spatie/laravel-permission
Manage roles and permissions in Laravel using database-backed models integrated with Laravel’s Gate. Assign roles to users, grant permissions directly or via roles, and authorize actions with the familiar can() checks. Includes docs for setup and usage.
Downgraded PHP requirement to 8.3.
Full Changelog: https://github.com/spatie/laravel-permission/compare/7.2.4...7.3.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/7.2.3...7.2.4
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.24.1...6.25.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/7.2.1...7.2.2
Full Changelog: https://github.com/spatie/laravel-permission/compare/7.1.0...7.2.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/7.0.0...7.1.0
The aim for v7 is to modernize the codebase while keeping the upgrade path easy. Modern PHP/Laravel features, Pest tests, but no big architectural changes. A future v8 could then tackle larger changes and streamline the package more fundamentally.
PackageServiceProvider from spatie/laravel-package-toolsEvent suffix (PermissionAttached → PermissionAttachedEvent, etc.)Command suffix (CacheReset → CacheResetCommand, etc.)is_a($this, X::class) → $this instanceof Xget_class($obj) → $obj::classstrpos($x, $y) !== false → str_contains($x, $y)WildcardPermissionuse imports for global classesclearClassPermissions() method__construct from Wildcard contractFull Changelog: https://github.com/spatie/laravel-permission/compare/6.24.1...7.0.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.24.0...6;24.1
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.24.0...6.24.1
null as array key by @jnoordsij in https://github.com/spatie/laravel-permission/pull/2904Full Changelog: https://github.com/spatie/laravel-permission/compare/6.23.0...6.24.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.22.0...6.23.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.21.0...6.22.0
removeRole method by @TobMoeller in https://github.com/spatie/laravel-permission/pull/2859teams-permissions.md by @dualklip in https://github.com/spatie/laravel-permission/pull/2863Full Changelog: https://github.com/spatie/laravel-permission/compare/6.20.0...6.21.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.19.0...6.20.0
collectPermissions that is not being assigned" by @erikn69 in https://github.com/spatie/laravel-permission/pull/2851Full Changelog: https://github.com/spatie/laravel-permission/compare/6.18.0...6.19.0
permission. prefix on wildcard_permission key by @jerrens in https://github.com/spatie/laravel-permission/pull/2835collectPermissions that is not being assigned by @JHWelch in https://github.com/spatie/laravel-permission/pull/2840Full Changelog: https://github.com/spatie/laravel-permission/compare/6.17.0...6.18.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.16.0...6.17.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.15.0...6.16.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.14.0...6.15.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.13.0...6.14.0
loadMissing('permissions') when the relation is needed, and test with Model::preventLazyLoading() by @erikn69 in https://github.com/spatie/laravel-permission/pull/2776Full Changelog: https://github.com/spatie/laravel-permission/compare/6.12.0...6.13.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.11.0...6.12.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.10.1...6.11.0
6.10.0 : "Can no longer delete permissions" by @erikn69 in https://github.com/spatie/laravel-permission/pull/2759Full Changelog: https://github.com/spatie/laravel-permission/compare/6.10.0...6.10.1
GuardDoesNotMatch should accept collection by @erikn69 in https://github.com/spatie/laravel-permission/pull/2748cache key exists and forgetCachedPermissions fails by @erikn69 in https://github.com/spatie/laravel-permission/pull/2707Larastan in dev by @drbyte in https://github.com/spatie/laravel-permission/pull/2755Full Changelog: https://github.com/spatie/laravel-permission/compare/6.9.0...6.10.0
->withPivot() for teamed relationships (allows getPivotColumns()) by @juliangums in https://github.com/spatie/laravel-permission/pull/2679$role->hasPermissionTo() to include BackedEnum by @drbyte co-authored by @SanderMuller$guard_name can be an array by @angelej in https://github.com/spatie/laravel-permission/pull/2659Full Changelog: https://github.com/spatie/laravel-permission/compare/6.8.0...6.9.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.7.0...6.8.0
6.5.0Full Changelog: https://github.com/spatie/laravel-permission/compare/6.6.0...6.7.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.5.0...6.6.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.4.0...6.5.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.3.0...6.4.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.2.0...6.3.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.1.0...6.2.0
Reset teamId on Octane by @erikn69 in https://github.com/spatie/laravel-permission/pull/2547
NOTE: The \Spatie\Permission\Listeners\OctaneReloadPermissions listener introduced in 6.0.0 is removed in 6.1.0, because the logic is directly incorporated into the ServiceProvider now.
