Ant Path Matcher Laravel Package

Product Decisions This Supports

• Feature scoping where wildcard scope is a security property. Laravel’s Str::is() / Request::is() translate * into .*, so admin/* matches admin/users/42/delete. This package preserves Ant semantics — * stays inside one segment, ** crosses segments — which is the difference between a correct and an over-permissive access rule. That makes it the right primitive for allow/deny lists, redirect allowlists, and tenant path scoping.
• Build vs. buy. Zero dependencies, MIT, framework-agnostic (no Laravel major-version coupling). Cost to adopt ≈ cost to write, but writing means owning regex escaping, edge cases (empty segments, trailing slashes, nested **), and test coverage. Buy now, retain a vendoring fallback.
• Roadmap inputs. Recurring Laravel-shaped problems that reduce to “/-delimited string vs. pattern”: tenant/route scoping (/t/{tenant}/**), object-storage key allowlists (tenant-42/uploads/**/*.png), CDN/cache purge rules, webhook and post-login redirect allowlists, feature-flag targeting by path, log/metric filtering, gitignore-style asset exclusion.
• Invest-vs-patch signal. If more than two teams hand-roll pattern checks, that argues for a first-class, config-driven “path policy” layer (rules in config, ops-editable, single matcher contract) rather than scattered Str::is calls.
• Migration decisions. Java/Spring teams already reason in Ant patterns; adopting it lowers translation and code-review friction during a PHP migration.
• Default-deny advocacy. A matcher with well-defined wildcard scope lets you argue for default-deny policies with confidence instead of hedging with deny-by-exception.

When to Consider This Package

Adopt when:

• You need * vs ** distinction — that is the whole value proposition.
• Patterns live in configuration and may be edited by ops or support, so readability beats regex.
• You match arbitrary /-delimited strings, not only filesystem paths.
• You want a dependency-free, framework-agnostic matcher with no Laravel lock-in.
• The surface is small enough that you can accept small-team maintenance.

Look elsewhere when:

• Str::is(), Request::is(), or Route::pattern() already express the rule — a single * rule does not justify a dependency.
• You need filesystem traversal or globbing → Symfony Finder (->path(), ->notPath()).
• You need capture groups, lookarounds, or backreferences → compiled regex, cached.
• You match thousands of patterns on a hot path → compile to one alternation regex or a segment trie; per-call compilation will show up in middleware.
• You need maintenance guarantees: 6 stars, 0 dependents, last release January 2023. No CVE watch, no community catching edge cases, no benchmark data. You must consciously accept ownership.
• Pattern and input may be URLs with query strings — ? is a single-character wildcard in Ant syntax and collides with ? in URLs. Strip or normalize query strings, or you will get surprising matches.

Gates before committing: spike PHP 8.3/8.4 on your Laravel version; confirm whether URI-template variables ({var}) and extraction are supported if you want one pattern to both match and yield parameters; confirm separator behavior for non-/ delimiters and Windows-style paths. Put it behind a PathMatcher contract you own so swapping or forking is a one-file change.

How to Pitch It (Stakeholders)

Executives: A free, MIT-licensed utility that lets us express rules like admin/** and billing/* in configuration instead of hand-written regex. It closes a category of over-permission bugs: today our wildcards cross path separators, so a rule intended to protect admin/reports can also grant admin/users/42/delete. Adoption is measured in hours, not sprints, and exit cost is near zero because the code is tiny and permissively licensed.

Engineering: Framework-agnostic Ant-style matcher, zero dependencies, no Laravel version coupling. Wrap it in our own PathMatcher interface, pin the version, and add a pattern-compilation cache if it lands in hot middleware. Upstream looks dormant — 6 stars, no dependents, last release 2023 — so plan the fork: copy the class into app/Support/ with attribution. That fallback is roughly half a day and we should scope it now, not after an incident.

State the caveats up front: unproven in the wild, no benchmarks, dormant maintainer, and ?-as-wildcard is a genuine footgun for URL matching. Recommendation: adopt for config-driven, non-hot-path matching — ACLs, allowlists, cache and purge rules — not as the backbone of request routing.