- What is wnikk/laravel-access-rules used for?
- It is a Laravel package for rule-based access control using RBAC and ABAC concepts. You define permissions for routes, Eloquent models, and UI elements, then enforce them with middleware, gates, and Blade directives. It also supports roles, groups, and unlimited inheritance for hierarchical permission setups.
- How do I install wnikk/laravel-access-rules in a Laravel app?
- Install it with Composer using composer require wnikk/laravel-access-rules. Laravel package auto-discovery should register the service provider, but check the package README for any required config publishing or migration steps. Run your normal migration and cache-clear steps after installation, and verify the package PHP and Laravel support matrix in composer.json.
- Does this package support roles, groups, and permission inheritance?
- Yes. The package is described as supporting roles, groups, unlimited inheritance, and multiplayer use. That makes it suitable for hierarchical permission models where roles or groups inherit access from parent definitions.
- How do I protect Laravel routes with wnikk/laravel-access-rules?
- The package is designed to define access rules for routes and enforce them through Laravel middleware and gates. You define the rule or permission, attach the appropriate middleware or gate check to the route, and let Laravel authorization reject unauthorized requests. Use Blade directives for matching UI visibility.
- Can I use it for model-level permissions and Blade UI checks?
- Yes, the package overview lists routes, models, and UI elements as permission targets. Model-level authorization is typically enforced through gates or policies that call the package rule checks, while Blade directives handle conditional rendering. Keep rule names consistent across routes, models, and views to avoid drift.
- What is the acr:doctor Artisan command?
- acr:doctor is an Artisan diagnostic command associated with the v3.3.15 hardening release. It inspects the self-referential rule hierarchy for integrity problems such as rules with a missing parent row and parent chains that form loops. Run it as a read-only pre-flight check in staging before enabling new writes or deploying the upgrade.
- Does v3.3.15 prevent circular rule hierarchies?
- v3.3.15 adds a write-path invariant that a rule cannot be placed under itself. The release notes do not confirm whether this is a validation rule, domain exception, or database constraint, nor whether it blocks transitive cycles like A to B to A. Because acr:doctor separately detects loops, treat multi-node cycle prevention as unconfirmed and test your admin and API write paths.
- Is acr:doctor read-only or can it fix broken rules?
- The release notes do not confirm whether acr:doctor repairs data or is strictly read-only. Until the maintainer documents a fix mode, treat it as a diagnostic report and review findings manually. Check its exit codes if you plan to schedule it in CI or Laravel scheduler.
- What happens if a rule has a missing parent in laravel-access-rules?
- The v3.3.15 doctor can detect rules whose parent row is missing. The evaluation behavior for orphaned rules is not documented in the release notes, so verify whether your version skips them, throws an error, or falls back. Silent skipping is the risky case because access restrictions may not be applied.
- Is wnikk/laravel-access-rules production-ready and actively maintained?
- v3.3.15 is a patch-level hardening release, which indicates ongoing maintenance and a focus on rule hierarchy integrity. The package follows standard Laravel conventions such as a service provider, Artisan command, and Eloquent-backed data model, so it adds no new infrastructure. Before production rollout, confirm the PHP and Laravel support matrix and run acr:doctor against a staging copy of your rules table.