Thanks @jameshulse for the heads-up and code-review.
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.0.1...6.1.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/6.0.0...6.0.1
[@haspermission](https://github.com/haspermission) directive by @axlwild in https://github.com/spatie/laravel-permission/pull/2515Full Changelog: https://github.com/spatie/laravel-permission/compare/5.11.1...6.0.0
No functional changes. Just several small updates to the Documentation.
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.11.0...5.11.1
eloquent.retrieved event by @erikn69 in https://github.com/spatie/laravel-permission/pull/2490Full Changelog: https://github.com/spatie/laravel-permission/compare/5.10.2...5.11.0
permission:show Command by @erikn69 in https://github.com/spatie/laravel-permission/pull/2457Full Changelog: https://github.com/spatie/laravel-permission/compare/5.10.1...5.10.2
permission:show output of roles with underscores by @erikn69 in https://github.com/spatie/laravel-permission/pull/2396Full Changelog: https://github.com/spatie/laravel-permission/compare/5.10.0...5.10.1
Apologies for the break caused by 5.9.0 !
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.9.0...5.9.1
permission- prefix to publish tag names by @sedehi in https://github.com/spatie/laravel-permission/pull/2301getPermissionsWithRoles method. by @xiCO2k in https://github.com/spatie/laravel-permission/pull/2316Full Changelog: https://github.com/spatie/laravel-permission/compare/5.8.0...5.9.0
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.7.0...5.8.0
Role model (ref Model::preventAccessingMissingAttributes()) by @juliomotol in https://github.com/spatie/laravel-permission/pull/2227Full Changelog: https://github.com/spatie/laravel-permission/compare/5.6.0...5.7.0
hasAllPermissions() if the permission name does not exist by @mtawil in https://github.com/spatie/laravel-permission/pull/2248Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.16...5.6.0
for loop in WildcardPermission by @SubhanSh in https://github.com/spatie/laravel-permission/pull/2113Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.15...5.5.16
Autocomplete all Blade directives via Laravel Idea plugin
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.14...5.5.15
FIXED BREAKING CHANGE. (Sorry about that!)
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.13...5.5.14
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.12...5.5.13
Compatibility Bugfix
MissingAttributeException for guard_name by @ejunker in https://github.com/spatie/laravel-permission/pull/2216Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.8...5.5.9
HasRoles trait
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.7...5.5.8
Optimize HasPermissions trait
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.6...5.5.7
Just a maintenance release.
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.5...5.5.6
Fix regression introduced in 5.5.10
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.11...5.5.12
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.10...5.5.11
DIFull Changelog: https://github.com/spatie/laravel-permission/compare/5.5.9...5.5.10
${var} string interpolation deprecation by @Ayesh in https://github.com/spatie/laravel-permission/pull/2117getKey, getKeyName instead of id by @erikn69 in https://github.com/spatie/laravel-permission/pull/2116Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.4...5.5.5
Super Admin on teams by @erikn69 in https://github.com/spatie/laravel-permission/pull/1845role_id,permission_id #1823This package now requires PHP 7.2.5 and Laravel 6.0 or higher. If you are on a PHP version below 7.2.5 or a Laravel version below 6.0 you can use an older version of this package.
$guard parameter may be passed to RoleMiddleware, PermissionMiddleware, and RoleOrPermissionMiddleware. See #1565users relationship type to BelongsToManydisplay_role_in_exceptionpermission:show command uses configured modelsTrying to access array offset on value of type null in #1370hasAnyRole()guardName to Exception PermissionDoesNotExist #1316permission:show CLI command to display a table of roles/permissionsremoveRole now returns the model, consistent with other methods$guarded properties updated to protectedThis is in preparation for compatibility with Laravel 5.8's cache TTL change to seconds instead of minutes.
NOTE: If you leave your existing config/permission.php file alone, then with Laravel 5.8 the 60 * 24 will change from being treated as 24 hours to just 24 minutes. Depending on your app, this may or may not make a significant difference. Updating your config file to a specific DateInterval will add specificity and insulate you from the TTL change in Laravel 5.8.
