Weave Code
Laravel Static Permission Laravel Package
sourceboat/laravel-static-permission
Laravel Static Permission lets you define permissions in code or configuration instead of database tables. Check access with familiar Gate, middleware, and Blade helpers—ideal for apps with fixed, predictable authorization rules and no permission-table overhead.
Define laravel permissions and roles by code
Frequently asked questions about Laravel Static Permission
- How do I install sourceboat/laravel-static-permission?
- Install it with Composer using composer require sourceboat/laravel-static-permission, then check whether the package supports auto-discovery and a publishable config file. Define your permission and role catalog in code or config as documented by the package. Before adopting it, verify the Laravel and PHP version constraints, CI status, and last release date because the package has no adoption signals.
- Does laravel-static-permission work with Laravel 10 and Laravel 11?
- That is not safe to assume from the provided context. Packages from the Laravel 5 through 8 era often break on Laravel 10 or 11 due to PHP 8 deprecations and framework changes. Inspect the composer.json constraints and test matrix, and run the suite against your target Laravel version before committing.
- How does laravel-static-permission integrate with Laravel Gate and Blade @can?
- The package is intended to plug into Laravel's native authorization layer, so controllers, middleware, Blade @can checks, and policies should remain familiar if it uses Gate or Gate::before. The key spike is to confirm it does not introduce a bespoke authorization API. If it stays Gate-based, the dependency is easier to swap or replace in-house.
- Do I need permission and role database tables with this package?
- No permission or role tables are required for the catalog because definitions live in code or configuration. That removes permission-row drift from the code that checks access. However, you must verify whether user-to-role assignments are also static or still need a database schema and migration path.
- Can I manage roles and permissions at runtime with an admin panel?
- This package is a poor fit for admin panels that let non-engineers create roles or grant permissions at runtime. Static definitions turn those changes into code edits and deploys, which is unsuitable for customer-configurable roles or tenant-defined scopes. Use it only when roles are genuinely fixed, such as admin, member, and viewer.
- Is laravel-static-permission maintained and safe for production?
- Treat it as a security-critical, low-scrutiny dependency: the assessment shows 0 stars, 0 dependents, and unproven maintenance cadence. Authorization bugs are silent and high impact, and with no dependents there is little evidence of production hardening or community CVE watching. The mitigating factor is that the code volume is likely small, so forking or reimplementing with native Gate may be cheap.
- How do I test static permissions in Laravel?
- Test the permission catalog and Gate behavior with Laravel's actingAs helper, Gate assertions, and feature tests around middleware and Blade directives. Also test edge contexts such as multi-guard setups, API token authentication, queued jobs, and console commands where no authenticated user exists. Confirm the package's own tests run on a modern PHP and Laravel matrix before relying on it.
- Does it support multiple guards, Sanctum API tokens, or queued jobs?
- There is no field evidence of behavior under multi-guard setups, Sanctum or API-token contexts, queued jobs, or console commands because the package has no dependents. In jobs and commands there is often no authenticated user, so permission checks need an explicit user or context. Validate all of these scenarios in a spike if your application uses them.
- How does laravel-static-permission behave with config:cache and Laravel Octane?
- Static configuration is generally compatible with config:cache, but you should verify whether the package reads permissions at boot or dynamically at check time. Under Laravel Octane, long-running workers can expose state leakage if any request-specific data is cached. Add tests for config caching, Octane workers, and queued jobs before production use.
- What are alternatives to laravel-static-permission?
- You can implement a small permission catalog with native Laravel Gate and policies, often using enums or config arrays, which avoids an unmaintained dependency in a security-critical path. If you need database-backed roles and runtime administration, evaluate Spatie Laravel Permission instead. Given the package's small scope and weak adoption signals, an in-house registry is a credible alternative.
Weaver
How can I help you explore Laravel packages today?