Weave Code
Laravel Fluent Policy Laravel Package
soyhuce/laravel-fluent-policy
Define Laravel authorization policies as fluent, reusable method chains instead of repetitive gate checks. soyhuce/laravel-fluent-policy keeps access rules readable and composable, integrating with Laravel's Gate so complex permissions stay inline, testable, and easy to maintain.
Write fluent policies in Laravel
Frequently asked questions about Laravel Fluent Policy
- How do I install soyhuce/laravel-fluent-policy in a Laravel app?
- Install it with Composer using composer require soyhuce/laravel-fluent-policy, targeting the ^1.8 release if you are planning around Laravel 12. The package is Composer-only in the provided overview, with no published config, migrations, or service provider side effects. Confirm the installed composer.json constraint resolves against your PHP 8.2+ and Laravel version before converting policies.
- Does soyhuce/laravel-fluent-policy support Laravel 12?
- Version 1.8.0 adds Laravel 12 to the CI test matrix, which is the main forward-compatibility signal in that maintenance release. It reports no functional changes, deprecations, or breaking changes. Check the package's composer.json constraint rather than assuming CI coverage equals an explicit support commitment.
- What is the difference between fluent policies and standard Laravel policies?
- Standard Laravel policies are hand-written boolean methods on policy classes, while this package lets you express those rules as fluent, reusable method chains. The policies still sit on top of Laravel's native Gate/Policy resolver, so Gate, can(), authorize(), Blade @can, and form requests continue to work. The goal is readability and composition for complex permissions, not replacing Laravel's authorization pipeline.
- Can I migrate existing Laravel policies to soyhuce/laravel-fluent-policy incrementally?
- Yes. The package is additive: converted policies extend the package base class and gain fluent composition methods, while unconverted policies keep working unchanged. A sensible migration is to start with one low-risk, well-tested read-only policy, publish an internal convention, and then convert policies by domain.
- How do anyOf and allOf composition work in Laravel authorization policies?
- The fluent API lets you compose conditions and abilities with all-of and any-of style helpers instead of repeating gate checks. Any-of rules grant access when any composed condition passes, while all-of rules require every condition to pass. Because the failure mode is silent over-permission, review permissive compositions carefully and cover them with feature tests.
- Will soyhuce/laravel-fluent-policy preserve Laravel Gate before and after hooks?
- The package is designed as an additive layer over Laravel's native Gate/Policy resolver, so authorization calls continue through Gate. The 1.8.0 release is a maintenance release and reports no functional changes that would alter Gate behavior. If your application depends on before/after hooks or Gate::allows short-circuit semantics, add a focused integration test during migration to confirm the expected order.
- How do I return custom denial messages or HTTP status codes from fluent policies?
- The provided overview does not document Response-style denials with messages or status codes in the fluent API. If you rely on Laravel's denial Response objects, verify that the package supports expressing them before converting those abilities. Keep those cases covered by feature tests through Gate or authorize() so the exact response behavior stays pinned.
- Is soyhuce/laravel-fluent-policy safe to use for production authorization?
- Release risk for 1.8.0 is low: it is a maintenance update with Laravel 12 CI coverage and dependency bumps, with no reported breaking changes. The larger risks are structural: a small single-maintainer project, and an abstraction over a security-critical primitive where permissive composition can silently over-grant. Use it incrementally, require code review for policy changes, and keep authorization behavior covered by tests.
- How should I test policies written with soyhuce/laravel-fluent-policy?
- Test them through Laravel's normal authorization surface, using actingAs users and assertions around Gate, can(), authorize(), or HTTP responses from form requests. The provided material does not document dedicated assertion helpers, so standard Laravel feature tests are the safe baseline. Pay special attention to any-of and all-of compositions, since those are where permissive mistakes are easiest to introduce.
- What are alternatives to soyhuce/laravel-fluent-policy?
- The primary alternative is vanilla Laravel policies and Gate, with hand-written methods and explicit before/after hooks. That may be preferable if your team values audit-friendly plain policies or runs authorization outside Laravel's Gate. Choose the fluent package when readable, composable policy chains matter more than avoiding an extra small dependency.
Weaver
How can I help you explore Laravel packages today?