Ownable Laravel Package

Getting Started

Install via Composer: composer require sowailem/ownable. The package adds an Ownable trait to models that enforces ownership at the database level using owner_type and owner_id columns (polymorphic relationship). Begin by adding the trait to any model requiring ownership control, then run php artisan migrate — the package ships with a migration that adds the required columns to your tables (now following Laravel naming conventions as of v1.0.6). The first use case is typically protecting resource updates/deletes: only the assigned owner (e.g., User) should be allowed to modify their own records. Additionally, v1.0.6 introduces the @owns Blade directive for clean ownership-based template conditionals.

Implementation Patterns

• Policy Integration: Combine with Laravel Policies by checking $user->can('update', $model) — the trait automatically scopes queries via whereBelongsToUser($user) helper methods (e.g., Post::whereBelongsToUser($user)->get()).
• Auto-assignment on Creation: In controller logic, set ->owner() or assign owner_id before saving (e.g., $post->owner()->associate($user)). Use middleware or policy before/after hooks to enforce this consistently.
• Multi-tenant Scoping: For per-tenant ownership (e.g., teams), use the owner_type polymorphic field to support different owner models like Team, Organization, or User — query with ->ownedBy($ownerModel) to filter across owner types.
• Soft Deletes Compatibility: The trait is compatible with SoftDeletes; deleted records are still scoped by owner, ensuring no leakage across users’ soft-deleted items.
• Blade Integration (NEW): Use the @owns directive to conditionally render content based on ownership:

  @owns($post)
    <button>Edit Post</button>
  @endowns
  

  This internally calls $post->isOwnedBy(auth()->user()) and is especially useful for layout-level access control.

Gotchas and Tips

• Default Owner Scope: By default, Eloquent queries do not auto-scope by owner — you must explicitly use helpers like ownedBy($owner) or whereBelongsTo($user); forgetting this can leak data in public endpoints.
• UUID Support: If using UUIDs for IDs, ensure owner_id is stored as string (not unsignedBigInteger) — configure via config/ownable.php or override the trait’s getOwnerIdColumn() method.
• Testing Pitfall: Unit tests may fail ownership checks if factories don’t set owner_id; use ->for($user) in factories or set ->owner()->associate($user) explicitly in test fixtures.
• Performance Note: Polymorphic joins (owner_type + owner_id) can cause slowdowns on large tables; consider adding composite index ['owner_type', owner_id]` manually if needed.
• Extensibility: Override trait methods like isOwnedBy($user) for custom logic (e.g., admin bypass), or extend OwnableServiceProvider to register global scopes.
• Facade Fix (v1.0.6): A critical typo in the facade accessor has been corrected — ensure you’re not manually referencing the old (broken) accessor in service provider bindings or custom code.
• Missing Import (v1.0.6): OwnerContract is now properly imported — if you’ve implemented custom traits or extensions, ensure use Sowailem\Ownable\Contracts\OwnerContract; is included.