Weave Code
Simple Permissions Laravel Package
guava/simple-permissions
A lightweight permissions package for Laravel that lets you assign roles and permissions to users through a simple, readable API, with middleware and Blade directives for guarding routes and views without the overhead of larger ACL libraries.
Simple permission and role system for Laravel. Supports enums.
Frequently asked questions about Simple Permissions
- What is guava/simple-permissions used for in Laravel?
- It is a lightweight Laravel RBAC package for assigning roles and permissions to users through a simple, readable API, with enum support plus middleware and Blade directives for guarding routes and views. It fits applications that use Eloquent models, standard guards, middleware, gates, and policies for straightforward role and permission checks. It is a weaker fit for complex ABAC, delegated administration, externalized authorization, or team-scoped permissions unless those capabilities are explicitly supported.
- How do I install and configure guava/simple-permissions in a Laravel app?
- Use Composer to require a pinned ^1.1.1 release, publish the package config and migrations, and run the migrations in staging first. Then seed your permission catalog, assign roles and permissions to users, and enforce checks through middleware, gates, policies, or Blade directives. Confirm the exact publish tags and configuration keys in the package README before changing production.
- Which Laravel and PHP versions does guava/simple-permissions support?
- The provided context does not list an exact Laravel or PHP version matrix, so check composer.json and the README before adopting. The assessed baseline is v1.1.1, and you should test it in staging against your application's Laravel and PHP versions.
- Does guava/simple-permissions support multiple guards or auth providers?
- Multiple guard and provider support is not confirmed in the provided material, so verify it in the package documentation and test your guard names explicitly. The assessment flags guard or auth-provider mismatch as a failure mode when integrating with standard Laravel authentication.
- Does guava/simple-permissions support teams or multi-tenant permission scoping?
- The assessment describes team and multi-tenant scoping as a weaker fit unless the package explicitly supports it, and no such capability is confirmed in the provided context. Confirm this in the documentation before designing tenant-scoped roles or permissions.
- How is permission cache invalidation handled in guava/simple-permissions?
- The provided context does not specify the exact cache invalidation mechanism, but it flags stale permission caches as a production failure mode. Define how role and permission changes clear cached lookups, and test that behavior with your cache driver before rollout.
- Can I extend the Role and Permission models safely?
- The assessment calls for validating custom User and Role models, API responses, and cached permissions, so extension should be tested rather than assumed. The v1.1.1 roles-cast fix suggests edge cases around casting and serialization, so cover those with regression tests.
- How do I migrate from existing Laravel authorization logic to guava/simple-permissions?
- Start by defining your authorization model and role taxonomy, then install a pinned ^1.1.1 release and run migrations in staging. Seed the permission catalog, backfill existing role assignments, add middleware, gates, or policies, and run UAT before production rollout.
- What should I test before production after the v1.1.1 roles-cast fix?
- Add regression coverage for role casting and serialization, especially in JSON or API responses and with custom User or Role models. Also test cached permissions, guard names, cache drivers, queue workers, and Laravel Octane if you use it, then pin the version and validate in staging.
- Is guava/simple-permissions actively maintained, or should I use a larger ACL package?
- The assessment treats it as a community-supported package with low-to-medium maintenance risk and small patch releases, so pin versions, review changelogs, and keep an internal owner or fallback option. It is a strong fit for simple Laravel RBAC, but larger ACL or externalized authorization systems may be better for complex ABAC, delegated administration, or multi-tenant needs.
Weaver
How can I help you explore Laravel packages today?