- How do I install dcat-plus/laravel-admin in a Laravel application?
- Require it with Composer, publish the package config and assets, then run the admin scaffolding command that generates the /admin route group, auth guard, and base directory. After that, create an admin user and sign in at /admin. Installation itself is conventional and low friction; the harder decision is how the second auth guard and asset pipeline will coexist with your existing application.
- Which Laravel and PHP versions does dcat-plus/laravel-admin support?
- The declared range is whatever composer.json states, but that is a claim, not proof of verification. The most recent tagged release is from December 2024, so check whether CI actually runs against the Laravel version you plan to use. If no CI matrix is visible, install it on a throwaway branch against your target framework version before committing.
- What is dcat-plus/laravel-admin best used for, and when should I avoid it?
- It fits internal back-office and CRUD consoles where the UI is not a product differentiator, since grids, forms, filters, charts, and permission management come ready-made. Avoid it for API-first, headless, or customer-facing surfaces, because it mounts an entire secondary application framework with its own routes, guard, middleware, menus, and jQuery/PJAX front end inside your Laravel app.
- How is dcat-plus/laravel-admin different from dcat-admin or laravel-admin?
- It sits in the lineage Laravel-admin to Dcat Admin to dcat-plus, with a small audience and no visible upstream-merge commitment. Before adopting, establish the actual delta from dcat-admin/dcat-admin, whether a changelog exists, and whether fixes flow upstream or the project has permanently forked. The answer to that determines your long-term upgrade and patching path.
- How do I create a custom action in dcat-plus/laravel-admin?
- Use the admin:action generator, which accepts --namespace, --base, --force, and non-interactive positional arguments, so it can be scripted in CI or scaffolding routines. Pick the action type that matches the container it renders in: default, grid-row, grid-batch, grid-tool, form-tool, show-tool, tree-row, or tree-tool. That taxonomy maps cleanly onto grid, form, and tree surfaces, which keeps CRUD extension code predictable.
- What are lazy-table and lazy-form, and when should I enable them?
- They defer rendering of heavy grid and form content to the separate endpoints /dcat-api/render and /dcat-api/form instead of overloading the action endpoint. Use them on pages that build many widgets or run expensive queries, so the page shell renders first and the deferred blocks load afterward. They are a performance lever rather than a setting you should enable everywhere by default.
- Is HandleActionController's _action dispatch safe from object injection?
- The documented flow posts an underscored class name in _action, which HandleActionController then deserializes and instantiates; any endpoint that turns a client string into new $class() is a gadget-chain primitive. Verify that _action is validated against an explicit registry or whitelist rather than namespace and authorization checks alone, and treat this as your highest-severity audit item. Related risk: actionScript, resolverScript, and rejectScript emit JavaScript with server values interpolated directly, which sits outside Blade escaping and complicates CSP nonce adoption.
- Do batch actions enforce authorization on the selected rows?
- No. BatchAction::getKey() returns the array of selected IDs straight from the browser, so the framework does not perform per-ID authorization for you. You must check inside the action that the current admin is allowed to modify each record, because the default scaffolding will not do it. Skipping this check lets a crafted request operate on rows outside the user's scope.
- Can dcat-plus/laravel-admin coexist with an existing SPA, Inertia, or Livewire front end?
- It can, but expect real friction: you get a second auth guard, a second front-end toolchain, and a second set of rendering conventions layered beside your main front end. It works best when the admin panel is an isolated, self-contained area under /admin rather than something sharing layouts, session semantics, or JS build steps. Isolate it deliberately instead of blending it into the primary application.
- Is dcat-plus/laravel-admin actively maintained and safe for production?
- The project shows roughly 145 stars, zero dependents, and a most recent tagged release in December 2024, with an effective bus factor of one and no commercial support or LTS commitment. Upstream lineage has a documented history of maintainer abandonment and framework-version lag, so plan for the possibility of maintaining your own fork. For long-lived systems, pin versions, review the published vendor assets and their third-party licenses separately from the MIT wrapper, and confirm a security disclosure channel exists.