ahinest / laravel-permission-manager

1.0.0 2026-10-16 16:35 UTC

Requires

• php: ^8.2
• ext-filter: *
• ext-json: *
• ext-pdo: *
• illuminate/database: ^12.0
• illuminate/support: ^12.0
• illuminate/validation: ^12.0
• spatie/laravel-permission: ^6.25

Requires (Dev)

• larastan/larastan: ^3.12.2
• laravel/pint: ^1.24
• orchestra/testbench: ^10.0
• pestphp/pest: ^3.8
• phpstan/phpstan: ^2.2.16

MIT

Published on Packagist.org on 2026-10-16 16:58 UTC

README

Español

Version 1.0.0 · ahinest/laravel-permission-manager

Administrative authority for Laravel applications using Spatie Permission: explicit delegation, role hierarchy, authorized account and membership operations, and transactional audit history through a host adapter.

Requires PHP ^8.2, Laravel 12 and Spatie Permission ^6.25. Check verified compatibility before choosing dependencies.

Installation

composer require ahinest/laravel-permission-manager
php artisan vendor:publish --tag=permission-manager-config

Keep your User model with Spatie HasRoles. Select the package Role or a Spatie subclass with HasDelegationPolicy, then configure user_model, the exact admin_role, guard and application permission mappings. Apply Spatie's schema before publishing and running the extension migration. Follow the installation guide for the complete sequence.

Authority model

• P(role): functional permissions supplied by Spatie.
• Q(role): permissions in the role's active delegation policy.
• D(user): union of Q across the user's persisted roles in the configured guard.

Functional permissions and policy-manager identity do not implicitly enlarge D. Every administrative write rechecks persisted authority under the shared transaction lock. Smaller role levels mean greater hierarchical authority. The configured global administrator has explicit administrative privileges; no functional Gate::before bypass is installed.

Minimal usage

use Ahinest\LaravelPermissionManager\Services\UserPermissionManagementService;

$user = app(UserPermissionManagementService::class)
    ->assignRole($actor, $target, $roleId);

The actor and target are persisted host users. The service checks functional entry, hierarchy, delegable authority and administrative identities, protects the last eligible administrator, records effective changes and returns fresh assignments.

Bind UserAccountWriter for compound account operations and TransactionalAuditStore for durable audit persistence. HTTP is optional and disabled by default. Installation creates no accounts, roles, permissions or implicit grants.

Documentation

Installation · Authorization · Delegation · Integration · HTTP API · Auditing · Public API

Security · Migrations · Compatibility · Verification · Static analysis · Release process · Changelog

Use one guard, integer Spatie keys and one connection. Teams, wildcards and Passport client-credential actors are unsupported. Direct SQL and Spatie/Eloquent writes outside the authorized services are not intercepted. External effects must wait for commit; cache errors after commit require reconciliation before retrying. See the security guide for the full boundary.