Laravel Accessproof Laravel Package

Product Decisions This Supports

• Authorization risk reduction: Use Laravel AccessProof as a dev-only regression tool to reproduce and prevent tenant-selection, same-tenant object/role, and cross-tenant related-record authorization defects before release.
• Build vs. buy: Prefer adopting this package over building a custom authorization test harness, especially for Laravel 12/13 multi-tenant SaaS applications with role-based access rules.
• Release readiness: Add AccessProof scenarios to CI as a release gate for authorization-sensitive features, using isolated test databases and synthetic fixtures.
• Roadmap input: The v1.2.1 field report demonstrates nine real authorization defects reproduced in a private multi-tenant SaaS app, giving product and security teams concrete scenarios to prioritize in hardening work.
• Documentation alignment: Use the updated scenario cookbook and anonymized field report to align product requirements, security expectations, and engineering test coverage.
• Adoption confidence: The patch is backwards-compatible with no public API/runtime changes, and adds independent installation verification from stable Packagist and checked-out source.

When to Consider This Package

• You are building or maintaining a Laravel 12/13 application on PHP 8.3+.
• You need to test authorization behavior against actual application routes with disposable fixtures.
• You operate a multi-tenant SaaS or complex role/permission model where cross-tenant leakage and object-level authorization are material risks.
• You want a dev dependency that does not install authorization policies, crawl routes, or monitor remote side effects.
• You can run tests against isolated test databases with synthetic fixtures, including SQLite, MySQL 8, or PostgreSQL 16.
• You need CI verification that the package installs both from Packagist and from source, including watchRows() behavior with real SQLite records.

Look elsewhere if you need production runtime enforcement, comprehensive security certification, route crawling, remote side-effect monitoring, non-Laravel support, or if your team cannot maintain isolated test databases and synthetic fixtures. This is a scoped regression-testing field report, not a security certification.

How to Pitch It (Stakeholders)

For executives: Laravel AccessProof is a low-risk, dev-only testing package that helps catch costly authorization defects—especially cross-tenant data leaks—before they reach customers. The v1.2.1 release adds independent field validation: nine authorization defects were reproduced in a private multi-tenant SaaS app, and 34 tests / 86 assertions passed on SQLite and MySQL 8 after fixes. It is not a full security certification, but it materially improves release confidence at low adoption cost.

For engineering: Adopt via composer require --dev mykholy/laravel-accessproof:^1.2. The patch is backwards-compatible, leaves the public PHP API and runtime unchanged, and adds publication-quality checks that install the stable Packagist package and the checked-out source in independent Laravel 13 consumer jobs. Use it with isolated test databases and synthetic fixtures to exercise real routes and watchRows() scenarios.