- What is maxiviper117/laravel-access and what does it do?
- laravel-access is a Laravel package for explicit scoped authorization. It provides permission enums, polymorphic scopes, and a permission catalog with zero implicit state, so access is granted through stated permissions rather than inferred behavior. It fits Laravel applications that need role and permission management with a simple API.
- How do I install and configure laravel-access in a Laravel app?
- Install it with Composer as maxiviper117/laravel-access and pin 0.1.10 while the package is pre-1.0. A typical Laravel integration would publish config or migrations and register the service provider, but the provided excerpt does not document exact steps. Follow the repository README and verify the schema, registration API, and cache behavior in a scratch branch before enabling it in an app.
- Which Laravel and PHP versions does laravel-access support?
- The evaluation assumes PHP 8.x with Laravel 10, 11, or 12, but the provided material does not confirm the supported range. Check composer.json for exact PHP and illuminate/support constraints before adoption. Because the package is pre-1.0, also ask whether there is a stated 1.0 timeline or backward-compatibility policy.
- What are permission enums and polymorphic scopes in laravel-access?
- Permission enums are typed permission definitions, and polymorphic scopes let permissions be scoped to different model types or instances. Together they support explicit scoped authorization where grants are stated rather than inferred. The exact API and persistence schema are not shown in the excerpt, so confirm the details against the README.
- What are dynamic permission definitions in laravel-access v0.1.10?
- Dynamic permission definitions, added in v0.1.10, let permission catalog entries be introduced at runtime instead of being fixed only in config, seeders, or enum-like constants. That makes the catalog data rather than code and fits multi-tenant products, admin-configurable RBAC, and modular architectures where modules register permissions on boot. It also raises questions about persistence, the registration API, per-tenant catalogs, cache invalidation, and who can write definitions. Treat the write path as privileged and confirm whether changes are audited.
- Does laravel-access replace Laravel Gate and policies?
- The provided material does not state whether laravel-access layers on top of Laravel Gate::define and policies or replaces them. Dynamic definitions move the package closer to the Gate and policy layer as a source of truth, so the boundary needs to be documented. If you rely on hand-written Gate calls, spike a representative policy to check for a second competing permission registry or conflicts.
- Is laravel-access stable enough for production at version 0.1.10?
- Version 0.1.10 is pre-1.0, and under semver a 0.x minor release may contain breaking changes. A single feature release is not evidence of API stability, test coverage, or maintainer cadence, and the changelog gives no deprecation or migration notes. For production, pin the exact version, wrap package calls behind a thin internal AuthorizationService, and review CI status, open issues, and test coverage first.
- How does laravel-access handle cache invalidation and Laravel Octane?
- The provided material does not specify how laravel-access invalidates permission or role caches when a definition changes. Dynamic definitions almost always require invalidation, and stale authorization caches are a security-adjacent failure mode rather than only a performance issue. Confirm whether registration is boot-time only or genuinely runtime, whether it is idempotent across Octane and queue workers, and test invalidation before production.
- How do I migrate existing roles and permissions to laravel-access?
- Treat migration as a backfill project: import existing roles and permissions from seeders, config, or your current source of truth, then reconcile counts and diff the results before enabling the package. Pin 0.1.10, isolate calls behind an internal service, and enable dynamic definitions behind a flag for non-privileged use cases first. The provided material does not give a step-by-step migration recipe, so validate schema and cache behavior in a read-only spike.
- How do I test authorization with laravel-access?
- The provided excerpt does not include testing guidance. For evaluation, write feature tests that create roles and permissions, assert allowed and denied abilities, and cover dynamic definitions plus cache invalidation. Keep package calls behind a thin internal service so tests focus on your authorization contract and a future swap-out is a one-file change.