Laravel Restify Laravel Package

Product Decisions This Supports

• Feature: authorized relationship management for authenticated users. This release hardens the core value proposition — attach/sync fail closed when no parent policy exists, meaning relationship writes are denied by default rather than silently allowed. That directly supports any roadmap item involving user-managed associations (team membership, role assignment, tagging, project collaborators) where an IDOR bug becomes a security incident.
• Build vs buy: leans "buy." The 10.4.62 release delivered three fixes in one patch — authorization fail-closed, global-scope/soft-delete-aware ID resolution, and per-model connection transactions — exactly the edge cases an in-house attach() wrapper gets wrong. Each is a multi-week bug class (tenant leakage, cross-connection transaction drift) that teams typically discover in production. 10.4.67 adds a narrower correctness fix for keyless pivot models, reinforcing that the maintainers are still closing relationship-write edge cases. The maintenance signal remains strong.
• Roadmap enabler: multi-tenant and multi-database expansion. Honoring global scopes and soft deletes during related-ID resolution, plus running write transactions on the model's own connection, removes the two most common blockers to shipping the same feature across tenant-scoped or read/write-split architectures. If the roadmap includes tenant isolation or a reporting replica, this release is the green light rather than a follow-up ticket.
• Risk register item: custom attachers bypass authorization. The release explicitly documents that custom attachers skip the policy check. That is a documented gap, not a fixed one — it needs a PM-owned decision on whether custom attachers are permitted at all, and if so, an enforcement mechanism (code review checklist, static analysis rule, or a lint in CI).
• Edge-case correctness for custom pivot models. 10.4.67 skips the primary-key tiebreaker on pivots without a declared key. This is not a strategic capability, but it removes a latent failure path for teams using custom pivot classes that do not declare an id. Worth folding into the upgrade rather than treating as a separate initiative.
• Compliance posture. Fail-closed authorization is the behavior auditors ask about; "deny unless a policy grants" is defensible in a SOC 2 / ISO 27001 control narrative in a way that "allow unless a policy denies" is not. Worth capturing in the security controls documentation while it's fresh.

When to Consider This Package

Adopt when:

• The product has many-to-many relationships written by end users through the API or UI, and authorization on those writes is a real concern rather than a theoretical one.
• The data model is tenant-scoped (global scopes) or uses soft deletes on either side of the relationship — the 10.4.62 changes specifically fix related-ID resolution in those cases, so a pre-10.4.62 version is a latent correctness bug for you.
• The application uses multiple database connections, or a read/write split, where attach/sync writing on the wrong connection would cause inconsistent or lost writes.
• You use custom pivot models that do not declare a primary key — 10.4.67 addresses the keyless-pivot tiebreaker path, so include that patch if this describes your schema.
• You want fail-closed authorization semantics without hand-rolling a policy layer around Eloquent's relationship methods.

Look elsewhere or proceed with caution when:

• The authorization model is centralized somewhere else (e.g. a dedicated permission service or API gateway) and duplicating the policy check inside the ORM creates two sources of truth.
• You rely on custom attachers and cannot enforce the documented "skips authorization" caveat through review or tooling — the security guarantee does not extend to your code path.
• Relationship writes are all system-generated (seeders, imports, background jobs) with no user-facing mutation surface; the authorization value is low and the added layer is mostly ceremony.
• The team is on a Laravel version outside the package's supported matrix — verify before planning the upgrade, since the connection-transaction fix may depend on framework internals.

How to Pitch It (Stakeholders)

To executives: This is a security and correctness release for a package we use (or are evaluating) to manage user-facing relationship writes. It changes the default from "permit unless blocked" to "deny unless explicitly granted," which is the posture our security questionnaire and auditors expect. It also fixes silent-failure classes — tenant/soft-delete scoping and multi-database transaction routing — that produce data leakage and inconsistent writes without throwing errors. The latest patch adds a small correctness fix for keyless pivot models. Low upgrade cost, meaningfully lower incident risk.

To engineering: Upgrade to 10.4.67, which supersedes 10.4.62. Three behavioral changes to note from the 10.4.62 baseline. First, attach and sync now fail closed when no parent policy is resolvable — any call site that previously relied on the absence of a policy meaning "allowed" will start throwing; audit those before rollout. Second, related-ID resolution on attach/sync now respects global scopes and soft deletes, so IDs that were previously accepted despite being out of tenant scope or soft-deleted will now be rejected — this is intended behavior but may surface as failing tests or 403s in staging. Third, write transactions now run on the model's own connection, which matters if you have read/write splits or multiple connections. The 10.4.67 patch additionally skips the primary-key tiebreaker on pivots without a declared key; include it if we use custom pivot models without explicit primary keys. The known limitation remains that custom attachers bypass authorization by design; if we have any, they need explicit review sign-off, and I'd like a CI check or lint to keep that from spreading.

One-line ask: Approve the 10.4.67 patch upgrade and a short audit of attach/sync call sites that lack an explicit parent policy.