Weave Code
Entrust Laravel Package
savannabits/entrust
Savannabits/Entrust adds role-based access control to Laravel, letting you assign roles and permissions to users via Eloquent traits, middleware, and Blade directives for simple authorization checks.
This package provides a flexible way to add Role-based Permissions to Laravel
Frequently asked questions about Entrust
- What is savannabits/entrust and how does it add roles and permissions to Laravel?
- Savannabits/Entrust is a community-maintained continuation of the abandoned zizaco/entrust package that provides trait-based role and permission management for Laravel. It stores roles, permissions, and their pivot relationships in dedicated database tables and exposes them through Eloquent traits like HasRole on your User model. You then enforce access with route middleware aliases and Blade directives such as @role and @permission. It is designed for conventional monolithic applications and admin back-ends that need flat or single-hierarchy RBAC.
- How do I install and set up savannabits/entrust in a Laravel application?
- Install the package with Composer using composer require savannabits/entrust, then publish the package migrations and run php artisan migrate to create the roles, permissions, role_user, and permission_role tables. Add the HasRole trait to your User model so roles and permissions can be assigned and checked. Finally, register the package middleware aliases in your HTTP kernel or bootstrap file and optionally seed baseline roles and permissions. The setup is low-ceremony and typically takes only a few minutes in a fresh Laravel 10 or 11 application.
- Which Laravel and PHP versions does savannabits/entrust 9.0 support?
- The v9.0.0 release explicitly targets Laravel 10 and Laravel 11, which places the package in the PHP 8.1+ range. Applications still on Laravel 9 or earlier, or on PHP below 8.1, are effectively stranded on the 8.x line. Since 8.x is no longer the maintained release, you should confirm your host application meets the Laravel 10 or 11 and PHP 8.1+ requirements before upgrading.
- How do I upgrade from savannabits/entrust 8.x to version 9.0?
- Pin the dependency to ^9.0, run composer update savannabits/entrust, and carefully review the diff on any published migrations and config files before applying new migrations. Because this is a major version bump, treat it as an application upgrade and run a full regression pass over every authorization path, including traits, middleware aliases, Blade directives, and direct Gate checks. Stage the upgrade on the target Laravel version first, and keep a documented rollback to 8.1.0 in case permission checks behave unexpectedly.
- Can I migrate from zizaco/entrust to savannabits/entrust?
- Yes, the table and trait naming is largely compatible because savannabits/entrust is a continuation of the original zizaco/entrust package. You should still validate the published migration set and update namespace imports before swapping the Composer dependency. Run your authorization test suite against a staging database to confirm role and permission checks behave identically after the swap.
- Does savannabits/entrust support multiple teams or multi-tenancy permission scoping?
- No, savannabits/entrust does not natively support teams, per-tenant roles, or multi-tenancy permission scoping. It is built for flat or single-hierarchy role-to-permission mapping in a single-tenant application. If your requirements include per-tenant roles, permission inheritance graphs, or API-token-scoped abilities, spatie/laravel-permission with its teams feature is generally a better fit. Entrust remains a defensible choice mainly for legacy continuity rather than greenfield multi-tenant architecture.
- How do I check roles and permissions in Blade templates and middleware with Entrust?
- Entrust provides Blade directives such as @role and @permission that let you conditionally render UI elements based on the authenticated user's assigned roles and permissions. For HTTP routes, register the package middleware aliases and apply them like role:admin or permission:edit-posts on your route groups. You can also use the trait methods on the User model for direct checks inside controllers and services. Always verify that the middleware aliases are registered in your HTTP kernel or bootstrap configuration before relying on them.
- How does permission caching work in savannabits/entrust and should I enable it in production?
- Entrust optionally caches the permission tables so repeated role and permission checks do not hit the database on every request, which is recommended for production workloads. The trade-off is that you must clear or refresh the cache whenever roles, permissions, or their assignments change. Because authorization correctness is security-sensitive, test cache invalidation paths carefully and document the cache-clearing step in your deployment runbook.
- Is savannabits/entrust actively maintained and safe for production use?
- Savannabits/entrust is a community fork of the dormant zizaco/entrust package and depends on a small maintainer base, so long-term support is not guaranteed. The 9.0.0 release documents only added Laravel 10 and 11 support, which makes the changelog opaque regarding other breaking changes or included security fixes. For production use, pin exact versions, review release diffs, run regression tests on all authorization paths, and record the maintenance risk as an accepted trade-off. There is no published CVE history or formal upgrade guide beyond the release notes.
- What are the alternatives to savannabits/entrust for Laravel role-based access control?
- The most common alternative is spatie/laravel-permission, which offers teams and multi-tenancy support, wildcard permissions, and a richer guard model. For simpler applications, native Laravel Gates and Policies may be sufficient without any third-party package. Entrust remains a reasonable choice when you need continuity with an existing Entrust installation or a zizaco/entrust migration, but a build-versus-buy comparison against spatie/laravel-permission is worth doing before starting greenfield work.
Weaver
How can I help you explore Laravel packages today?