laravelplus/fortress

Fortress is a powerful Laravel package designed to streamline and enhance attribute-based authorization through middleware. It acts as the ultimate security gatekeeper for your application, ensuring that only the right users with the correct attributes gain access to specific resources.

v1.0.2 2024-12-19 20:07 UTC

Requires

• php: ^8.2
• spatie/laravel-permission: ^6.10.1

Requires (Dev)

• fakerphp/faker: ^1.23
• laravel/pail: ^1.1
• laravel/pint: ^1.18.3
• mockery/mockery: ^1.6
• nunomaduro/collision: ^v8.5.0
• orchestra/testbench: ^v9.6.1
• phpunit/phpunit: ^11.1.1

MIT

• Nejcc

• laravelPlus
• fortress

README

Fortress is a powerful Laravel package designed to streamline attribute-based authorization. By leveraging the #[Authorize] attribute, it provides a declarative and clean approach to securing your Laravel application. Whether managing roles, permissions, gates, or ownership rules, Fortress ensures security is flexible, robust, and easy to implement.

Key Features

• Attribute-Based Authorization: Use #[Authorize] attributes for roles, permissions, gates, and ownership checks.
• Simplifies Middleware Logic: Declarative syntax removes clutter from middleware, keeping it clean and readable.
• Ownership Validation: Validate ownership with configurable keys and default behaviors.
• Laravel 11 Support: Fully compatible with Laravel 11 and follows PSR standards.
• Customizable Configuration: Flexible configuration for roles, permissions, gates, and ownership rules.

Installation

You can install the package via Composer:

composer require laravelplus/fortress

Configuration

Append Middleware where you need it:

$middleware->web(append: [
    ...
    Laravelplus\Fortress\Middleware\AttributeAuthorizationMiddleware::class,
]);

To publish the configuration file, run:

php artisan vendor:publish --provider="Laravelplus\\Fortress\\FortressServiceProvider"

The configuration file will be published at config/fortress.php. Customize default values for ownership keys, gates, and more.

Usage

Applying the #[Authorize] Attribute

Add the #[Authorize] attribute to your controller methods to enforce authorization:

use Laravelplus\Fortress\Attributes\Authorize;

class PostController
{
    #[Authorize(
        public: false,
        roles: ['admin', 'editor'],
        permissions: ['create', 'update'],
        owner: App\Models\Post::class,
        overrideKey: 'author_id'
    )]
    public function update(Request $request, $id)
    {
        // Update logic
    }
}

How It Works

• Roles: Ensures the user has one of the specified roles (admin or editor).
• Permissions: Validates the user has create or update permissions.
• Ownership: Checks if the authenticated user is the owner of the Post model by comparing author_id with the user's id.

Example Scenarios

Example 1: Public Endpoint

Allow unauthenticated users to access a method:

#[Authorize(public: true)]
public function show($id)
{
    // This method is accessible by everyone
}

Example 2: Role and Permission Validation

Restrict access based on roles and permissions:

#[Authorize(roles: ['manager'], permissions: ['approve-leave'])]
public function approveLeave(Request $request)
{
    // This method is accessible only by managers with approve-leave permission
}

Example 3: Ownership Validation

Restrict access to resources owned by the authenticated user:

#[Authorize(owner: App\Models\Comment::class, overrideKey: 'user_id')]
public function editComment(Request $request, $id)
{
    // Accessible only if the comment belongs to the authenticated user
}

Example 4: Gate Validation

Use Laravel gates to control access:

#[Authorize(gates: 'edit-settings')]
public function settings()
{
    // This method is accessible if the "edit-settings" gate returns true
}

Testing

To run the package's test suite:

composer test

Example output:

PHPUnit 11.0.0 by Sebastian Bergmann and contributors.

.............                                                    22 / 22 (100%)

Time: 00:00.410, Memory: 26.00 MB
OK (22 tests, 60 assertions)

Changelog

See the CHANGELOG for details about recent changes.

Contributing

Contributions are welcome! Please see the CONTRIBUTING file for details on how to contribute.

Security

If you discover any security-related issues, please email [e-mail] instead of using the issue tracker.

Credits

• Author: Nejcc
• Contributors: All Contributors

License

This package is licensed under the MIT License. See the LICENSE file for details.

Download

You can download the package here:
Packagist - Laravel Fortress