baseline / bl-backpack

2.39 2026-10-21 13:15 UTC

Requires

• php: >=8.4
• backpack/crud: ^7.0
• intervention/image: ^2.5
• laravel/framework: >=12.0
• laravel/sanctum: ^4.0
• nwidart/laravel-modules: ^12.0
• propaganistas/laravel-phone: ^5.0
• spatie/laravel-fractal: ^6.3

mit

• Darren Hemphill

• php
• laravel
• backpack

Published on Packagist.org on 2026-10-21 13:15 UTC

README

baseline/bl-backpack is an add-on for Laravel Backpack CRUD applications. It provides tenant-aware administration and nested CRUD routes, along with reusable CRUD operations, API support, dashboard components, model traits, and Artisan code-generation tools.

Requirements

• PHP 8.4 or later
• Laravel 12 or later
• Backpack CRUD 7

Composer installs the package's other required libraries, including Laravel Sanctum and Laravel Modules.

Installation

Install the package in your Laravel application:

composer require baseline/bl-backpack

Laravel package discovery registers Baseline\Backpack\BlBpServiceProvider automatically. To publish the package's configurable files and overridable resources:

php artisan vendor:publish --provider="Baseline\Backpack\BlBpServiceProvider"

Review the published files before deploying. The package includes Backpack views, frontend assets, configuration, and custom admin routes.

Multi-tenancy

The default tenant settings are in config/tenant.php:

Setting	Default	Purpose
model	App\Models\Tenant	Tenant model class
relation	tenant	Tenant relationship and tenant table name
foreign_key	tenant_id	Tenant key used on users and tenant-owned models
super_tenant	0	Tenant ID treated as the super tenant
global_baseroute	global	Base route for global administration

Update these values to match your application's models and schema. Tenant-specific admin routes are registered beneath the Backpack route prefix and use the tenant middleware group. Global routes use global_permission. The package adds enabled-user/tenant checks to the tenant middleware group.

Use Baseline\Backpack\Model\Traits\IsTenant on tenant-owned Eloquent models. The trait scopes queries to the current tenant when the request uses the tenant middleware and provides the configured tenant relationship. Tenant-owned tables need the configured foreign-key column. The package also provides helpers, validation rules, and model traits for tenant-aware access and data handling.

For a new application, php artisan bl-backpack:setup_tenant_in_database copies the package's tenant and user migrations into the application and runs migrations immediately. Review the migration files and ensure the application's users table and database are ready before running it, especially if the application already has tenant-related migrations. To add records, the package also provides php artisan tenant:add and php artisan tenant:add_user; see php artisan help tenant:add and php artisan help tenant:add_user for their arguments.

CRUD and application scaffolding

The package includes Backpack CRUD operations and hooks, nested-route/controller helpers, request and response classes, filters, and traits for common model and UI behavior. Its Artisan generators can create MVC files, migrations, models, requests, controllers, and Fractal transformers. For example:

php artisan help bl-backpack:create_mvc
php artisan help bl-backpack:create_transformer

Other generator commands include bl-backpack:create_migration, bl-backpack:create_model, bl-backpack:create_controller, and bl-backpack:create_request. Generated files are application code: review and adapt them to your schema, authorization rules, and route structure.

JSON:API and API routes

JSON:API requests can use the same CRUD routes as browser requests by sending Accept: application/vnd.api+json (and the matching Content-Type for request bodies). The package also provides optional API routes and Sanctum bearer-token authentication.

A controller can exclude api routes by declaring protected $excludeApiRoutes = ['destroy', 'search']; (names: index, search, show, create, update, destroy, secret, or ['*'] for all). Web routes are unaffected.

API routes are disabled by default. Enable them in config/bl-backpack.php or through BL_BACKPACK_API_ENABLED=true. The default API prefix is api/bl-backpack/v1. For bearer tokens you must install Sanctum and modify the backpack guard in config/auth.php to use the bl-backpack driver, otherwise bearer tokens are not accepted (see Authentication (Sanctum)).

The API is off unless a controller opts in with 'json_api_routes' => true, in its $crud_config (default false). For opted-in controllers the API is default deny: each operation registers the attributes it exposes in its setup{Operation}Defaults() method with registerApiAttributes(). An operation without a registration exposes only its id. Writes are not limited to exposed attributes, but normal request validation and model mass-assignment rules still apply; the tenant foreign key is always rejected. Relationships are exposed the same way, with registerApiRelationships(), and are returned as linkage or with ?include= (see the docs). Hidden and sensitive looking attributes are refused in API responses. Run php artisan bl-backpack:api_audit to review what every operation exposes.

See JSON:API and API operations for request formats, pagination and filtering, authentication, token abilities, and API spec generation. When the API is enabled, generate an OpenAPI spec plus a Postman collection and environment with:

php artisan bl-backpack:api_spec

Dashboards

DashboardOperation provides composable tabs, rows, columns, components, dashboxes, shortcuts, and badges for Backpack dashboards. See the dashboard components guide for the API and an example.

License

This package is licensed under the MIT License.