Weave Code
Nova Role Manager Laravel Package
a2zwebltd/nova-role-manager
Nova Role Manager adds a clean Laravel Nova interface for creating, editing, and assigning roles and permissions. Built around spatie/laravel-permission, it lets you manage access control, attach permissions to roles, and assign roles to users directly from your Nova dashboard without custom code.
A Laravel Nova tool for managing Spatie roles and permissions with optional audit logging.
Frequently asked questions about Nova Role Manager
- How do I install nova-role-manager in a Laravel Nova application?
- Install it with Composer using composer require a2zwebltd/nova-role-manager, then publish the package config so you can review role-manager.role_model, protected_roles and edit_permission. After that, register the tool in your NovaServiceProvider so it shows up in the Nova sidebar. You also need a licensed Nova installation and spatie/laravel-permission already configured, because this package is an admin UI on top of Spatie rather than a replacement for it.
- Does nova-role-manager replace spatie/laravel-permission?
- No. It is a thin admin-plane tool that creates, edits and assigns roles and permissions through spatie/laravel-permission, while your application keeps authorizing requests through Spatie gates and policies at runtime. That separation keeps the blast radius of the tool limited to the Nova admin surface and its vendor routes under /nova-vendor/role-manager/. It is not a runtime authorization dependency, so removing it does not change how your app checks permissions.
- Which Laravel, PHP, Nova and Spatie versions does nova-role-manager support?
- Version 1.2.1 is the current release, but the maintainers do not publish a clear compatibility matrix in the notes, so check the composer.json constraints before committing. You need a valid Nova licence and a Nova major version that matches the package constraints, plus a compatible spatie/laravel-permission release. Confirm Laravel, PHP and Spatie majors against your app before rollout, and check how actively the package is maintained between releases.
- What is the privilege escalation vulnerability fixed in nova-role-manager 1.2.1?
- In releases before 1.2.1, anyone with access to the Nova tool could POST directly to the toggle and bulk-toggle endpoints and grant or revoke permissions on protected roles such as SUPER_ADMIN. Version 1.2.1 routes save, toggle and bulk-toggle through a single guard that checks both edit_permission and protected_roles, so authorization is a choke point instead of duplicated per endpoint. Treat any deployment on an earlier version as a potential incident and audit what changed, not just an upgrade. The release notes do not include a CVE reference or an explicit affected-versions statement, which is worth flagging for AppSec sign-off.
- How does the protected_roles config option work in nova-role-manager?
- protected_roles is a list in the published config that marks roles which should not be edited through the Nova tool, typically something like SUPER_ADMIN. Since 1.2.1 the shared guard denies save, toggle and bulk-toggle requests that target those roles, so the behaviour is fail-closed and callers receive a 403. The notes do not state whether matching happens by role name, id or model instance, or whether it is case sensitive or wildcard-aware, so test it against your own role names. In multi-tenant installs the list appears to be global rather than per-tenant, so validate scoping carefully.
- What does the edit_permission config option control in nova-role-manager?
- edit_permission is the ability the package evaluates when deciding whether a user may write roles and permissions through the tool. It is checked alongside protected_roles in the shared guard that protects the write endpoints. It is not confirmed whether it is evaluated with Gate::allows and whether it gates the Nova UI components as well as the HTTP endpoints, so verify both paths in staging. Point it at an ability that only trusted administrators hold.
- Does nova-role-manager work with a custom Role model or renamed Spatie permission tables?
- Yes, as of 1.2.1. The role-manager.role_model setting lets you point the tool at a custom Role model, and the release also fixed config handling so installations with a renamed permission.table_names.roles entry work without code changes. That removes a real blocker for projects with non-default schemas. Still test role CRUD after switching the model, because the automated tests only cover the role permission endpoints.
- Is it safe to upgrade an older nova-role-manager install to 1.2.1?
- 1.2.1 is a security release, so upgrading is strongly recommended, but expect behavioural breaks. Any script, saved HTTP request or custom UI that previously called /toggle or /bulk-toggle on a protected role will now get a 403, which is intentional but is a de facto breaking change for automation. The notes do not mention new migrations or mandatory config additions, suggesting it is close to drop-in for existing installs, but run it on a staging copy first.
- Does nova-role-manager provide an audit log for permission changes?
- The package is described as supporting optional audit logging, but the technical assessment found no clear evidence of an audit trail covering admin-plane mutations and flagged that as a compliance gap. If audit records are a requirement, confirm exactly which events are captured, where they are stored and how long they are retained before relying on it. Many teams pair the tool with their own model event listeners or an activity-log package for full coverage of role and permission changes.
- What test coverage does nova-role-manager have and is it production ready?
- Version 1.2.1 shipped the first automated test suite, built with Pest and Orchestra Testbench, and it covers the role permission endpoints including the bypass that was fixed. Role CRUD, the transaction semantics of bulk-toggle and the Nova UI components are not verified by those tests. That makes it reasonable for production on 1.2.1 or later provided you add your own feature tests around protected roles and any automation hitting the toggle endpoints.
Weaver
How can I help you explore Laravel packages today?