Weave Code
Nova Bouncer Laravel Package
yadahan/nova-bouncer
Provides Laravel Nova resources for Bouncer, the roles and permissions package. Manage roles, abilities, and entity assignments directly from Nova with a clean, searchable interface, letting admins grant or revoke access without touching code.
Nova Bouncer is a Laravel Nova tool that brings the Bouncer authorization package into your admin panel, letting you manage roles and abilities for any model without writing custom code. It registers Nova resources for creating roles and assigning abilities to users or other entities directly from the UI.
- Manage roles and abilities through native Nova resources
- Attach or detach permissions on any Bouncer-authorized model
- Searchable selection fields for quick assignment
- Honors Bouncer's scopes and multi-tenancy constraints
- Install via Composer and register the tool in Nova
Frequently asked questions about Nova Bouncer
- What is yadahan/nova-bouncer and what does it actually do?
- It is a Laravel Nova tool that registers Nova resources on top of the Bouncer authorization package, letting admins create roles and attach or detach abilities on any model that uses Bouncer's HasRolesAndAbilities trait. It is a presentation layer that reads and writes Bouncer's role and ability tables, not an authorization engine of its own. Bouncer must already be installed and wired into your models for the tool to do anything useful.
- How do I install and register nova-bouncer in Laravel Nova?
- Run composer require yadahan/nova-bouncer, publish the provider assets with vendor:publish, and register the tool in the tools() method of your NovaServiceProvider. You should also gate the tool with a canSee callback so only authorized admins see it. Bouncer itself must be configured and its migrations run before the resources show meaningful data.
- Does nova-bouncer work with spatie/laravel-permission?
- No. The package is built exclusively for Bouncer and there is no adapter for spatie/laravel-permission or any other permission library. If your application is on spatie, there is no path forward with this tool and you should stop evaluating it. Bouncer and spatie use incompatible tables and APIs, so running both is not realistic.
- Which Laravel, PHP, and Nova versions does nova-bouncer support?
- The repository publishes no compatibility matrix, so the composer.json constraints in the package are the real source of truth. The last release was December 2024, and you must confirm your exact Nova, Laravel, PHP, and Bouncer combination postdates it or is inside those constraints. The frontend assets under resources/js are where Nova major upgrades typically break third-party tools, so test after any Nova upgrade.
- Do I need a Laravel Nova license to use nova-bouncer?
- Yes. Nova is a paid, licensed product, and without an active license the prerequisite cost dominates any value this package delivers. The tool only makes sense in the narrow intersection of two deliberate choices: a licensed Nova install and Bouncer already in use. Treat both as hard gates before estimating any work.
- Can nova-bouncer manage Bouncer wildcards, ownership (toOwn), and multi-guard abilities?
- Bouncer supports wildcards, ownership constraints, entity-scoped abilities, and multiple guards, but a generic CRUD interface is unlikely to expose all of them. Anything the UI cannot express becomes out-of-band database or code work, which quietly defeats the point of delegating permissions to admins. Verify your specific needs during a spike and permanently scope unsupported features to engineering if you adopt the tool.
- Why do permission changes made in Nova not take effect?
- Bouncer caches abilities per user, so writes made through the Nova UI will not be visible until the cache is refreshed. Your code or tooling must call Bouncer::refresh() or Bouncer::refreshFor($user) after changes. Cache staleness here is a silent correctness bug: admins will believe they fixed a permission and see nothing change.
- Is nova-bouncer safe to use in a multi-tenant application?
- The tool honors Bouncer's scopes, but you must decide explicitly whether it renders inside Bouncer::scope() or globally. A UI that shows global roles to a tenant administrator is a cross-tenant privilege escalation. Test the scoped and unscoped behavior carefully before letting tenant admins near the screen.
- Does nova-bouncer keep an audit trail of who changed roles or abilities?
- No. Nothing records who granted or revoked what, so you need to write your own observers to answer questions like who granted edit-users on a Friday afternoon. There is also a real lockout risk: deleting the ability your superadmin path depends on can lock every admin out of Nova, including out of the screen needed to fix it. If audit, approval, or separation of duties is on your compliance roadmap, this package closes none of it.
- Is nova-bouncer actively maintained, and should I plan to fork it?
- It has roughly 26 stars, zero dependents, a single maintainer, and a last release in December 2024, so there is effectively no ecosystem validation or shared upgrade path. The realistic steady state is that your team maintains a fork; the MIT license makes forking trivial, but the obligation is permanent. That can still be an acceptable trade for a few days of saved CRUD work, as long as you make the decision consciously now rather than during an incident.
Weaver
How can I help you explore Laravel packages today?