- How do I install jeremykenedy/laravel-roles in a Laravel application?
- Install it with composer require jeremykenedy/laravel-roles, then run php artisan roles:install to publish the config, migrations, and views. The installer is interactive by default, so pass the --css and --force flags to make it reproducible in CI. After publishing, run php artisan migrate and wire the package's role and permission traits into your User model as described in the documentation.
- Which Laravel and PHP versions does jeremykenedy/laravel-roles support?
- The package declares support for Laravel 5.3 through 13 and PHP 7.2 and above. The verified test matrix is much narrower: PHP 8.2 to 8.4 with Laravel 12 and 13. Laravel 11 is still declared as supported but has been dropped from the test matrix, so confirm it installs and passes your own suite before committing to that combination.
- How do I protect routes with role and permission middleware?
- The package registers route middleware aliases for role, permission, and level checks, so you can attach them to individual routes or route groups in your routes files. Denials now return a 403 rather than a 500, so make sure your tests and error handling expect that status. For anything more nuanced than a simple check, pair the middleware with Laravel policies.
- How do I check a user's roles and permissions in Blade templates?
- The package ships Blade directives for role and permission checks so you can conditionally render navigation and actions without dropping into raw PHP. They read from the same underlying relationships as the middleware, which keeps templates and route protection consistent. Still escape any user-supplied role or permission names you print yourself, even though the package now escapes its own flash and validation output.
- Can I choose which CSS framework the admin interface uses?
- Yes. The installer offers self-contained view sets for Bootstrap 4, Bootstrap 5, and Tailwind, and the Tailwind views ship inline SVG so no icon font is pulled in. Picking the set that matches your frontend limits collisions with your asset pipeline. If you use something else entirely, publish the views and restyle them.
- What changed to the JSON API middleware in v12, and why am I suddenly getting 403s?
- In v12 the JSON API middleware became config-driven: rolesAPIAuthEnabled, rolesAPIMiddlewareEnabled, and rolesAPIMiddleware (which defaults to role:admin) are now honored instead of being ignored. Any API consumer authenticating with a role not literally named admin will begin receiving 403s after upgrading. Set rolesAPIMiddleware to the gate you actually want before deploying; disabling the middleware lets any authenticated user read and create roles, so treat that only as a time-boxed exception.
- Why does an unauthorized request return 403 instead of 500 now?
- Denial handling changed from throwing a 500 to returning a proper 403, which is a correctness fix but a consumer-visible contract change. Contract tests that asserted 500 will fail, and clients that retried or suppressed 5xx responses will behave differently. Alerting keyed on 5xx rates also shifts, so update those expectations alongside the upgrade.
- Is the stored XSS issue in role and permission names fixed?
- Yes. Earlier v12.x releases interpolated role and permission names into translated strings containing markup and printed the result raw, so anyone permitted to name a role could store markup that executed in the next administrator's session. Flash and validation output are now escaped and composer audit reports clean. Upgrade if you are on any v12.x release that predates the fix.
- Is laravel-roles suitable for multi-tenant or ABAC-heavy authorization?
- It is built for application-level RBAC inside a standard Laravel monolith, not for per-tenant isolation or policy and attribute-heavy rule sets. Role levels and inheritance cover hierarchical checks, but multi-tenant scoping and a centralized decision point shared across services fall outside its scope. For those needs, combine Laravel policies with a tenancy package or a dedicated authorization service.
- How actively is jeremykenedy/laravel-roles maintained, and what should I watch when upgrading?
- The package is maintained by a single author, so a large major carrying a security fix lands as a single release with no second maintainer to hedge against. Pin the version, read the changelog before taking a major, and keep your own tests around the middleware and admin screens. Also set a team policy for how far declared-but-untested combinations such as Laravel 11 are allowed to drift.