- What Laravel versions does Bouncer support, and can I use it with Laravel 10 or older?
- Bouncer officially supports Laravel 11+ as of v1.0.2. For Laravel 10 or older, downgrade to v1.0.1, but note that newer features (e.g., PHP 8.1+ optimizations) won’t be available. Test thoroughly in your CI/CD pipeline, as some Laravel 11+ dependencies may introduce breaking changes.
- How do I migrate from Laravel’s native Policies/Gates to Bouncer without breaking existing authorization logic?
- Bouncer integrates with Laravel’s native policies by default, so you can adopt it incrementally. Use `Bouncer::runAfterPolicies()` to ensure policies execute first, or `Bouncer::runBeforePolicies()` for Bouncer to override them. Start by assigning roles/abilities to users and testing alongside existing gates before fully replacing them.
- Does Bouncer support multi-tenancy, and how do I scope permissions to specific tenants?
- Yes, Bouncer includes built-in scoping for multi-tenancy. Use `Bouncer::forModel($model)` or `Bouncer::forTenant($tenantId)` to restrict checks to a specific tenant. For shared-hosting or SaaS, combine this with Laravel’s query scopes or middleware to ensure tenant isolation. Always validate tenant context in your application logic.
- Can I use Bouncer with custom database models or tables instead of the default schema?
- Bouncer supports custom models/tables via morph maps, but you’ll need to manually register them in migrations if not using the default `roles`, `abilities`, and `role_ability` tables. For complex setups, ensure your custom tables include `entity_id` and `entity_type` columns for polymorphic relationships. Check the `bouncer:prune` command to clean up orphaned records.
- How does Bouncer handle caching, and do I need to manually refresh permissions after updates?
- Bouncer caches permissions cross-request by default to improve performance. After updating roles/abilities (e.g., during migrations or admin actions), call `Bouncer::refresh()` to clear the cache. For high-traffic apps, consider caching strategies like Redis or database-level optimizations to reduce cache invalidation overhead.
- What happened to the ‘levels’ feature in Bouncer, and can I still use hierarchical permissions?
- Levels were removed in v1.0.0 as a niche feature with limited adoption. If you need hierarchical roles (e.g., admin > editor > user), implement a custom solution using `hasRole()` checks with parent-child relationships in your database. Alternatively, use abilities like `can('manage_content')` for granular control without hierarchy.
- How do I test Bouncer in my Laravel application, especially with Livewire or GraphQL (Lighthouse)?
- Test Bouncer using Laravel’s built-in testing tools. For Livewire, mock the `Bouncer` facade in your tests or use `actingAs()` with role/ability assignments. For Lighthouse/GraphQL, verify return types and mutations with `Bouncer::can()` checks. The package includes Workbench compatibility for real-app testing, ensuring it works with Laravel’s evolving features.
- Are there performance concerns with Bouncer in high-concurrency environments, and how can I optimize it?
- Bouncer is optimized for most use cases, but complex queries (e.g., checking thousands of abilities) may impact performance. Enable caching (`Bouncer::cache()`) and avoid unnecessary `allowEveryone()` rules. For high-scale apps, consider denormalizing permissions or using a dedicated permission service. Monitor query execution with Laravel Debugbar or Xdebug.
- How do I resolve conflicts between Bouncer permissions and Laravel Policies when they return conflicting results?
- Bouncer respects Laravel’s policy precedence by default. Use `Bouncer::runBeforePolicies()` to prioritize Bouncer checks or `runAfterPolicies()` to let policies decide first. For edge cases, combine both systems with custom logic, like `if (auth()->user()->can('admin_override') || Gate::allows('update', $post))`. Document your precedence rules in your authorization layer.
- What alternatives to Bouncer exist for Laravel RBAC/ABAC, and why should I choose this package?
- Alternatives include Spatie’s Laravel-Permission (simpler but less flexible) or Entrust (older, less maintained). Bouncer stands out for its fluent Eloquent API, hybrid RBAC/ABAC support, and seamless integration with Laravel’s native authorization (Policies/Gates). It’s ideal for apps needing fine-grained permissions, multi-tenancy, or caching, with minimal boilerplate.