Refs:
https://laravel-news.com/cache-ttl-change-coming-to-laravel-5-8 https://github.com/laravel/framework/commit/fd6eb89b62ec09df1ffbee164831a827e83fa61d
saved event from firing on all subsequent models when calling assignRole or givePermissionTo on unsaved models. However, it is preferable to save the model first, and then add roles/permissions after saving. See #971.getCacheKey method in HasPermissions trait to getPermissionCacheKey for clearer specificity.php artisan permission:cache-resetThe following changes are not "breaking", but worth making the updates to your app for consistency.
config/permission.php file changed to move cache-related settings into a sub-array. You should review the changes and merge the updates into your own config file. Specifically the expiration_time value has moved into a sub-array entry, and the old top-level entry is no longer used.app or tests are clearing the cache by specifying the cache key, it is better to use the built-in forgetCachedPermissions() method so that it properly handles tagged cache entries. Here is the recommended change:- app()['cache']->forget('spatie.permission.cache');
+ $this->app->make(\Spatie\Permission\PermissionRegistrar::class)->forgetCachedPermissions();
roles and permissions relations (respectively) are now automatically reloaded after an Assign/Remove role or Grant/Revoke of permissions. This means there's no longer a need to call ->fresh() on the model if the only reason is to reload the role/permission relations. (That said, you may want to call it for other reasons.)Route::role() and Route::permission() middleware helper functionsrole_or_permission middleware to allow specifying "or" combinationssaved callback.[@elserole](https://github.com/elserole) directive:[@role](https://github.com/role)('roleA')
// user hasRole 'roleA'
[@elserole](https://github.com/elserole)('roleB')
// user hasRole 'roleB' but not 'roleA'
[@endrole](https://github.com/endrole)
role scope[@unlessrole](https://github.com/unlessrole)/[@endunlessrole](https://github.com/endunlessrole) Blade directivespermission:create-role command to create optionally create-and-link permissions in one command. Also now no longer throws an error if the role already exists.model_id by defining new columns array with model_morph_key key in config file. This improves UUID compatibility as discussed in #777.Changes related to throwing UnauthorizedException:
BEST NOT TO USE v2.7.7 if you've changed tablenames in the config file.
HasPermissions::getStoredPermission to allow a collection to be returned, and to fix query when passing multiple permissionshasAnyPermission to take an array of permissionsHasRole::assignRole and HasRole::syncRoles to accept role id's in addition to role names as argumentsGate::before for custom gate callbacksup migration for permission tablesGate::before for custom gate callbacksUnauthorizedException (which raises an HttpException with 403 response)PermissionRegistrar to use $gate->before()log_registration_exception as it is no longer relevantPermissionRegistrar to use $gate->before()log_registration_exception as it is no longer relevantRoles and Permissions got detached when soft deleting a modelpermission scope[@hasanyrole](https://github.com/hasanyrole) and [@hasallroles](https://github.com/hasallroles) Blade directivesPermissionMiddleware and RoleMiddlewarehasAnyPermission to take an array of permissionscreate-permission and create-role commandshasanyrole and hasallrole can accept multiple roleshasPermissionTo wouldn't use the right guard namemodel_type to the primary key of tables that use a polymorphic relationshiprole()/permission() relation to user models would be saved incorrectlyusers() relation on Permission and RoleforeignKey and relatedKey in the relationsHasRoles traithasPermission methodlaravel-permission to permission.hasAnyPermissionlog_registration_exception in settings fileid when using the role scopehasDirectPermission method is now publicRole scopeboot method in SP to solve some compatibility problems with other packagesgivePermissionTo and assignRole in Laravel 5.1** this version does not work in Laravel 5.1, please upgrade to version 1.5.1 of this package
givePermissionTo to accept multiple permissionsassignRole to accept multiple rolessyncPermissions-methodsyncRoles-methodhasPermissionTo function to the Role modelhasAnyRole can now properly process an arrayhasDirectPermission can now accept a string###Added
hasAllRoles()- and hasAnyRole()-functionshasPermission-method.Full Changelog: https://github.com/spatie/laravel-permission/compare/5.3.1...5.3.2
Full Changelog: https://github.com/spatie/laravel-permission/compare/5.5.0...5.5.1
hasPermissionTo uses the cache to avoid extra queries when it is called multiple timesgetDirectPermissions, getPermissionsViaRoles, getAllPermissionsHow can I help you explore Laravel packages today?