Weave Code
Lumki Laravel Package
kineticamobile/lumki
Lumki is a Laravel package by Kineticamobile for building modular admin panels and CRUD interfaces. It offers a lightweight, customizable foundation for managing resources, forms, and data with less boilerplate, making it easier to add back-office tools to Laravel applications.
Laravel 8 Users Management. Add-on to Jetstream, using spatie/laravel-permissions & lab404/laravel-impersonate
Frequently asked questions about Lumki
- What is kineticamobile/lumki and what does it do?
- Lumki is a Laravel 8 package by Kineticamobile that provides users, roles, and permissions management as an add-on to Laravel Jetstream. It relies on spatie/laravel-permission for the authorization model and lab404/laravel-impersonate for session impersonation. In practice it compresses the admin CRUD work around users, roles, and permissions into a much shorter build. It is an opinionated scaffold rather than a general-purpose user-management library.
- Does Lumki require Laravel Jetstream?
- Yes, Lumki is explicitly layered on top of Laravel Jetstream, so a Jetstream-based application is effectively a prerequisite. If your app uses a bespoke auth flow, Sanctum-only API tokens, or an existing admin panel, Lumki introduces a second competing source of truth for users and roles. In that case the fit is poor and adopting it is likely a net negative. Confirm whether your Jetstream install uses the Livewire or Inertia stack before committing, because Lumki's published views target one of them.
- Which Laravel versions does Lumki support?
- Lumki targets Laravel 8, which reached end of security fixes in January 2023. Adopting it today means either pinning your host application to an unsupported framework version or owning a forward-port yourself. There is no guarantee of an upstream branch supporting Laravel 10 or 11. Check the repository for maintained forks if you need a current framework.
- How do I install Lumki with Composer?
- Installation is standard Composer fare: require kineticamobile/lumki, publish its config and migrations, and run the spatie/laravel-permission migrations. You also need to register the impersonation middleware and route guards that lab404/laravel-impersonate provides. The real effort sits in the seams rather than the install command, so budget time for verifying what Lumki publishes and which tables it touches.
- Does Lumki work with spatie/laravel-permission?
- Yes, spatie/laravel-permission is a hard dependency and forms Lumki's entire authorization model. That means roles and permissions live in the standard Spatie tables, and any existing role data must be reconciled and backfilled if you retrofit Lumki into an application that already has its own role model. That reconciliation is a data migration with security consequences if assignments are mapped incorrectly. Plan and test it carefully.
- How does user impersonation work in Lumki?
- Lumki uses lab404/laravel-impersonate, which swaps the authenticated session to another user via a dedicated route and middleware. Because impersonation is a privilege-escalation surface, you should verify that it is gated by a policy or permission and that every event logs the actor, subject, and timestamp. Small, low-audit codebases handling impersonation warrant extra scrutiny before production use. Add your own audit logging if the package does not provide it.
- Is Lumki compatible with Filament, Nova, or Backpack?
- Running Lumki alongside Filament, Nova, or Backpack generally means two competing sources of truth for users and roles, which is a net negative for maintainability. If you already have an admin panel, its native user management is almost always the cheaper safe path. Lumki is best treated as a greenfield accelerator for Jetstream-based projects, not a retrofit tool.
- What license does Lumki use and can I use it commercially?
- GitHub reports the license as NOASSERTION, meaning no recognized OSI license was detected in the repository. Absent an explicit license, default copyright applies and the terms of use inside a commercial product are legally undefined. This is a legal-review gate, not an engineering detail, so get written clarification from the maintainer before shipping. Do not assume permissive use or redistribution rights.
- Is Lumki safe to use in production?
- Treat it with caution: it is a low-adoption package (around 71 stars, small contributor base) whose core value is granting roles and impersonating users, which is exactly the privilege-escalation surface to be most conservative about. Verify authorization gating and audit logging for impersonation events, and confirm whether the package alters the users table or operates purely additively. Given limited third-party scrutiny, plan to treat the codebase as internal-forever rather than a maintained upstream. A fork you own is a realistic end state.
- Is Lumki actively maintained, and what are the alternatives?
- Expect a probable single maintainer, low issue triage, and no guaranteed forward-port beyond Laravel 8. Check commit cadence and issue response time over the last twelve months before committing, and look for maintained forks if you need Laravel 10 or 11. Alternatives include building on Spatie permissions directly, using Filament or Nova for admin CRUD, or extracting Lumki's patterns such as the policy structure and impersonation guard. For most teams, the cheapest safe path is a thin in-house admin layer rather than this dependency.
Weaver
How can I help you explore Laravel packages today?