- What is lake/larke-admin and what features does it include?
- Larke Admin is a Laravel package that provides a ready-made admin API plus backend scaffolding: JWT authentication, RBAC with admins, groups, roles, permissions and menus, user and menu management, attachment and file handling, and CRUD tooling. It registers its own service provider, config, migrations and routes, and returns responses in a fixed {code, msg, data} envelope. A separate Vue frontend consumes the API, so the package covers the backend half of a decoupled admin panel.
- Which Laravel and PHP versions does larke-admin support?
- The package targets modern Laravel releases, commonly reported as Laravel 9 through 11 with PHP 8.1+, but you should confirm the exact constraint range in its composer.json before committing. Because it ships migrations and its own middleware, the supported Laravel majors effectively become your supported majors. If your application is pinned to an older or newer framework version, verify compatibility in a scratch branch first.
- How do I install lake/larke-admin in a Laravel application?
- Install with composer require lake/larke-admin, then publish the package config and migrations, run php artisan migrate, and seed the initial admin data. The service provider auto-registers routes and middleware aliases, so you reach the admin API under its configured prefix. After that, authenticate against the admin endpoint, exercise one CRUD resource, and test a permission-denied case to confirm the RBAC layer is wired correctly. Budget roughly one to three days for a full spike.
- Does larke-admin use tymon/jwt-auth or is its JWT implementation hand-rolled?
- The package ships JWT authentication as part of its own auth layer, but the README does not make the underlying token library obvious, so read composer.json and the auth middleware before you rely on it. If it is built on a maintained library such as tymon/jwt-auth or lcobucci/jwt, security patches flow through Composer; if it is hand-rolled, you inherit responsibility for reviewing signing, validation and expiry logic. Either way, treat the token issuance path as security-critical code and read it line by line.
- Will lake/larke-admin conflict with Sanctum, Passport or spatie/laravel-permission?
- It can. The package brings its own JWT guard and its own RBAC tables, so it may collide with auth.php defaults, existing middleware groups, and any permission system you already run. It is not designed to sit alongside spatie/laravel-permission, and running both permission models in one app creates two sources of truth. Before adopting it, verify guard coexistence in a branch and keep the admin identity separate from your customer or user model.
- Do I have to use the bundled Vue admin UI to use larke-admin?
- No, but you do have to solve the UI yourself. The admin interface lives in a separate frontend repository, not in the Composer package, so you either source, build, host and maintain that SPA or build your own UI against the package API. That frontend cost is a real line item that package evaluations often miss. Confirm the frontend license is compatible with your product before shipping it.
- Can I use only the RBAC permission layer without the JWT authentication?
- Realistically, no. The package granularity is coarse: authentication and authorization ship together, and there is no clean, supported way to take permissions alone. If you already standardize on Sanctum or Passport plus spatie/laravel-permission, adopting larke-admin means forking or wrapping its auth layer. A safer pattern is to keep the package behind routes and controllers you own, so replacing it later is an adapter rewrite rather than a product rewrite.
- Is larke-admin production-ready, and how risky is the dependency?
- It is a working system with an Apache-2.0 license and an April 2025 release, but the project has a bus factor of one, a few hundred stars and effectively no third-party dependents, so there is little soak testing behind it. You will likely be the first production user of several code paths, and the documentation is primarily Chinese, so subtleties such as permission inheritance and menu-permission binding get inferred rather than read. Treat it as a strong starting point for internal back-office tooling, not as an audited auth provider, and gate adoption behind a security review.
- Does larke-admin support token refresh, revocation and SSO or OIDC?
- Refresh, revocation, blacklisting and secret rotation behavior is not spelled out in the overview, so verify it in the token service before you depend on it, especially if you rotate signing secrets. There is no indication of SSO or OIDC support; it is a standalone admin identity system. If your organization requires SSO or compliance audits, this package is a poor fit and you should plan for a different auth layer.
- Does larke-admin work with PostgreSQL, and are its migrations portable?
- The overview does not commit to a database, and Laravel packages of this type often ship MySQL-flavored migrations, so check the migration files for engine-specific SQL and hardcoded table prefixes before assuming Postgres support. Run migrate against a scratch Postgres database as part of your spike. If you find MySQL-only constructs, plan to fork the migrations rather than patch them at runtime. Redis is worth having available for cache and queues regardless.