- How does this package differ from Laravel’s built-in Passport scopes?
- This package enforces *structured* scopes tied to resources and actions (e.g., `edit:post:draft`), unlike Passport’s flat scopes (e.g., `admin`). It integrates with Laravel’s policy system and provides a domain-driven design for granular OAuth2 authorization, reducing broad permissions like `manage_posts` to specific actions.
- Can I use this with Laravel 8 or Passport v9?
- No, this package targets Laravel 9+ and Passport v10+ due to architectural changes in those versions. If you’re on older versions, you’ll need to check for a compatible fork or evaluate alternatives like `spatie/laravel-permission`, which supports broader Laravel versions.
- Do I need to define custom models for resources and actions?
- Yes. The package expects you to create `Resource` and `Action` models/classes (e.g., `PostResource`, `DeleteAction`) to map permissions to your application’s domain. This follows domain-driven design principles but requires upfront modeling effort for complex systems.
- How do I migrate existing Passport scopes to this system?
- Start by auditing your current scopes to identify gaps (e.g., replace `admin` with `admin:posts:delete`). Define new `Resource`/`Action` models, then update token scopes incrementally. Use `Passport::tokens()->update()` to backfill existing tokens, and phase out old scopes via middleware.
- Will this work with Laravel’s native policies?
- Yes, the package bridges with Laravel’s policy system via `AuthorizationServiceProvider`. You can use it alongside or instead of policies, depending on your needs. For example, validate a `DeletePost` action via both a policy *and* the resource/action scope.
- How do I handle dynamic or nested resources (e.g., `post/comment/reply`)?
- The package doesn’t natively support nested resources, but you can model them hierarchically (e.g., `CommentResource` with a `post_id` foreign key). For dynamic scopes, override the `getScope()` method in your `Token` model or use middleware to resolve scopes at runtime.
- Is there a performance impact from scope resolution during token validation?
- Yes, scope resolution adds overhead during token creation/validation. Mitigate this by caching `Resource::actions()` or using Laravel’s query caching. For high-traffic apps, benchmark with tools like Laravel Debugbar to identify bottlenecks.
- Can I use this for API token authentication without OAuth2?
- No, this package is designed for OAuth2 flows via Laravel Passport. If you’re using API tokens without scopes (e.g., `Bearer` tokens), consider alternatives like `spatie/laravel-permission` or Laravel’s built-in gates/policies.
- What if I need to manage scopes via a UI (e.g., admin panel)?
- This package doesn’t include a UI or API for scope management—you’ll need to build custom admin routes or use companion packages like `spatie/laravel-permission` for pre-built interfaces. The focus here is on the authorization logic, not the management layer.
- How do I test scope validation logic in my application?
- Unit test scope resolution by mocking `Token` objects and `Resource`/`Action` models. Use Laravel’s `Passport::actingAs()` to simulate authenticated requests, then assert scope validation with `authorize()` or custom middleware. Integration tests should cover edge cases like expired tokens or missing resources.