- How do I install and set up yajra/laravel-acl in a Laravel application?
- Install it with Composer, then publish the package config and migrations and run your migrations to create the roles and permissions tables. Add the HasRole trait to your User model, register the package's two middleware aliases (in bootstrap/app.php on current Laravel, or the HTTP Kernel on older versions), and seed a permission catalogue. The whole slice is small enough to wire up in an afternoon: schema, trait, middleware, and a demo route.
- Which Laravel versions does yajra/laravel-acl support?
- Releases track Laravel majors, so you should pin the ACL major that matches the framework version you are on rather than floating the constraint. On Laravel 13, pin ^13.1 or later because v13.1.0 contains the serialization fix; the v12.x line pairs with earlier framework versions. Avoid starting greenfield work on 13.0.0, since the known serialization issue is only closed in 13.1.0 and later.
- How do I assign roles and permissions to users with yajra/laravel-acl?
- The HasRole trait is the real API surface: it exposes Eloquent-friendly methods for attaching roles to a user and permissions to a role or directly to a user. That gives you coarse role-based gating with per-user exceptions when someone needs one extra permission. Because the trait is short, an engineer can read the whole enforcement path in under an hour instead of treating the package as a black box.
- How do I protect routes with role and permission middleware?
- Register the package's middleware aliases and apply them to route groups or individual routes alongside Laravel's auth middleware. Order matters: auth must run before the role and permission checks, and a route registered outside the intended group will silently allow access rather than deny it. Treat middleware placement as a security-sensitive change and back it with automated negative tests rather than relying on code review alone.
- How do the @role and @permission Blade directives work?
- The package ships Blade directives such as @role and @permission so you can conditionally render navigation, buttons, and menu items based on the current user's access. These are presentation helpers only: they hide UI, they do not enforce anything, so every protected action still needs server-side middleware, Gate, or policy checks. Keeping that distinction clear prevents the classic bug where a hidden button is still reachable by a direct request.
- Does yajra/laravel-acl integrate with Laravel Gates and policies?
- Yes. Permissions register with Laravel's native Gate, so enforcement stays where reviewers and QA already look: controllers, form requests, policies, and @can checks. There is no parallel authorization dialect or bespoke Acl::check call that every squad has to learn. That composition over the framework's authorization contracts is the package's main architectural selling point.
- How does caching work, and how do I avoid stale permission data?
- Permission lookups are cache-backed for speed, which is what makes repeated checks cheap on hot routes. The canonical incident with any cached ACL is a user whose access was revoked but who still gets through, so establish a cache-flush-on-deploy convention before launch. Also avoid sharing a cache store between environments, since that can leak authorization state from one environment into another.
- Can yajra/laravel-acl handle per-tenant roles or ownership checks like 'can this user edit this invoice'?
- No, and it is deliberately not built for that. The model is flat role-based access control: roles attach to users, permissions attach to roles or directly to users, and it is the right shape for coarse gating with per-user overrides. Ownership semantics and tenant-scoped roles belong in Laravel policies and, eventually, a different data model, so plan the exit before you try to grow the package into that.
- How should I test that unauthorized users are actually denied?
- Write negative-path tests in CI that prove a roleless user and a guest both receive 401 or 403, not a redirect or a silently rendered page that masks the failure. Use Laravel's testing helpers to authenticate users, refresh the database per test, and clear the permission cache in setUp so results are deterministic. If any queued job carries ACL entities, add a serialize and unserialize round-trip test, because that class of bug surfaces at queue-drain time in production.
- Is yajra/laravel-acl actively maintained, and how does it compare to spatie/laravel-permission?
- It is a small MIT-licensed package with zero dependencies and no commercial support, so the star count and release cadence are modest and you should read the changelog before a framework upgrade. The mitigating factor is that the HasRole trait is short enough for your team to fork and own if upstream stalls. spatie/laravel-permission is the heavier, larger-community alternative, but it is more machinery than a flat role-with-overrides model needs. If near-term roadmap includes audit logs, SSO or SCIM role sync, or per-tenant scoping, treat this as a v1 accelerator with a planned exit rather than a long-term foundation.