- Which Laravel and PHP versions does dlnsk/h-rbac support, and is that matrix tested in CI?
- The package is designed for conventional Laravel applications, but the exact Laravel and PHP constraints should be confirmed in its composer.json and README before adoption. Check the repository's CI configuration and recent commits to verify the stated support matrix is actually tested. Because it builds on native Gate and Policy behavior, the Laravel version needs to support the authorization features you rely on.
- How do I install dlnsk/h-rbac in a Laravel app?
- Install it with Composer, publish and run the package migrations, then add the provided trait to your User model. After that you seed roles and permissions, assign roles to users, and optionally wire the middleware. The package is additive to Laravel's native authorization, so existing Gate definitions and policies continue to work.
- How does dlnsk/h-rbac cache permissions, and what invalidates the cache?
- The package includes caching for permission and role lookups, which matters because authorization checks run frequently. The key production question is whether role and permission mutations reliably invalidate the cached permission graph. Verify this in the source and test it yourself: stale cached roles can cause either silent privilege escalation or unexpected lockout.
- Does the role hierarchy support transitive inheritance, bounded depth, and cycle detection?
- The package uses a hierarchical model where roles inherit permissions from descendant roles, which is intended to avoid role explosion. The technical assessment flags unbounded depth and cycles as risks to confirm. Review the traversal implementation and add tests for deep hierarchies and accidental role cycles before relying on it in production.
- Are permission callbacks evaluated on every authorization check, and what is the performance cost?
- Callbacks are arbitrary application code executed inside the authorization path, so they can run on every can() check that reaches them. That means a slow query or thrown exception in a callback can degrade or break authorization across the app. Keep callbacks small, cache expensive lookups, and load-test the checks that run most often.
- Can dlnsk/h-rbac handle multiple guards, multi-tenancy, or team-scoped roles?
- The package is designed for a conventional Laravel application and layers roles on top of native gates and policies. The provided context does not establish built-in support for multiple guards, multi-tenancy, or team-scoped roles. If you need those, verify the schema and API in the source or plan to add scoping yourself.
- How does dlnsk/h-rbac interact with Laravel policies, Gate::before, and policy before/after hooks?
- It is deliberately additive rather than a replacement, so Gate::define, policy auto-discovery, $this->authorize(), and @can continue to work. Roles become an additional source of truth that can short-circuit or enrich a check. You should still test how your existing Gate::before super-admin shortcuts and policy before/after hooks combine with role-based decisions.
- Does dlnsk/h-rbac have tests, and are there integration tests against real Laravel Gate behavior?
- The evaluation calls for confirming test coverage and integration tests against real Gate behavior rather than assuming it from the README. Check the repository's test suite, CI runs, and recent commit history. Because the package wraps native authorization, tests should cover both package-level role checks and interaction with policies and Gate hooks.
- Is dlnsk/h-rbac safe for production, given its low star count and single maintainer?
- Technically it is small and conventional, but the dominant risk is organizational: low star count and a single maintainer mean a low bus factor and no commercial support path. The recent release date is a positive maintenance signal, but verify it against commit history rather than a single tag. Plan for the package to be small enough to fork or replace if maintenance stops.
- How do I migrate from Spatie permissions or an existing role system to dlnsk/h-rbac?
- Adopt it incrementally because it builds on native gates: install and migrate, map current roles and permissions into the new tables, dual-write role assignments, and put new checks behind a feature flag. Shadow mode is a useful step, evaluating the new decision alongside the old one and logging divergences without enforcing. Avoid running it alongside another role package such as Spatie's, because two competing role models on one User model cause confused debugging. Cut over module by module, then remove the legacy checks.