Weave Code
Laravel Access Control Laravel Package
happenv-com/laravel-access-control
Role-based access control for Laravel. Define roles and permissions, assign them to users, and guard routes, controllers, and Blade views with simple middleware and helper checks. Lightweight, configurable, and easy to drop into existing apps.
A modular access control library for Laravel applications that uses enum-based permissions and a voter system. Perfect for modular monolith architectures where different modules can define their own permission logic and extend existing.
Frequently asked questions about Laravel Access Control
- How do I install happenv-com/laravel-access-control in a Laravel application?
- Install it with Composer using the package name happenv-com/laravel-access-control and pin version 3.1.1 rather than 3.1.0 so you get the ability-resolution fix. The standard Laravel integration shape applies: register the service provider if needed, publish the package migrations, and run php artisan migrate to create the role and permission tables. Then add the HasPermissions trait to your user model and configure your roles and permission enums. Prototype in one non-critical service before rolling it out broadly.
- Does this package support Laravel 9 and Laravel 10?
- The assessment assumes Laravel 9+ or 10+ with PHP 8.x and a relational database for the role and permission tables. You should still confirm the exact Composer constraints in the package before adopting it, because the evaluation does not list a formal version matrix. If you are on an older Laravel version, treat compatibility as unverified until you test it in a prototype.
- How is this different from Spatie laravel-permission?
- It occupies the same architectural slot as Spatie laravel-permission and wraps Laravel's Gate and Policy layer rather than replacing it. The distinguishing design is enum-based permissions plus a voter system intended for modular monoliths where modules define and extend their own permission logic. Spatie is the more established option with a larger contributor base, so compare maturity, feature coverage, and long-term maintenance needs before choosing. For a small modular monolith, this package may fit the domain model more naturally.
- Can different modules define their own permissions and extend existing ones?
- Yes, that modular extension model is the package's stated design goal. The enum-based permissions and voter system are meant to let separate modules own their permission logic while still composing with permissions defined elsewhere. In practice, you should establish naming conventions and a seeded role matrix early so module-defined permissions do not collide or become inconsistent. Validate that every permission string resolves correctly before expanding across modules.
- How do I guard routes, controllers, and Blade views with this package?
- The package provides middleware and helper checks for authorization, and it composes with Laravel's existing Gate and @can directives. Use middleware aliases on routes, authorization checks in controllers or Form Requests, and @can or helper checks in Blade templates. Because it wraps Laravel's authorization layer, it should fit alongside existing policies rather than requiring a routing rewrite. Confirm the exact middleware alias names and helper signatures in the package documentation for your pinned version.
- What changed in version 3.1.1, and should I upgrade from 3.1.0?
- Version 3.1.1 is a patch focused on the HasPermissions trait's ability-string resolution and condition evaluation. It is intended as a drop-in upgrade from 3.1.0 with no stated breaking changes, but the fix can cause ability strings that previously failed to resolve to now match. That means previously denied checks may start passing for existing role assignments, so test your permission strings and role matrix before deploying. Prefer 3.1.1 for new installs to avoid inheriting known-incorrect behavior.
- What does it mean that conditions are checked once in this package?
- The 3.1.1 change alters evaluation semantics so conditions are evaluated once rather than re-evaluated per check. If conditions previously ran repeatedly, any condition with side effects or time dependence will now behave differently. You should confirm whether single evaluation implies caching, where that cache is invalidated, and whether a cache clear is required after upgrading. Avoid side-effectful conditions and test time-sensitive authorization rules explicitly.
- Does this package support multi-guard, teams or tenancy, and wildcard permissions?
- The provided assessment does not confirm support for multi-guard setups, teams or tenancy, or wildcard permissions. Those are common requirements for API-first and multi-tenant Laravel services, so verify them against the package documentation and source before committing. If they are missing, you may need to extend the package or supplement it with Laravel policies. Treat these as evaluation gates rather than assumed features.
- Is this package safe to use in production given its young age and single contributor?
- The technical risk is moderate and concentrated in maintenance and bus factor, not necessarily code quality. The package is relatively young and this change has a single named contributor, so pin a tested version and avoid automatic upgrades on the authorization path. Prototype in a non-critical service, add feature tests around allowed and denied cases, and monitor upstream release cadence. If long-term support is critical, consider whether a more established alternative is safer.
- How should I test and validate permission strings before adopting it?
- Start with a seeded role matrix in a single non-critical service and assert both allowed and denied outcomes in feature tests. Check that every permission string used by your application resolves as expected under version 3.1.1, especially strings that may have failed under 3.1.0. Test conditions for side effects and time dependence, and verify middleware, controller, and Blade checks behave consistently. Only widen scope after the prototype proves the role and permission model matches how your product thinks about entitlements.
Weaver
How can I help you explore Laravel packages today?