- How do I install amir/laravel-permission in a Laravel application?
- Require the package with Composer, publish its config and migrations, then run php artisan migrate. Add the package's Eloquent trait to your User model so roles and permissions can be assigned to users. Service-provider auto-discovery handles registration, and a working spike typically takes under a day for an experienced Laravel engineer.
- Is amir/laravel-permission the same as spatie/laravel-permission?
- No. The package names are one character apart, but they are separate packages with different APIs and semantics. Spatie's package is the de facto standard with a very large star count and thousands of dependents, while this one has roughly 47 stars and no known dependents. Treat them as incompatible mental models and do not assume Spatie documentation or Stack Overflow answers apply.
- Which Laravel and PHP versions does amir/laravel-permission support?
- Check the composer.json constraints in the repository before committing, since the last release appears to be around December 2024 and may not declare support for the newest Laravel major. There is no confirmed CI matrix proving version coverage. Verify compatibility against your exact PHP 8.x and Laravel versions and pin the package accordingly.
- Does amir/laravel-permission integrate with Laravel's Gate, can() and @can?
- Yes. The package binds into Laravel's Gate, so existing can() checks and @can Blade directives continue to work without rewriting controller authorization logic. It also ships its own middleware and Blade directives. That keeps the integration blast radius mostly on the data model and seeding path rather than application code.
- Does amir/laravel-permission cache the permission graph?
- This is not documented in the available material and is the most important thing to verify empirically. Permission checks often run many times per request, so whether the role and permission graph is cached per request or hits the database on every can() call determines whether the package is viable under load. Benchmark query counts for N checks in a single request and confirm the cache is invalidated when roles or permissions change.
- Does amir/laravel-permission support multi-tenancy or team-scoped permissions?
- There is no evidence of multi-tenancy or teams scoping, so treat it as global-only until proven otherwise. If your product needs per-tenant, per-object, or record-level authorization, you will most likely write that missing layer yourself. Confirm the package matches your authorization model before adopting it.
- Is amir/laravel-permission safe to use in production?
- The primary risks are supply chain and bus factor: a single maintainer, no organizational backing, and no visible security disclosure process. There is also no public corpus of production war stories, third-party tutorials, or companion packages such as admin UI or Filament integrations. Mitigate by pinning to an exact version, reviewing every lockfile diff, and having an internal commitment to fork and maintain if upstream stalls.
- How do I assign roles and permissions to users with this package?
- Add the package's Eloquent trait to your User model, then attach roles and abilities through the trait's methods. Roles and permissions live in the published migration tables, with pivot tables linking them to users. Seed the base roles and permissions as part of your deployment process so authorization works immediately after migrate.
- Can I install amir/laravel-permission alongside spatie/laravel-permission?
- They are not designed to coexist, as both would try to own similar tables, traits, and Gate behavior. Composer may or may not block the combination depending on namespace and conflict declarations, so do not rely on the resolver to protect you. Choose one package and enforce the exact vendor name in composer.json to avoid engineer error.
- What are the alternatives to amir/laravel-permission?
- spatie/laravel-permission is the default choice for most Laravel applications because of its ecosystem, documentation, tutorials, and companion admin UI integrations. Laravel's built-in Gate and policies cover simpler authorization needs with no extra dependency at all. Choose this package only if its specific API fits your requirements and you accept the maintenance burden of potentially forking it.