Expression Language Laravel Package

Product Decisions This Supports

• Dynamic Rule Engine for Business Logic: Enable product teams to define and update rules (e.g., pricing, permissions, workflows) via a configurable admin interface or API without code deployments. Examples:

  • Pricing Rules: Store expressions like 'user.tier === "premium" && order.quantity > 5 ? 0.2 : 0.1' in a database to calculate discounts dynamically.
  • Feature Flags: Replace hardcoded toggles with expressions like 'feature_enabled && user.isBetaTester() && date.isWeekend() && user.country === "US"' for granular control.
  • Access Control: Define policies (e.g., 'user.role === "admin" || (user.team === "finance" && request.method === "POST")') in a centralized location, reducing code duplication in Policies or Middleware.

• Build vs. Buy Decision:

  • Adopt: Use this package to avoid reinventing a secure expression parser. It is MIT-licensed, production-ready, and integrates natively with Laravel’s ecosystem, reducing development time and security risks.
  • Custom Alternative: Only consider building a custom solution if requirements are highly specialized (e.g., domain-specific syntax or unique performance needs like 10M+ evaluations/sec).
  • Avoid: Skip if the use case is static (e.g., simple if conditions) or involves untrusted input (risk of code injection).

• Roadmap Priorities:

  • Configuration-Driven Features: Prioritize features where rules evolve frequently (e.g., compliance updates, A/B tests, or seasonal promotions).
  • Security-Critical Logic: Use for systems where injection risks are unacceptable (e.g., payment processing, admin dashboards). Compiled expressions mitigate eval() risks.
  • Performance Optimization: Cache compiled expressions for high-frequency use cases (e.g., API rate limiting, policy checks in loops).
  • Laravel Integration: Extend existing components like Policies, Middleware, Form Requests, and Nova to reduce boilerplate and improve maintainability.

• Laravel-Specific Opportunities:

  • Policies: Replace verbose if chains in App\Policies\UserPolicy with expressions stored in a database or cached configuration.
  • Middleware: Dynamically authorize or route requests based on expressions (e.g., 'user.hasPermission("edit_post") && post.published') without modifying middleware logic.
  • Form/Request Validation: Validate submissions with rules stored in a validation_rules table, enabling non-technical teams to update validation logic.
  • Feature Flags: Implement granular toggles via a feature_flags table with expressions like 'feature_enabled && user.isPremium() && date.isHoliday()'.
  • Workflow Automation: Define multi-step processes with conditions stored in a workflow_rules table (e.g., 'order.status === "shipped" && user.isVIP() ? "skip_quality_check" : "proceed"').

When to Consider This Package

Adopt When:

• Dynamic Rules Are a Core Requirement: Logic must change frequently without code deployments (e.g., marketing campaigns, compliance updates, or A/B tests). Ideal for:
  • E-commerce: Dynamic pricing, bundle discounts, or region-specific promotions.
  • SaaS: Role-based feature toggles or user-segmented workflows.
  • FinTech: Conditional approval logic for transactions.
• Performance Is Critical: Expressions are evaluated repeatedly (e.g., in loops, high-traffic APIs, or real-time systems). The package compiles expressions to PHP, ensuring low-latency evaluations.
• Security Is a Priority: Need to avoid eval() risks while supporting dynamic logic. The package compiles expressions to PHP and supports variable whitelisting to mitigate injection risks.
• Laravel/Symfony Ecosystem Is Used: Already using Symfony components or planning to adopt more. Seamless integration with Laravel’s service container, PSR standards, and existing components (e.g., Policies, Middleware).
• Use Cases Align with Expression Language Strengths:
  • Dynamic Access Control: Role-based or attribute-based access decisions (e.g., 'user.role === "admin" || (user.team === "finance" && request.path.startsWith("/payments"))').
  • Validation Rules: Store validation logic in a database (e.g., 'input.length > 5 && input.includes("@") && !input.includes(" ")').
  • Feature Flags: Toggle features per user with complex conditions (e.g., 'feature_enabled && user.isBetaTester() && date.isWeekend()').
  • Workflow Conditions: Define approval paths dynamically (e.g., 'order.total > 1000 ? "require_manager_approval" : "auto_approve"').

Look Elsewhere When:

• Rules Are Static: Logic is simple and unlikely to change (e.g., if ($user->isAdmin())). Use native PHP if/else or Laravel’s built-in helpers (e.g., authorize()).
• Untrusted Input Is Evaluated: Raw user-provided expressions pose code injection risks. Use predefined rules or a sandboxed environment (e.g., a custom parser with strict whitelisting).
• Complex Workflows Require State Machines: Multi-step processes with branching logic. Use a dedicated workflow engine (e.g., Laravel Nova Workflows, Camunda, or Symfony Workflow).
• Legacy PHP (<8.1) Is Required: The package requires PHP 8.1+ for full functionality (e.g., named arguments, attributes). Downgrade to an older Symfony version if compatibility is an issue.
• Domain-Specific Syntax Is Needed: If the use case requires custom operators or non-standard logic, consider extending the package or building a lightweight parser tailored to your domain.

How to Pitch It (Stakeholders)

For Executives (Business/Strategy):

"This package lets us embed flexible business rules directly into our application without writing code—enabling faster iterations for pricing, permissions, and features. For example, our marketing team could update discount logic for a holiday sale via an admin panel, while our security team could define granular access controls in a centralized policy store. It’s like giving non-technical teams a ‘code-free’ way to configure logic, reducing deployment cycles and improving agility. The risk of injection attacks is minimized because expressions are compiled to secure PHP, not evaluated as raw strings."

For Engineers (Technical/Architecture):

*"Symfony’s ExpressionLanguage is a battle-tested, MIT-licensed solution for dynamic logic evaluation. It compiles expressions to PHP at runtime, offering performance comparable to native code while avoiding the pitfalls of eval(). Key benefits:

• Security: Whitelist variables and operators to prevent injection.
• Extensibility: Add custom functions/operators for domain-specific needs.
• Laravel Integration: Works seamlessly with Policies, Middleware, and Form Requests.
• Caching: Compiled expressions can be cached for high-throughput use cases.

Use it for dynamic rules, feature flags, or validation logic—anywhere you’d otherwise hardcode conditions or use eval(). Avoid it for static logic or untrusted input."*

For Product Managers (Use Cases/Roadmap):

*"This package unlocks configuration-driven features for high-impact areas:

• Pricing Engines: Store discount rules in a database (e.g., 'user.tier === "premium" && order.quantity > 5 ? 0.2 : 0.1').
• Feature Flags: Toggle features per user with complex conditions (e.g., 'feature_enabled && user.isBetaTester() && date.isWeekend()').
• Access Control: Define policies in a centralized location (e.g., 'user.role === "admin" || (user.team === "finance" && request.method === "POST")').

Prioritize this for frequently changing logic or security-critical decisions. Pair it with a simple admin UI to let non-technical teams manage rules."*