inventas/momentum-lock

Expose Laravel authorization abilities on the frontend for Laravel Data resources.

v0.4.0 2026-06-03 07:37 UTC

Requires

• php: ^8.3
• illuminate/auth: ^12.0|^13.0
• illuminate/support: ^12.0|^13.0
• spatie/laravel-data: ^4.0
• spatie/laravel-typescript-transformer: ^2.6

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.29
• orchestra/testbench: ^10.0|^11.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-laravel: ^4.0

MIT

• Boris Lepikhin
• Lennart Fischer

• authorization
• laravel
• permissions
• inertia
• Inventas

README

Momentum Lock is a Laravel package that lets you handle Laravel authorizations on the frontend level.

The package is only intended to work with Laravel Data objects and TypeScript Transformer.

Note

Inventas maintains this repository as a fork of lepikhinb/momentum-lock. We adopted the package because the upstream project appears inactive and we need ongoing Laravel support, including Laravel 13.

• Installation
  • Laravel
  • Frontend
• Usage
• Credits

Installation

Laravel

Install the package into your Laravel app.

composer require inventas/momentum-lock

This fork is tested against Laravel 12 and Laravel 13.

Frontend

The frontend package is framework-agnostic and will work great within any TypeScript-powered workflow.

Install the upstream frontend package.

npm i momentum-lock
# or
yarn add momentum-lock

Usage

Extend your data classes from DataResource instead of Data provided by Laravel Data.

use Momentum\Lock\Data\DataResource;

class UserData extends DataResource
{
    public function __construct(
        public int $id,
        public string $username
    ) {
    }
}

You can either specify the list of abilities manually, or let the package resolve them from the corresponding policy class.

class UserData extends DataResource
{
    protected $permissions = ['update', 'delete'];
}

Register DataResourceCollector in the TypeScript Transformer configuration file — typescript-transformer.php. This class helps TypeScript Transformer handle DataResource classes and append permissions to generated TypeScript definitions.

return [
    'collectors' => [
+       Momentum\Lock\TypeScript\DataResourceCollector::class,
        Spatie\TypeScriptTransformer\Collectors\DefaultCollector::class,
        Spatie\LaravelData\Support\TypeScriptTransformer\DataTypeScriptCollector::class,
    ],
]

On the frontend, you can use the helper can. This function checks whether the required permission is set to true on the passed object, and can be used in both scripts or templates.

<script lang="ts" setup>
import { can } from "momentum-lock"

const props = defineProps<{
  users: UserData[]
}>()
</script>

<template>
  <div v-for="user in users" :key="user.id">
    <a v-if="can(user, 'update')" :href="route('users.edit', user)"> Edit </a>
  </div>
</template>

Credits

• Original package by Boris Lepikhin
• Maintained fork by Inventas

License

The MIT License (MIT). Please see LICENSE for more information.