iamgerwin/nova-spatie-role-permission
Adds Nova resources and UI for managing Spatie roles and permissions, letting you create roles, assign permissions, and attach them to users directly from your Laravel Nova dashboard. Simplifies access control administration without leaving Nova.
This package wires spatie/laravel-permission into Laravel Nova, giving you Nova resources for managing roles and permissions without building CRUD screens yourself.
Minimum setup:
composer require iamgerwin/nova-spatie-role-permission:^1.1.7
spatie/laravel-permission is installed, migrated, and its Role/Permission models are working before involving Nova. This package is a Nova UI layer; it does not replace the underlying permission system.Role and Permission resources in app/Nova/NovaServiceProvider.php (or verify whether the package auto-discovers them in your Nova version). Check the package README/service provider for the exact class namespaces to register.php artisan nova:publish only if you need to customize Nova assets; it is unrelated to this package's resources.First use case: open Nova, create a role, attach permissions via the relationship field, then assign that role to a user through your existing user resource (or via spatie directly). Verify with php artisan tinker that $user->hasRole(...) and $user->can(...) behave as expected.
Where to look first:
Role and Permission Nova resource classes — these are what you will extend or override.config/permission.php from spatie — table names, guard defaults, and cache settings all live there.Register resources explicitly. In NovaServiceProvider::resources(), add the package's Role and Permission resources. If you need custom behavior, create your own resource classes extending the package ones rather than editing vendor code.
Guard-aware role assignment. spatie/laravel-permission scopes roles and permissions by guard_name. Expose the guard field in the Nova form and make sure it matches the guard your users authenticate against (web by default). A role created for web will not apply to an api guard.
Permission attachment via relationship fields. The natural pattern is a BelongsToMany field on the Role resource pointing at permissions. On save, Nova syncs the pivot. Confirm the relationship name matches spatie's permissions() relation on the Role model.
Seed the baseline, manage the delta in Nova. Seed canonical roles/permissions in migrations or seeders so environments are reproducible, then use Nova for day-to-day adjustments. This avoids "works on my machine" permission drift.
Super-admin bypass. A common companion pattern is a Gate::before check in a service provider that grants all abilities to a super-admin role. This lives in your app, not the package, but it is the usual reason teams install this UI.
Customizing fields. Override fields(NovaRequest $request) in a subclass to add descriptions, hide the guard field, or restrict which permissions are selectable. Keep any authorizedToCreate() override static — see Gotchas.
Testing. If you extend the package's resources or reuse its test stubs, mirror the Nova 5.7.5 signatures. The v1.1.7 release updated stubs specifically because the upstream Authorizable trait changed.
Upgrade if you are on Nova 5.7.5+. Before v1.1.7, authorizedToCreate() on the Role and Permission resources was non-static, causing a fatal "Cannot make static method non static" error against Nova 5.7.5's Authorizable trait. If you are pinned below 1.1.7 and recently upgraded Nova, this is your breakage.
Keep authorizedToCreate() static in overrides. If you subclass the resources and override this method, declare it public static function authorizedToCreate(Request $request). Making it non-static reintroduces the same fatal error. The same applies to any other methods Nova's Authorizable trait defines as static.
Missing import was part of the fix. v1.1.7 added use Laravel\Nova\Nova; to the Role resource. If you copied that resource into your app before this release, add the import or you will hit class-not-found errors when the resource references Nova.
PHP 8.3 is not optional. This release line requires it. On PHP 8.2 you will either fail to install or hit syntax/runtime issues.
Permission cache invalidation. Spatie caches permissions. Changes made through Nova's Eloquent models normally trigger cache resets via model events, but bulk updates, raw queries, or direct pivot manipulation will not. After such operations, call:
app(\Spatie\Permission\PermissionRegistrar::class)->forgetCachedPermissions();
Guard mismatches are the most common silent failure. If a user "has" a role in the database but can() returns false, check guard_name on both the role and the permission, and check the guard configured for your auth driver.
Deleting roles and permissions. Prefer deleting through the Nova resource (Eloquent events) so spatie cleans up pivot rows. Direct SQL deletes leave orphaned model_has_roles / role_has_permissions rows.
Test stub drift. If your test suite copies the package's Nova stubs, update them alongside this release. Stubs that predate Nova 5.7.5 will not match the current trait signatures and can produce confusing failures unrelated to your own code.
Extension point. The cleanest customization path is subclassing the package resources and registering your subclasses in NovaServiceProvider, rather than publishing and editing vendor files. That keeps future upgrades (like this one) low-friction.
How can I help you explore Laravel packages today?