shouldn't work that way, and I don't plan for it to. In my view, that would take away the whole logic of being a 'verified user'.

However, if this is an essential feature, I see only one way: adding a group in the permissions where everyone in that group automatically receives the verified badge. This way, nothing would change drastically.

Would that work for you?

Mirzaagha

ram0ng1 Thank you for your answer and support. I think your answer makes a lot of sense. I think I'll use it the way you set it up.

ram0ng1

Mirzaagha
However, if this is an essential feature, I see only one way: adding a group in the permissions where everyone in that group automatically receives the verified badge. This way, nothing would change drastically.

Would that work for you? /rp

Mirzaagha

ram0ng1 How will that work? Maybe someone will need it. Thanks.

ram0ng1

Mirzaagha

adding a group in the permissions where everyone in that group automatically receives the verified badge.

ram0ng1

🛡️ Verified — release notes

A few additions and a proper GDPR integration.

🔐 flarum/gdpr support

Registers a VerifiedDocuments DataType with the GDPR pipeline. Loads only when flarum/gdpr is installed.

📦 Export bundles request rows, the document files, and the verified-status snapshot into the user's zip.
🕶️ Anonymize strips reason/admin notes/document paths, wipes the documents on disk, nulls handled_by references.
🗑️ Delete hard-removes everything the user submitted plus the files, resets verified columns.

Strictly scoped to the data subject — no third-party PII in the output.

👥 Group-based auto-verification

New permission verified.autoVerified. Assign it to a group and every member gets the badge automatically. Revoking the permission removes it instantly.

Auto-verified users appear in the admin Approved tab with their own notice — no revoke button there, since the source of truth is the permission grid.

📄 Configurable document types

Add, rename or remove the document types users can pick when requesting verification. Section is hidden when Require document is off.

🔍 Admin Approved tab

Now server-paginated (15/page) with username/email search. Counts both manually- and group-verified users.

🖼️ Document preview modal

Admins now review documents inline in a modal (image or PDF), not in a new tab.

🐛 Fixes

✉️ HTML notification emails render properly (no more literal <strong> tags).
💬 Tooltip shows a sensible line for group-verified users (no verified_at date).
🥑 Avocado theme: badge now shows on hero, thread cards and post cards.

Update

composer update ramon/verified

Prints

andrewjs18

nice extension!

how is the data handled for passports, photo ids, etc.? is it encrypted? I had an idea with an engineering friend of mine a year or two ago to try to devise a system for forums to help prevent buy/sell/trade/classified scams on my forum by requiring user's to verify some of their data before they would even be able to access the buy/sell/trade section.

I'm not sure how far he got with it....

ram0ng1

andrewjs18

Storage

Local on disk, in

storage/verified-documents/{userId}/{file} - outside the public folder (not directly accessible via URL).
The path is saved in the document_path column of the verify_requests table (migrations/2026_05_04_000001).
No S3, no external storage.

WITHOUT Encryption YET

No, the files are NOT encrypted YET.
Current protection is only:

File system permissions (chmod 0640 on the file, 0750 on the directory - UploadDocumentController.php:135,146)
Folder outside the public webroot
Download endpoint requires admin (DownloadDocumentController.php:31-33)
Randomized names: bin2hex(random_bytes(16)) - 128 bits of entropy, prevents enumeration (UploadDocumentController.php:142)
Double MIME validation: client + finfo_open() on the server
Limit 8MB, file extensions png/jpg/jpeg/webp/pdf
The public token is virtual (/assets/verified/...) — it never exposes the actual disk path.

I’m going to refine the logic to ensure there are no loopholes. My plan is to delete files once they are approved and implement encryption for the documents. For now, I’ll keep it as it is.

luceos

ram0ng1 My plan is to delete files once they are approved and implement encryption for the documents.

Some communities might need to keep the documents for legal reasons. I would be careful removing a feature that could be necessary. If you consider this, then maybe provide a choice upon approval:

remove files immediately
remove files after N days
keep files

Thanks for the compatibility with GDPR. It's a great extension already 👍️