Laravel Authorization Laravel Package

Product Decisions This Supports

• The security rationale is unchanged — v1.6.0 does not weaken tenant isolation. The v1.4.0 fix (BelongsToTenant retaining TenantScope during Eloquent model restoration for Livewire props and SerializesModels jobs) is untouched by this release, as is strict mode and the MissingTenantContextException / ModelNotFoundException behavior. The ship-blocker upgrade decision still stands; v1.6.0 is adoptable on the same grounds, not a replacement for it.
• The scope cut reframes build-vs-buy: this is now a shared internal library, not a general-purpose package. It carries only what oohire and opiny both use — single-database organizations, roles inside them, and a platform admin. Adopt it for that core; explicitly plan to own the periphery. Any roadmap item that assumed "the package handles it" needs re-checking against the removal list.
• Teams-without-tenancy is gone → a real product-line constraint. TeamResolver, DefaultTeamResolver, CallbackTeamResolver, SetPermissionsTeam, and resolveTeamsUsing() are removed. If the roadmap includes a workspace/teams product without strict tenancy, the app must call setPermissionsTeamId() from its own middleware (SetCurrentTenant covers the tenanted path). Size this before committing to such a feature; don't scope it as "free."
• Custom authorization bypass is now app work. BypassStrategy, RoleBypass, NoBypass, BypassGate, and bypassUsing() are removed in favor of one Gate::before rule (super-admin passes — under teams only the global assignment counts — everyone else falls through, never false). Support-tool impersonation, partner API service accounts, or break-glass admin flows are now our implementation and our security review.
• Permission verdict memoization is gone — flag a performance risk. userCan() is now plain $user->can(); UserPermissionMemo and forgetUserPermissions() are removed (role-read memoization and forgetUserRoles() remain). Before rollout, load-test admin list/detail screens and any high-cardinality permission checks; a p95 regression here is a customer-visible product issue, and app-level caching becomes our cost.
• Tenant/area switching UX is now fully app-owned. Tenancy\CurrentArea, authorization.areas, the Livewire original-route hook, plus the 1.5.0 enterable_scope / fallback_to_owned / TenantResolver::choose() knobs are all removed. The resolver still drops a gone or soft-deleted tenant and picks the user's sole existing one. Net: less out-of-the-box behavior, more control — narrower picker rules (active-only, owned-first, remembered area) become a deliberate product design task in the switcher rather than a config flag.
• Deploy and operations runbooks must be revised. authorization:sync, authorization:repair-ownership, and make:authorization-policy are removed along with PermissionSync::plan() / apply(prune: true). AuthorizationSeeder still syncs permissions and roles and re-derives owner rows on every run — confirm seeding is in the deploy path and remove any pipeline step calling the deleted commands, or releases will fail at deploy time.
• Treat dependency upgrades as potentially breaking from here on. Public API was removed in a minor deliberately, on the reasoning that there are two consumers and both are the author's. That is a defensible call for an internal library and a governance risk for us: pin exact versions, add contract tests around the symbols we depend on, and keep a fork/vendor path open. This is a dependency-risk line item for roadmap planning, not a feature trade-off.
• No migrations and unchanged remaining behavior keeps the change cheap and low-risk. The upgrade is a code-level refactor with a known blast radius (config keys, symbol references, deploy steps) and no data migration — which is why it can be scheduled inside a sprint rather than as its own program.
• Roadmap items on queues, events, and Livewire still proceed without a bespoke tenancy design review — that conclusion from v1.4.0 carries forward unchanged.

