README

This package is unmaintained and contains security defects. It should not be used in any application.

A full audit is in AUDIT.md: 22 findings, five of them critical. The most serious:

It adds a public, unauthenticated user-registration endpoint (POST /rbac_register) to any application that installs it — with no validation, no email uniqueness check, no password rules and no rate limiting.
It breaks the host application on install. routes/api.php references a controller class whose namespace does not match its PSR-4 path, so it can never autoload — and the service provider loads that route file unconditionally.
It runs a database query during boot(), so php artisan migrate fails on a fresh install and every HTTP request pays a full table scan.
Authorization failures return HTTP 200. Any client checking response.ok treats a denied request as successful.
php artisan config:cache fails, because the config file returns Carbon objects.

It also targets Laravel 8/9 and Passport 10. Passport::routes() was removed in Passport 11, so this cannot run on any currently supported version regardless.

Use this instead

A complete rewrite against the same idea, with the above fixed and 32 tests running against SQLite, PostgreSQL and MySQL:

→ zain-ul-abdain/laravel-route-permissions

composer require zain-ul-abdain/laravel-route-permissions

The most important design change: permissions derive from route names rather than controller class names. In this old version, renaming a controller silently changed the required permission string and orphaned every grant referencing it — authorization breaking during an ordinary refactor, with no error.

This repository is kept public and archived for reference and for the audit. It is not a maintained package.

Original README (2022), unchanged below

Laravel - Role Based Access Control

Custom Route Wise Access Control

This package allows you to manage user permissions and roles in a database and Authentication and Authorization

Custom RBAC user based roles and permissions package
Custom RBAC provides flexibility to use Laravel/Passport in a manner of minutes.

Prerequisites

Laravel ^8.0

Php ^7.3

Laravel/Passport ^10.4

Commands

composer require zainburfat/rbac

Run migrations:

php artisan migrate

Install Passport:

php artisan passport:install

Use trait in the "User" model:

use HasApiTokens

use UserPermissionTrait

To exclude some methods/class from creating permissions of them just add "@exclude-permission" in the docs block of class/method you want to exclude.

/**
 *...
 *@exclude-permission
 *...
 */
class SomeController extends Controller
{
    /**
     *...
     *@exclude-permission
     *...
     */
    public function index()
    {
        ...
    }
}

Permissions are created dynamically through command according to the controllers having methods:

php artisan create:permission

Define an api authentication guard and set the driver option to passport in config/auth.php:

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],
 
    'api' => [
        'driver' => 'passport',
        'provider' => 'users',
    ],
],

Publish config file

php artisan vendor:publish --tag=custom-rbac

Set token expirations inside config\customrbac.php:

    'tokensExpireIn' => now()->addDays(15),
    'refreshTokensExpireIn' => now()->addDays(30),
    'personalAccessTokensExpireIn' => now()->addMonths(6)

Use PermissionsApi middleware to authorize user to specific Api route and for web routes use PermissionsWeb middleware

app/http/kernel.php under protected $routeMiddleware:

'permissionsApi' => \Zainburfat\Rbac\Middleware\PermissionsApi::class,
'permissionsWeb' => \Zainburfat\Rbac\Middleware\PermissionsWeb::class,

Login and register using package's route

For Login use paramenters ('email', 'passport')

For Register use paramenters ('name', 'email', 'passport')

http://yourdomain/rbac_login
http://yourdomain/rbac_register

zainburfat / rbac

Maintainers

Package info

Statistics

Security