Weave Code
Laravel Policy Soft Cache Laravel Package
innoge/laravel-policy-soft-cache
Laravel package that adds a soft cache layer for authorization policies, storing policy check results to avoid repeated Gate evaluations and speed up permission checks. It integrates with Laravel's authorization system to reduce policy overhead while keeping your existing policy code unchanged.
Enhance Laravel's authorization efficiency with soft caching for policy checks—boosting performance without affecting concurrent request integrity.
Frequently asked questions about Laravel Policy Soft Cache
- How do I install innoge/laravel-policy-soft-cache in a Laravel app?
- Install it with Composer using composer require innoge/laravel-policy-soft-cache at ^1.6 for Laravel 13 support. The package uses Laravel auto-discovery, so manual service provider registration is normally unnecessary. Check the README for a publishable config file, then enable caching per policy through the opt-in mechanism rather than globally.
- Which Laravel versions does laravel-policy-soft-cache support?
- Version 1.6.0 adds Laravel 13 compatibility, and the package targets modern Laravel applications on current PHP versions. Before bumping a service, diff the composer.json constraints between 1.5.0 and 1.6.0 to confirm the minimum Laravel and PHP versions. A compatibility release can legitimately raise the floor, so verify your oldest application still satisfies the constraints.
- How does soft caching for Laravel policies actually work?
- It decorates Laravel's Gate and policy dispatch layer and memoizes the verdict of each policy check. Repeated @can calls, nested policy checks, and per-item permission serialization in API resources then reuse the stored result instead of re-running the policy method. Your policy classes stay unchanged because caching happens at the authorization boundary.
- Is it safe to cache Laravel authorization policy results?
- Authorization caching is a security-sensitive boundary, so correctness depends on the cache key including user identity, ability name, model class and key, and every extra argument. A soft cache is short-lived or request-scoped, which limits staleness but does not guarantee correctness inside a single request. Write negative tests, such as asserting a user cannot view another tenant's record, before enabling it.
- Does the policy cache reset between requests on Laravel Octane or queue workers?
- The key question is whether the cache is genuinely request-scoped and reset at request boundaries under Octane, Swoole, and queue workers, rather than being a container singleton. A singleton that persists across requests could serve a verdict from a previous user or tenant. Confirm this behavior with an Octane test or keep the package out of long-lived worker processes until verified.
- Do I need to change my existing Laravel policies to use it?
- No policy code changes are required because the package layers on top of Gate and policy dispatch. Adoption is typically a Composer install plus a config file, with caching enabled per policy or through an explicit allowlist. Keeping it opt-in per policy limits the blast radius compared with enabling it globally.
- How are before() hooks, Gate::any, and policies with extra arguments handled?
- These are the edge cases to verify yourself: super-admin before() bypasses, guest users, soft-deleted models, variadic arguments, and closures each need correct key derivation or an explicit bypass. Test Gate::any and Gate::none alongside normal ability calls, since a wrongly shared key can return another subject's verdict. A small characterization suite in your own repository is the reliable check.
- Will it conflict with spatie/laravel-permission or Laravel Telescope?
- Any package that also decorates the Gate, such as a permission cache or a debugging toolbar, should be checked for double-wrapping. Run the combination in a staging branch and watch for duplicate queries, unexpected cache hits, or changed authorization results. Telescope is useful for confirming the query reduction you expect from the policy cache.
- How can I tell if policy caching actually improves performance?
- Instrument a representative request, such as an admin dashboard or list view heavy with @can directives, using Telescope or the query log. Compare policy-related queries and response time before and after enabling the cache. If the win is not measurable, disable it and remove the dependency.
- Is innoge/laravel-policy-soft-cache actively maintained, and how do I roll it back?
- The 1.6.0 release is a small compatibility PR adding Laravel 13 support, which shows the package tracks framework majors but also that it is a low-churn, likely single-maintainer project. Its footprint is small, so forking or replacing it is cheap if maintenance stalls. Rollback means disabling the config flag or removing the dependency; there are no migrations or schema changes to reverse.
Weaver
How can I help you explore Laravel packages today?