README

Laravel Valkyrie

Valkyrie is a roles-and-abilities (RBAC) package for Laravel with a fluent API. It stores authorization rules in the database and answers every Gate check through a Gate::before bridge, so $user->can(), @can, policies and ->can() route middleware work without changes. It also does a few things most RBAC packages don't:

Forbids always win. An explicit forbid beats any allow, wherever the allow comes from.
Scoped grants. Any grant or role assignment can be limited to one model, such as an office, a team or a project.
Ownership grants. An ability can apply only to the records the actor owns.
Ready for multi-tenancy without dictating it. Database-per-tenant, shared-table and hybrid setups all work, and Valkyrie leaves row scoping to your tenancy package or own setup.
A versioned cache. Invalidation affects only what a write changed, and it waits for the surrounding transaction to commit.
Extensible models. Subclass any model and swap it in with one line of config.

Installation

Requires PHP 8.4+ and Laravel 13.

composer require drivkraft/valkyrie
php artisan migrate

Then add the Drivkraft\Valkyrie\Concerns\HasRolesAndAbilities trait to your User model.

At a glance

use Drivkraft\Valkyrie\Facades\Valkyrie;

$user->allow()->to('view', Report::class);
$user->forbid()->to('delete', Report::class);

Valkyrie::allow(Valkyrie::defineRole('manager'))->toManage(Report::class);
$user->assign('manager', $office);           // only inside this office

$user->can('update', $report);               // through Laravel's Gate
Valkyrie::can($user, 'approve', on: $office);

Documentation

New to Valkyrie? Start with the Getting started tutorial.


How-to guides	Scopes · Ownership · Routes and views · Querying actors · Multi-tenancy · Schema · Extending models · Testing
Reference	API · Configuration · Middleware and Blade · Events · Exceptions · Commands · Schema
Explanation	Core concepts · Rule resolution · Caching · Multi-tenancy design · Known limitations

The full index is in docs/README.md.

Changelog

See CHANGELOG for recent changes.

Contributing

Thank you for considering contributing to Laravel Valkyrie! Please read the contributing guide to get started.

Security vulnerabilities

Please read our security policy to learn how to report security vulnerabilities.

Credits

Inspiration

Valkyrie builds on two excellent packages that shaped how authorization is done in the Laravel ecosystem:

silber/bouncer inspired the fluent grant API and the database-backed abilities model.
spatie/laravel-permission is the gold standard for roles and permissions in Laravel.

License

Laravel Valkyrie is open-source software licensed under the MIT license.

drivkraft / valkyrie

Package info

Security

Statistics