- What is pktharindu/nova-permissions used for?
- It is a Laravel Nova package that adds Nova resources and tooling for creating, editing, and assigning roles and permissions, giving administrators a simple UI for user access control. It is an admin surface over role and permission data, not an authorization engine, so enforcement still lives in your policies and gates. The separation it encourages is permissions in code (versioned, PR-reviewed, deployed atomically) and roles in the database (runtime, ops-owned).
- Does pktharindu/nova-permissions support Laravel Nova 5?
- Yes, Nova 5 support was added in v3.1.0. Be aware that the claim comes from a single pull request with no clearly visible CI matrix in the release notes, and that Nova 5 support shipped as a minor release rather than a major. Pin the exact version and test your Nova upgrade path rather than trusting semver alone.
- How do I install nova-permissions in a Laravel app?
- Install with Composer, publish the config and migrations, run the migrations, seed your permission catalogue, and register the Nova tool. The mechanical work is measured in hours to days for a pilot. The real cost is modelling: enumerating permissions per Nova resource and action, then rewriting every policy to consult them.
- Does installing nova-permissions actually enforce permissions?
- No. Installing the package does not add permissions or enforcement on its own; nothing is enforced until your policies and gates call into it. Treat it as a UI and data layer over roles and permissions. If you install it and expect access control to appear automatically, you get an unenforced admin panel.
- Does nova-permissions depend on spatie/laravel-permission?
- It is described as a Nova UI layer over spatie/laravel-permission for managing roles and permissions. However, the v3.1.0 release notes show no PHP dependency changes, so the underlying engine's identity and version constraint are not confirmed there. Check composer.json directly and decide who on your team owns upgrading that transitive dependency.
- Does nova-permissions support multiple guards and teams?
- This is not documented in the available release information. spatie/laravel-permission itself supports guards and teams, but whether this package's Nova UI surfaces those features is unconfirmed. If your app relies on multi-guard or team-scoped permissions, validate it in a pilot before committing.
- What is the super-admin bypass risk with Nova permissions?
- An unscoped Gate::before remains the classic source of silent, global over-permissioning in Laravel. This package does not fix or guard against that; it only gives you a UI for roles and permissions. Audit any Gate::before you have and scope it tightly before shipping.
- Is there an audit trail for role and permission changes in nova-permissions?
- No audit trail is documented. The package lets administrators change role and permission data through Nova, but there is no stated logging of who changed what and when. If you need that for compliance or least-privilege review, add your own model observers or event logging.
- Can I use nova-permissions without Laravel Nova?
- No. It is Nova-coupled by design, contributing Nova resources and tooling, and there is no reuse outside Nova. If Nova is not already your admin layer, the architecture does not fit cleanly. In that case use spatie/laravel-permission directly or pick a non-Nova admin panel.
- Is nova-permissions actively maintained and safe for production?
- It has roughly 136 stars, no dependents, and a single maintainer, so you are an early adopter. Most of the v3.1.0 changes were dependabot npm bumps in the build toolchain, several tied to published advisories; confirm none reach the compiled assets shipped in dist/. There is no visible security disclosure process, so pin exact versions, review diffs, and be ready to fork.