- What is imanghafoori/laravel-heyman used for?
- Laravel Heyman is an ergonomics package for declarative authorization and validation in Laravel applications. It lets you organize gates and permission checks into dedicated classes instead of scattering closures, and adds fluent assertion and guard helpers with global function shortcuts. The goal is centralized, readable, testable access-control logic that is easier to maintain as an application grows.
- How do I install laravel-heyman?
- Install it with Composer using composer require imanghafoori/laravel-heyman. The package supports Laravel service provider auto-discovery, so installation is standard and the configuration surface is small. After installing, run your test suite and static analysis before spreading helper calls through the codebase.
- Which Laravel and PHP versions does laravel-heyman support?
- You should verify supported Laravel and PHP versions against the package's Composer constraints and upstream CI rather than assuming compatibility. The last release noted in the evaluation is dated 2024-03-02, so confirm it falls within your framework and PHP support window. Add a CI job that installs the package on your exact Laravel and PHP matrix before adopting it.
- How does laravel-heyman compare to Laravel Gates and Policies?
- Heyman layers declarative assertion and guard helpers on top of Laravel and encourages putting gate and permission logic into dedicated classes rather than closures. That overlaps with Laravel Gates and Policies, so it should complement rather than silently replace your existing authorization layer. Decide explicitly when to use Heyman classes versus native Policies and Gates, and document that guideline for reviewers.
- Does laravel-heyman replace FormRequest validation?
- No, it should not be treated as a replacement for FormRequest validation or Laravel's native validator. Heyman's assertion and guard helpers are a thin ergonomics layer, and using them instead of FormRequests can create inconsistent error payloads. Keep FormRequest rules for request-shape validation and use Heyman only where your team has agreed it fits.
- What exceptions do laravel-heyman helpers throw and how should I handle them?
- The helpers throw exceptions when assertions fail, but you should confirm the complete helper inventory and exact exception class or contract in the package source. Map those exceptions in app/Exceptions/Handler or bootstrap/app.php on newer Laravel so failures produce coherent 4xx responses. Unmapped exceptions can become generic 500s, so test the error payload against your API contract.
- Is laravel-heyman safe to use in production given its maintenance risk?
- The evaluation flags a single-maintainer bus-factor risk and low strategic momentum, so treat it as a calculated dependency rather than a set-and-forget standard. Pin the version, monitor upstream activity, and have a mitigation plan to fork or vendor the package if it goes quiet. Because call sites are greppable and the package is small, removal cost is relatively low.
- Can I use laravel-heyman in jobs, services, and actions, or only controllers?
- The package is best used as a thin guard and assertion layer at entry points such as controllers, jobs, and service methods. It is an application-level ergonomics package, not infrastructure, so it can technically be called wherever your architecture permits global helpers. Decide and document which layers may use it, because broad helper usage becomes a de facto coding standard.
- Does laravel-heyman include middleware or exception-handler integration?
- The package is lightweight and does not appear to be infrastructure-level: the evaluation notes no queues, storage, service integrations, or runtime services to provision. Exception-handler binding and HTTP error mapping are described as application-side work, so verify in the source whether any middleware or handler integration ships. Plan to wire the thrown exceptions into your own error contract.
- How should I test and roll out laravel-heyman in an existing Laravel app?
- Start with a bounded spike on a branch: install the package, run the full test suite and PHPStan or Psalm, and check error responses against your contract. Then pilot it in one module with a written guideline for Heyman versus FormRequest versus Policy versus abort(). Review PR noise, payload consistency, and developer preference before promoting it to a team standard or removing it.