Weave Code
Authorization Laravel Package
directorytree/authorization
An easy, native role and permission management system for Laravel. Assign roles and permissions to your models, check abilities, cache lookups, and protect routes with built-in middleware.
Native Laravel Authorization.
Frequently asked questions about Authorization
- How do I install directorytree/authorization in a Laravel app?
- Run composer require directorytree/authorization, then php artisan migrate to create the package's role and permission tables. Add the Authorizable trait to your App\Models\User model. After that you can check roles and permissions using Laravel's normal authorization methods.
- Does directorytree/authorization work with Laravel 9, 10, 11, and 12?
- Yes, the package's release history tracks Laravel major compatibility across 9, 10, 11, and 12. Each Laravel major version has been added through community contributions, so confirm the current release supports your exact Laravel version before adopting. There is no documented commitment yet for Laravel 13.
- How does directorytree/authorization integrate with Laravel Gate and can() checks?
- The package registers every permission row with Laravel's Gate via a PermissionRegistrar, so Gate::allows(), can(), authorize(), and @can continue to work. It does not replace Laravel's authorization stack; it feeds it. Existing policies can coexist, but you should decide whether policies or permission strings are the source of truth to avoid overlap.
- How does caching work in directorytree/authorization and is it safe in production?
- It uses a global authorization.permissions cache key with daily expiry, invalidated when Permission model records are created, updated, or deleted. Grant and revoke operations mutate pivot tables rather than permission rows, so pivot-level changes may not flush the cache as expected. In multi-instance deployments using file or array cache stores, this can cause stale authorization decisions. Review cache invalidation and consider a shared cache store or manual flushing.
- Why do my permission checks fail in tests with directorytree/authorization?
- Tests must explicitly call app(PermissionRegistrar::class)->register() in setUp() before Gate assertions will resolve permissions. Forgetting this produces confusing false negatives because the registrar has not pushed permission rows into Gate. Add the call to your test base class or each relevant test.
- Does the permission middleware require all permissions or any permission?
- The README implies the permission middleware requires all listed permissions (AND), which differs from what many developers expect. Confirm this behavior against the package source or a quick test before relying on it. If you need OR semantics, you may need custom middleware or separate route definitions.
- Can I customize the models or use existing roles and permissions tables with directorytree/authorization?
- The package publishes default migrations that you can export and customize with vendor:publish --tag=authorization-migrations. You can swap the User model using static Authorization::useUserModel() calls in AuthServiceProvider, though this is boot-order sensitive. Whether the Role and Permission models can cleanly point at pre-existing tables depends on matching table and pivot names, so adoption often requires a data migration or schema alignment.
- What are the alternatives to directorytree/authorization for Laravel roles and permissions?
- The incumbent alternative is spatie/laravel-permission, which has much stronger adoption. DirectoryTree Authorization is intentionally thin and Laravel-native, so it suits teams that want simple Gate integration without a larger framework. Compare feature needs such as multiple guards, teams, wildcard permissions, super-admin bypass, and audit trails before choosing.
- Does directorytree/authorization support multiple guards, teams, or multi-tenancy?
- There is no documented support for multiple guards, teams or multi-tenancy, wildcard permissions, super-admin bypass, or an audit trail. Permissions appear to be global rather than guard-aware. If those are near-term requirements, treat the package as a starting point that must be extended rather than a complete solution.
- How many permissions can directorytree/authorization handle at boot time?
- The PermissionRegistrar pushes every permission row into Laravel's Gate, so boot-time cost grows with the number of permission rows. Keep the permission table small and avoid generating per-record permission strings. If you expect a large steady-state permission count, benchmark registration cost and consider caching or a different authorization design.
Weaver
How can I help you explore Laravel packages today?