curly-deni/laravel-permission-policy

A lightweight Laravel package for reusable, trait-based policy checks supporting CRUD, ownership, and private resource access.

v1.1.0 2025-05-03 19:50 UTC

Requires

• php: ^8.0
• illuminate/auth: ^10.0||^11.0||^12.0
• illuminate/contracts: ^10.0||^11.0||^12.0
• illuminate/database: ^10.0||^11.0||^12.0
• spatie/laravel-package-tools: ^1.16
• spatie/laravel-permission: ^6.17

Requires (Dev)

• laravel/pint: ^1.14

MIT

• Danila Mikhalev

• authorization
• crud
• laravel
• traits
• Policy
• permissions
• gates
• access control
• ownership
• private resources

README

A simple and flexible way to define and apply CRUD policies in Laravel using traits. Designed to work seamlessly with laravel-permission-maker 🎯

✨ Features

• ✅ Out-of-the-box CRUD permission checks
• 🔒 Support for private resource visibility
• 👤 Ownership-based access control
• 🧩 Easy integration using traits
• ⚙️ Configurable behavior via simple settings

📦 Installation

Install the package via Composer:

composer require curly-deni/laravel-permission-policy

⚙️ Configuration

After publishing the config file with:

php artisan vendor:publish --tag="permission-policy-config"

You’ll get the following settings in config/permission-policy.php:

return [

    'register_gate' => true, // Automatically register default gate with policy bindings

    // Toggle specific permission checks:
    'read_check' => false,   // Use 'read' instead of 'view'
    'view_check' => true,    // Check for 'view' permission
    'create_check' => true,  // Check for 'create' permission
    'update_check' => true,  // Check for 'update' permission
    'delete_check' => true,  // Check for 'delete' permission
];

🛠️ Note: If you disable the automatic gate registration ('register_gate' => false), make sure your custom gate implementation supports passing policy arguments via query parameters. You can use the included helper functions to handle this:

• encodeClassWithParams(string $class, array $params): string > Encodes a class name and arguments into a query-safe string.

• decodeClassWithParams(string $encoded): array > Decodes the encoded string back into the original class name and parameters.

🚀 Usage

This package is intended to be used with laravel-permission-maker.

Choose the trait that suits your needs:

Trait	Description
HasResourcePolicy	Basic CRUD permission checks
HasPrivateResourcePolicy	Adds private resource view checks
HasOwnResourcePolicy	Enables edit/delete for own resources
HasOwnAndPrivateResourcePolicy	Combines ownership and private access

🤝 Contributing

See CONTRIBUTING.md for contribution guidelines.

🙌 Credits

• Danila Mikhalev
• All Contributors

📄 License

This package is open-sourced software licensed under the MIT license.