When to Consider This Package

• Adopt when: you run a multi-tenant SaaS on Laravel where tenant isolation is a contractual, compliance, or trust requirement; you use Eloquent global scopes for tenancy and also use queues, events, or Livewire; and you want tenant context to be explicit and assertable (forTenant(), withoutTenant(), strict) rather than ambient.
• Adopt specifically because of v1.4.0 if you already touch tenancy through Eloquent scopes and serialize models into jobs — the restore-path gap is a real exposure and only 1.4.0+ closes it. Do not stay on a pre-1.4.0 line while handling multiple tenants' data.
• Adopt v1.6.0 if your model matches the reduced scope: single-database organizations, roles inside organizations, and a platform admin. That is now the package's entire contract; if that is your shape, the trim is a benefit (smaller surface, fewer behaviors to reason about).
• Proceed with caution when: you have significant legacy jobs dispatched outside tenant context in production — the narrowing is correct but converts a silent wrong-tenant read into a hard failure, so you need release capacity to audit and fix dispatch sites before enabling strict.
• Proceed with caution when you expected the removed surface: teams without tenancy, pluggable bypass, area/UI routing state, tenant-picker narrowing rules, permission verdict memoization, or permission-sync CLI. Each is now your code. Only adopt if you are funded to own that periphery — otherwise the total cost of ownership is higher than the package's feature list suggests.
• Proceed with caution on versioning: public API removal in a minor signals that consumers outside the author's two applications are not the design target. Pin versions and assume breakage on upgrade.
• Look elsewhere when: you are single-tenant (the tenant-boundary model is pure overhead), you have standardized on database-per-tenant where scoping is enforced at the connection level, your tenancy needs are already served by a broader platform package (a second scoping mechanism creates competing sources of truth), or you need a general-purpose authorization library — pair this with Laravel's native Gate/Policy rather than expecting it to replace them.

How to Pitch It (Stakeholders)

For executives: Two things are true at once. First, the security position is intact: the tenant-isolation fix we prioritized in v1.4.0 is unaffected by this release, so our documented guarantee that model restoration and queued-job hydration respect tenant boundaries still holds and can still go in front of enterprise buyers and security reviewers. Second, this release deliberately shrinks the package to only what its author's two applications use — it removes team handling without tenancy, custom authorization bypass, permission-check memoization, UI area state, tenant-picker tuning, and the permission-sync CLI. That is good for surface area and bad for our total cost of ownership: those capabilities become our code if we want them. Practically, the upgrade is a bounded refactor with no database migrations and no change to the remaining behavior: drop three config keys, replace a handful of symbol references, and remove deleted commands from deploy scripts. Recommendation: take the upgrade, pin the version, and fund two small hardening items — a load test on permission-heavy admin screens now that verdict memoization is gone, and contract tests around the symbols we depend on, because this package removes public API in minor releases by design. The strategic read is that we are depending on a well-maintained internal library, not a broadly supported open-source product; plan accordingly.

For engineering: Upgrade to v1.6.0 on top of the v1.4.0 baseline. Tenancy behavior (BelongsToTenant / TenantScope on restore, strict mode) is unchanged; there are no migrations. Work items: (1) remove enterable_scope, fallback_to_owned, and areas from any published config/authorization.php; (2) replace removed symbols — oohire touches ProviderWiringTest's BypassStrategy assertion and Support\Areas's CurrentArea::SESSION_KEY (needs its own session key), laravel-starter touches CurrentLayout's CurrentArea; (3) if any code path relied on teams without tenancy, add middleware calling setPermissionsTeamId(); (4) if you relied on a custom bypass, implement it in app code — the provider now registers a single Gate::before where super-admin passes (under teams, only the global assignment counts) and everyone else falls through, never false; (5) userCan() is now $user->can(), so benchmark permission-heavy screens and add app-level caching where needed; (6) define system-ability gates explicitly as Gate::define(SystemAbility::X->value, static fn (): bool => false) since systemAbilities() is gone; (7) TenantScopedPolicy now compares Tenancy::id() against the model's tenancy.foreign_key, so verify policy tests reflect that; (8) audit deploy pipelines for authorization:sync, authorization:repair-ownership, and make:authorization-policy and rely on AuthorizationSeeder for permission/role sync and owner-row re-derivation. Keep the regression tests covering restore-after-tenant-switch from the 1.4.0 rollout, and add a smoke test that boots the app with the trimmed config to catch stale keys.