- What is musonza/groups and what group features does it provide?
- musonza/groups is a Laravel 5 package for adding user group functionality to an application. It provides Eloquent models, migrations, and relationships for groups, polymorphic members, invitations, join requests, and per-group roles and permissions. It is intended to save time on the persistence and relationship layer rather than provide a complete group management UI, API, or notification system.
- How do I install musonza/groups in a Laravel app?
- Installation is the standard Composer workflow: require the package, publish its config and migrations, add the Groupable trait to your User model, and run the migrations. The package is designed to integrate with existing Laravel auth scaffolding, policies, and gates. You will still need to build your own controllers, routes, and UI for invitations, join approvals, and permission checks.
- Does musonza/groups support Laravel 10 or Laravel 11?
- The package's last release was in February 2020, during the Laravel 5.5 to 6 era. Its illuminate dependency constraints almost certainly exclude Laravel 9, 10, and 11, and its PHP 7.x idioms may cause deprecations or failures on PHP 8.2 and newer. Treat Laravel version compatibility as a blocking question before adopting it for a modern application.
- How do I add a user to a group with musonza/groups?
- The package models group membership through Eloquent relationships and a polymorphic Groupable member model. In practice you attach a user to a group through the package's membership records, then query membership when authorizing actions. The exact method names should be checked against the package source and README for your installed version, because the package is not actively maintained.
- Does musonza/groups handle invitations and join requests?
- Yes, the package includes persistence for invitations and join requests, along with membership records. However, it does not ship the full application flow: you own the controllers, validation, policy checks, notifications, and edge-case handling. Developers should test duplicate joins, re-invitations, and orphaned invitations when users are deleted, since these behaviors are not backed by a broad user base.
- How are roles and permissions handled in musonza/groups?
- musonza/groups provides per-group roles and permissions at the membership layer, which is a lightweight RBAC-style model. It is suitable for simple role-in-group checks, but it does not natively support inherited roles, resource-scoped permissions inside a group, or hierarchical groups. If you need richer authorization semantics, the package schema is a starting point rather than a complete solution.
- Can I use UUID or ULID user keys with musonza/groups?
- The package was written for a Laravel 5-era Eloquent model and may assume conventional integer foreign keys in its migrations and relationships. If your users table uses UUIDs or ULIDs, you must review the published migrations and model keys before running them. Reconciling non-integer user keys is one of the main integration seams to validate early.
- Is musonza/groups actively maintained and safe for production?
- No, it is not actively maintained: the last release was in February 2020, with a single maintainer and low adoption. There is no stated security response process, CVE watch, or long-term support commitment. The code volume is small enough to audit and fork, which reduces black-box risk but also means you should seriously consider owning the code rather than depending on it.
- What are alternatives to musonza/groups for Laravel teams and organizations?
- For simple group membership, many teams implement a small internal schema with groups, memberships, invitations, and roles rather than adopting an abandoned package. For richer multi-tenant or organization features, consider a maintained teams or permissions package, or build on Laravel's native gates and policies. The right choice depends on whether groups are commodity plumbing or a core differentiator in your product.
- Does musonza/groups include notifications, events, APIs, or audit logs?
- No, the package stops at the persistence and relationship layer. It does not provide a domain event bus, notification layer, REST or GraphQL API, caching, or audit trail. Anything beyond basic CRUD with members, invitations, join requests, and roles is application code that your team owns.