- What is apavliukov/laravel-authorization used for?
- It provides a flexible foundation for role- and permission-based access control in Laravel applications. You can define roles, permissions, and configurable authorization rules, then enforce them through middleware, Gate/Policy integration, and Blade-friendly permission checks. The package is lightweight and Laravel-native, intended to keep access logic organized as an application grows. Note that v1.6.0 narrows scope to single-database organizations, roles inside them, and one platform admin.
- How do I install apavliukov/laravel-authorization?
- Install it with Composer using composer require apavliukov/laravel-authorization. After installation, follow the package README for any configuration publishing, middleware registration, and Gate/Policy wiring. Because v1.6.0 removed some artisan commands and public API without a deprecation layer, check the release notes for your target version before deploying.
- How do I configure roles and permissions in laravel-authorization?
- The package provides configurable authorization rules and simple roles and permissions management. You define roles and permissions, then enforce them via middleware, Gate/Policy checks, and Blade-friendly checks. v1.6.0 fixes the tenancy shape: TeamResolver is removed, so applications with teams but no tenancy must call setPermissionsTeamId() from their own middleware. TenantScopedPolicy assumes Tenancy::id() compares against the model's tenancy.foreign_key.
- Which Laravel versions does apavliukov/laravel-authorization support?
- The package is a Laravel-native Composer package; exact Laravel and PHP version constraints are defined in its composer.json. Check that file and the release notes for the supported ranges before adding it to a project. Since v1.6.0 intentionally removed public API in a minor release, pin the version and test upgrades rather than assuming broad compatibility.
- How do I test authorization rules with laravel-authorization?
- Use Laravel's standard testing tools to assert middleware, Gate/Policy, and role or permission checks in feature tests. Include coverage for repeated permission checks because userCan() is now plain $user->can() and the old memoization helper is gone. Also test the fixed super-admin bypass and any stricter application-level policy logic you add.
- Is laravel-authorization safe for production?
- It is lightweight and Laravel-native, but v1.6.0 changes the security surface in ways you should review. The bypass gate is no longer pluggable and never returns false, which is more permissive than a custom strategy that could deny. The tenant scope fix from v1.4.0 should be independently verified rather than accepted from release notes, because the same refactor deleted BypassStrategy and adjacent policy wiring. For production, confirm scope/restore behavior and regression tests, and measure per-check query load in policy-heavy UI paths.
- How does apavliukov/laravel-authorization compare to spatie/laravel-permission?
- spatie/laravel-permission is a widely used alternative for role and permission management in Laravel. apavliukov/laravel-authorization is narrower after v1.6.0, scoped to single-database organizations, roles inside them, and one platform admin. Its release notes also state that public API can be removed in minor releases because it has two consumers, both the author's. Choose based on whether you need a broader community contract or a smaller Laravel-native authorization layer.
- Is apavliukov/laravel-authorization maintained and semver-stable?
- Treat it as effectively a private package published publicly: the release notes say public API was removed in a minor on purpose because there are two consumers, both the author's. That means semver is not a contract for external consumers, and future minors may delete whatever you depend on. Plan integrations assuming breaking changes can arrive in minor releases, pin versions, and budget for upgrade work.
- What changed in laravel-authorization v1.6.0?
- v1.6.0 is a strategic narrowing, not a feature release: the scope is now single-database organizations, roles inside them, and one platform admin. It removes Contracts\BypassStrategy, RoleBypass, NoBypass, Authorization::bypassUsing(), TeamResolver, Tenancy\CurrentArea, the authorization.areas config, the Livewire original-route hook, and artisan commands including authorization:sync, authorization:repair-ownership, and make:authorization-policy. Support\UserPermissionMemo and forgetUserPermissions() are gone, and userCan() is now plain $user->can(). Removed symbols fail loudly at boot or first call, so grep for them before upgrading.
- How do I replace the removed authorization:sync command?
- AuthorizationSeeder still syncs permissions and roles and re-derives owner rows on every run, so use it as the replacement for authorization:sync. Rewrite deploy scripts, runbooks, or scheduled tasks that called the removed command; do not simply delete the step if it was the only thing keeping permissions converged. Run the seeder during deployment or as a scheduled job and verify role and permission state afterward.