- How do I install nahid/permit in a Laravel application?
- Install it with Composer, then review the package's service provider, configuration, and migration steps before running migrations in production. Validate supported Laravel/PHP versions, auth guard compatibility, and middleware semantics in a sandbox first. Because authorization is security-sensitive, avoid direct coupling in controllers or models until the integration is proven.
- Which Laravel and PHP versions does nahid/permit support?
- The provided context does not list exact Laravel/PHP version constraints, so verify them in the package's composer.json and README before installing. Pin a specific version and run CI against the minimum and maximum Laravel/PHP versions you plan to support. The last release noted in the assessment is 2024-02-13, so confirm compatibility with your target framework.
- How does nahid/permit model roles, permissions, and user assignments?
- The package manages roles and permissions and lets you assign them to users, but the provided context does not document the exact schema or relationship model. Inspect the migrations and Eloquent models to confirm how roles, permissions, and user assignments are stored. Also verify guard scoping, wildcard behavior, and super-admin bypass before relying on it.
- Does nahid/permit replace Laravel Gate and Policy?
- No, it should not replace Laravel's native Gate and Policy system as your architectural reference. Treat nahid/permit as an implementation accelerator and keep Gate/Policy as the fallback until parity is proven. For complex domains, wrap the package behind an internal AuthorizationService interface so domain code does not depend on it directly.
- Can I use nahid/permit for API-only or Sanctum/token guards?
- It may work for API-only services, but the provided assessment says to confirm token and Sanctum guard support and response behavior explicitly. Validate middleware semantics and how unauthorized API requests are returned before committing. For policy-heavy APIs, prefer Laravel Gate/Policy or wrap the package behind an internal service.
- How should I handle permission caching and invalidation with nahid/permit?
- Permission caching is a high-risk area with this package, and stale permissions are both a correctness and security problem. Validate that cache invalidation is deterministic when roles or permissions change, and test with large role/permission sets and multiple guards. Monitor query overhead and N+1 patterns if checks are not cached.
- Is nahid/permit suitable for multi-tenant or hierarchical authorization?
- It is a weaker fit for multi-tenant, hierarchical, or attribute-based authorization unless the package's data model and extension points are proven. Multi-tenancy, guard scoping, wildcards, and super-admin bypass are called out as high-risk areas requiring explicit validation. Use Laravel Gate/Policy or a custom authorization strategy for policy-heavy domains.
- How do I test nahid/permit in CI and before production rollout?
- Pin a specific package version and run CI against the minimum and maximum Laravel/PHP versions you support. Test representative roles, guards, middleware ordering, database engines, and cache drivers, and compare behavior against your current authorization in shadow mode. Pilot on a non-critical module behind a feature flag before production rollout.
- What are the maintenance and security risks of using nahid/permit?
- The assessment notes low adoption signals: 74 stars, a last release on 2024-02-13, and a provided score of 1.26. Expect community-only support with no SLA, so assign a named maintainer, track advisories, and budget for fork or patch work. Do not adopt without an explicit vendor-risk exception and an exit plan.
- What is the migration path away from nahid/permit if it is abandoned?
- Wrap nahid/permit behind an internal AuthorizationService interface so domain code does not depend on it directly. Inventory existing roles, permissions, and route checks, map them to the package schema, and use dual-read or shadow-mode comparison before migrating one low-risk module behind a feature flag. Preserve a fallback to Laravel Gate/Policy until parity is proven, and document a rollback and replacement path.