jaguarjack/catchadmin
Laravel-based admin panel framework for rapid backend development, with built-in RBAC permissions, modular architecture, CRUD code generation, and a Vue front end. Ready-made user, role, menu, and department modules help teams scaffold secure, extensible admin apps quickly.
Build vs. buy for the back-office layer. CatchAdmin is a credible "buy" answer for the internal admin surface that every B2B product accumulates: users, roles, permissions, content, attachments, exports, audit/recycle bin. The decision it unblocks is whether the team hand-rolls the 20th CRUD screen or standardizes on a scaffold. Its scope (token auth, permission management, dynamic routes, dynamic tables, paginated API wrapper, resource-level permissions, upload/download, import/export, recycle bin, attachment management) maps almost 1:1 to a typical admin backlog, which makes the make/buy trade-off concrete rather than theoretical.
Roadmap sequencing: platform investment before feature velocity. The framework is modular by design (modules/{Module} on the backend, web/src/views/{module} on the frontend), with CLI tooling (catch:module:install, catch:make:migration, catch:make:model, catch:make:menu, catch:migrate, catch:db:seed). That supports a roadmap decision to spend one milestone building an internal admin platform — module template, menu conventions, permission wiring — and then amortize it across all later admin features instead of re-litigating structure per feature.
Turning a spec into a running admin screen. This is the most PM-relevant capability: the model layer is declarative ($searchable with per-field operators, $fields, $form, $formRelations, sortField, asTree, parentIdColumn), and there is a documented table-definition → migration → model → route → menu pipeline, plus shipped code-generation skills covering codegen, export, import and upload. Practically, a PRD's data dictionary plus field/required/nullable/foreign-key annotations becomes the input that produces the first working list, form and permission entry. That shortens the spec-to-demo loop and gives stakeholders something clickable far earlier in the cycle.
Prioritizing use cases where the framework's opinions are an asset, not a tax. Strong fit: internal ops consoles, supplier/back-office portals, CMS-style content administration, approval and review queues, import/export-heavy data maintenance, and anything needing soft-delete recovery ("data recycle bin") or attachment handling on day one. Weak fit: anything where the admin's look and feel is part of the product's differentiation or where the workflows are the product.
Resourcing and ramp-time decisions. The repo ships AGENTS.md and a set of agent skills (catchadmin-module, catchadmin-backend, catchadmin-codegen, catchadmin-export, catchadmin-import, catchadmin-upload, catchadmin-frontend, catchadmin-install) with explicit conventions — PSR-12, declare(strict_types=1), readonly constructor injection, status 1=Enabled / 2=Disabled, Unix-integer timestamps, unsignedInteger deleted_at instead of softDeletes(). That is unusually agent-legible, and it supports a staffing decision to let mid-level engineers (or coding agents under review) produce convention-compliant modules, with senior time spent on domain logic rather than scaffolding.
Licensing and distribution. Apache-2.0 means commercial use, internal modification and forking are all permissible without a procurement conversation. That removes legal friction from a pilot and preserves the exit option of an internal fork, which matters given the adoption profile (see below).
Adopt when most of these hold:
Catch\Base\CatchModel, Route::adminResource, standard controllers/models).Look elsewhere when any of these dominate:
CatchModel subclasses with framework-specific timestamp and soft-delete conventions creates real migration cost later. If the domain is the moat, keep it in app/ and use this only for the admin shell — and be honest about whether the team will actually maintain that boundary.Decision gate to recommend: run the spike, measure actual time-to-first-working-screen versus the team's current baseline, and record the framework's touchpoints in your codebase. If the spike shows the boundary can be held — domain logic outside CatchModel, presentation isolated in web/ — proceed. If the framework leaks into domain code during a two-module spike, it will leak everywhere.
For executives — the one-paragraph version. CatchAdmin is an open-source (Apache-2.0), modular Laravel + Vue admin framework that already contains the unglamorous 60–70% of every back-office build: authentication, roles and resource-level permissions, dynamic routing and tables, pagination, file upload/download, data import/export, soft-delete recovery and attachment management. Adopting it converts repeated per-feature scaffolding into platform configuration, which should compress the time from approved spec to clickable admin screen — the exact stretch where internal tools usually stall. Licensing is permissive, so there is no procurement cost and we retain the option to fork. The trade-off is deliberate dependency on a small, single-maintainer project with a Chinese-first documentation set and a deliberately current Laravel/Vue stack; we manage that with a pinned version, a vendored copy, and a strict rule that our business logic stays outside the framework. Ask: a two-week, two-module spike with a go/no-go, not a commitment.
For engineering — what you are actually agreeing to. You inherit strong conventions rather than a blank slate: modules/{Module} for backend, web/src/views/{module} for pages, CatchModel with declarative $searchable/$fields/$form, Route::adminResource, Unix-integer timestamps, status 1|2, and unsignedInteger deleted_at instead of Laravel's softDeletes(). The CLI (catch:make:migration|model|menu, catch:module:install, catch:migrate, catch:db:seed, catch:build) and the shipped agent skills mean scaffolding is cheap and reproducible. In return we accept: opinionated data conventions we must not fight per-module, tight coupling to Element Plus on the frontend, a fast-moving upstream we must pin, and the obligation to keep domain logic in app/ Services/Models rather than in framework subclasses. Success criterion for the spike is not "does it work" but "did the boundary hold, and what is our real per-module cost."
Framing the risk honestly. The dependency is real but bounded and reversible: no license lock-in, no per-seat cost, no data escrow concern, and the whole thing is forkable PHP. The residual risks — upstream abandonment, security-patch latency, and convention drift on upgrade — are the standard costs of adopting any scaffold, and they are cheapest to absorb now, at the start, with an explicit fork-and-pin policy, rather than after the admin surface has grown to fifty modules.
How can I help you explore Laravel packages today?