Weave Code
Laravel Security Model Laravel Package
onramplab/laravel-security-model
A Laravel package providing security for Eloquent model
Frequently asked questions about Laravel Security Model
- How does this package handle multi-tenant row-level security in Laravel?
- The package uses Eloquent global scopes to filter queries by tenant ID or user context, ensuring only authorized rows are returned. This integrates seamlessly with Laravel’s built-in Policies for fine-grained control. For complex scenarios, you can extend the trait or combine it with middleware for additional layers.
- Can I use this with Laravel’s built-in Policies instead of the package’s traits?
- Yes, the package is designed to complement Laravel’s Policies. You can use it alongside or instead of traits for security logic. The traits abstract common patterns (like row-level filtering), but Policies give you explicit control over authorization rules. Choose based on whether you prefer declarative traits or imperative middleware.
- Will this package slow down my Laravel application’s queries?
- Global scopes add minimal overhead, but poorly optimized queries can lead to N+1 issues. Always use `with()` or eager loading where needed. For read-heavy apps, consider caching filtered results with Redis or database views. Benchmark performance before scaling to production.
- Does this support field-level encryption for GDPR compliance?
- The package provides field-level permission logic but doesn’t include built-in encryption. For GDPR compliance, pair it with Laravel’s built-in encryption (e.g., `encrypt()`) or database-specific extensions like PostgreSQL’s `pgcrypto`. The package’s traits can then enforce who can read/write encrypted fields.
- How do I test security logic with global scopes and observers?
- Mock global scopes in unit tests by overriding the `boot()` method in your model’s test class. For observers, use Laravel’s `fake()` method to simulate events or manually trigger them. Pest or Laravel’s testing tools work well, but expect context-dependent tests (e.g., “User X can edit Model Y in Context Z”).
- Can I extend the package’s traits for custom permission rules?
- Yes, the traits are designed for extension. Override methods like `applyScopes()` or `authorizeFieldAccess()` in your model to add custom logic. For dynamic rules, combine with Laravel’s Policy methods or Gates. The package’s architecture encourages modularity while keeping security logic centralized.
- What Laravel versions and PHP requirements does this package support?
- The package requires Laravel 9+ and PHP 8.0+. Always check the latest `composer.json` for updates, as newer Laravel versions may introduce breaking changes. If you’re on an older version, consider alternatives like custom middleware or Policy-based solutions.
- How does audit logging work, and can I use queues for async logging?
- Audit logging relies on Eloquent Observers to trigger events on model changes. For async logging, manually dispatch events to Laravel Queues in the observer’s methods. The package doesn’t enforce async logging, but you can integrate it with Laravel’s queue system for performance-critical apps.
- What’s the difference between this package and implementing security via Middleware?
- Middleware is better for request-level security (e.g., API gateways), while this package focuses on model-level security (e.g., row/field permissions). Use Middleware for cross-cutting concerns like authentication, and the package for granular Eloquent model security. For hybrid approaches, combine both.
- Are there any known limitations with PostgreSQL or other databases?
- The package works with all Laravel-supported databases, but field-level encryption or complex queries may require database-specific tweaks. For example, PostgreSQL’s `pgcrypto` offers stronger encryption than MySQL’s `AES_ENCRYPT`. Always test edge cases like case-sensitive queries or custom collations.
Weaver
How can I help you explore Laravel packages today?