Weave Code
Authorization Laravel Package
tipoff/authorization
Opinionated Laravel authorization package enabling users with multiple email addresses and unique usernames. Includes User and EmailAddress models, policies, and auth guard/provider configuration. Requires Laravel Nova. Deprecated/archived; no longer actively maintained.
Laravel Package for opinionated authorization style
Frequently asked questions about Authorization
- Does this package support Laravel 10.x or PHP 8.2+?
- No, the package was last updated in 2021 and lacks explicit compatibility with Laravel 10.x or PHP 8.2+. Testing is recommended before adoption, as it may require manual adjustments or conflict with newer Laravel features.
- How do I install and configure this package for role-based access control?
- Run `composer require tipoff/authorization`, publish migrations, and update `config/auth.php` to include the `tipoff` user provider and `email` guard. The package auto-registers policies for its models (User, EmailAddress), so no manual policy binding is needed.
- Can I use this alongside Spatie’s Laravel-Permission or Laravel Fortify?
- Potential conflicts may arise due to overlapping functionality (e.g., role/permission tables). The package lacks documented integration guidelines, so thorough testing is required before combining it with other auth packages.
- What models and policies does this package include out of the box?
- The package provides `User` and `EmailAddress` models with pre-defined policies for role/permission checks. Policies are registered automatically, but you can extend them via traits or interfaces for custom logic.
- Does this package support attribute-based access control (ABAC) or hierarchical roles?
- No, the package is designed for role/permission-based access control (RBAC) only. Implementing ABAC or hierarchical roles would require custom extensions, as the package does not natively support these features.
- How do I test authorization logic with this package?
- Use Laravel’s built-in testing tools like `assertAuthorized()` or `assertForbidden()`. The package integrates with Laravel’s authorization system, so existing test patterns (e.g., mocking policies) will work seamlessly.
- Is there a performance overhead for policy resolution in high-traffic routes?
- No benchmarks are provided, but policy resolution follows Laravel’s native system. For high-traffic routes, consider caching policy evaluations manually or using middleware to pre-load user permissions.
- Who maintains this package, and how are security issues addressed?
- The package is unmaintained (last release in 2021) and marked as deprecated. Security vulnerabilities or Laravel compatibility issues won’t be patched. Use at your own risk or fork it for critical projects.
- Can I use this package without Laravel Nova, or is it a hard dependency?
- The package does *not* require Laravel Nova, despite the README mentioning it. The `composer require` command is sufficient for installation, though Nova may have been a dependency in older versions of the package.
- What’s the migration path if I’m already using Laravel’s native Gate/Policy system?
- Audit your existing `Gate::define()` calls and custom middleware. Replace them with the package’s `authorize:user` middleware or policy extensions. Start with non-critical routes to minimize disruption during migration.
Weaver
How can I help you explore Laravel packages today?