Top Related Projects
Quick Overview
Spatie's Laravel Permission is a powerful and flexible package for managing user roles and permissions in Laravel applications. It provides an intuitive API for assigning, revoking, and checking permissions, as well as handling role-based access control.
Pros
- Easy to integrate with existing Laravel projects
- Supports both role-based and permission-based access control
- Provides caching mechanisms for improved performance
- Offers extensive documentation and community support
Cons
- Can be overkill for simple projects with basic permission requirements
- Requires additional database tables and relationships
- May need custom implementation for complex hierarchical permission structures
- Performance impact on large-scale applications with numerous roles and permissions
Code Examples
- Assigning a role to a user:
$user = User::find(1);
$user->assignRole('writer');
- Checking if a user has a specific permission:
if ($user->can('edit articles')) {
// User can edit articles
}
- Creating a new role with permissions:
$role = Role::create(['name' => 'editor']);
$role->givePermissionTo('edit articles', 'publish articles');
- Using middleware to restrict access to routes:
Route::group(['middleware' => ['role:admin']], function () {
Route::get('/admin', 'AdminController@index');
});
Getting Started
- Install the package via Composer:
composer require spatie/laravel-permission
- Publish the migration and config files:
php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"
- Run the migrations:
php artisan migrate
- Add the
HasRoles
trait to your User model:
use Spatie\Permission\Traits\HasRoles;
class User extends Authenticatable
{
use HasRoles;
// ...
}
- Start using the package in your application:
// Create roles and permissions
$role = Role::create(['name' => 'writer']);
$permission = Permission::create(['name' => 'edit articles']);
// Assign roles and permissions
$user->assignRole('writer');
$user->givePermissionTo('edit articles');
// Check permissions
if ($user->hasPermissionTo('edit articles')) {
// User can edit articles
}
Competitor Comparisons
Laravel Eloquent roles and abilities.
Pros of Bouncer
- More flexible and granular control over permissions
- Supports ability inheritance and wildcards
- Easier to define and manage complex authorization scenarios
Cons of Bouncer
- Steeper learning curve due to more complex API
- May be overkill for simpler authorization needs
- Less community support and fewer integrations compared to Laravel Permission
Code Comparison
Bouncer:
Bouncer::allow('admin')->to('edit', Post::class);
Bouncer::allow('editor')->to('create', Post::class);
if ($user->can('edit', $post)) {
// User can edit the post
}
Laravel Permission:
$role = Role::create(['name' => 'writer']);
$permission = Permission::create(['name' => 'edit articles']);
$role->givePermissionTo($permission);
if ($user->hasPermissionTo('edit articles')) {
// User can edit articles
}
Both packages offer robust solutions for handling permissions in Laravel applications. Bouncer provides more flexibility and granular control, making it suitable for complex authorization scenarios. Laravel Permission, on the other hand, offers a simpler API and is easier to set up for basic permission management. The choice between the two depends on the specific needs of your project and the level of complexity required in your authorization system.
Role-based Permissions for Laravel 5
Pros of entrust
- Simpler setup process with fewer configuration steps
- Includes built-in middleware for role and permission checks
- Supports caching of permissions for improved performance
Cons of entrust
- Less actively maintained compared to laravel-permission
- Limited flexibility in defining custom permission logic
- Lacks some advanced features like direct permission assignment to users
Code Comparison
entrust:
$user->hasRole('admin');
$user->can('edit-post');
$user->attachRole('editor');
laravel-permission:
$user->hasRole('admin');
$user->hasPermissionTo('edit-post');
$user->assignRole('editor');
Both packages offer similar basic functionality for role and permission checks. However, laravel-permission provides more granular control and additional methods for managing permissions.
laravel-permission offers a more modern and actively maintained solution with extensive documentation and community support. It provides greater flexibility in defining and managing roles and permissions, including direct permission assignment to users without requiring roles.
entrust, while simpler to set up, may be a good choice for projects with basic role-based access control needs. However, for more complex permission structures or long-term maintainability, laravel-permission is generally the preferred option in the Laravel ecosystem.
Handle roles and permissions in your Laravel application
Pros of Laratrust
- Offers team-based permissions, allowing for more granular access control
- Provides a seeder command for easy initial setup of roles and permissions
- Includes middleware for role and permission checks, simplifying route protection
Cons of Laratrust
- Less actively maintained compared to Laravel Permission
- Documentation is not as comprehensive or up-to-date
- Slightly more complex setup process
Code Comparison
Laravel Permission:
$user->givePermissionTo('edit articles');
$user->assignRole('writer');
Laratrust:
$user->attachPermission('edit-articles');
$user->attachRole('writer');
Both packages offer similar functionality for assigning roles and permissions to users. Laravel Permission uses more intuitive method names, while Laratrust follows a different naming convention.
Summary
Both Laravel Permission and Laratrust are robust packages for managing roles and permissions in Laravel applications. Laravel Permission has a larger community, more frequent updates, and clearer documentation. Laratrust offers team-based permissions and a seeder command but is less actively maintained. The choice between the two depends on specific project requirements and preference for documentation and community support.
A framework agnostic authentication & authorization system.
Pros of Sentinel
- More comprehensive user management system, including authentication and activation
- Supports multiple authentication methods (session, token, etc.)
- Offers user throttling and suspension features
Cons of Sentinel
- Steeper learning curve due to more complex API
- Less frequently updated compared to Laravel Permission
- Requires more setup and configuration
Code Comparison
Laravel Permission:
$user->givePermissionTo('edit articles');
$user->assignRole('writer');
if ($user->hasPermissionTo('edit articles')) {
// User can edit articles
}
Sentinel:
$user = Sentinel::registerAndActivate($credentials);
$role = Sentinel::getRoleRepository()->createModel()->create($attributes);
$role->users()->attach($user);
if (Sentinel::getUser()->hasAccess('articles.edit')) {
// User can edit articles
}
Summary
Laravel Permission focuses specifically on role and permission management, offering a simpler API and easier integration with Laravel. It's more frequently updated and has a larger community.
Sentinel provides a more comprehensive user management solution, including authentication and activation features. However, it has a steeper learning curve and requires more setup.
Choose Laravel Permission for straightforward role and permission management, or Sentinel for a full-featured user management system with additional functionality.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
Associate users with permissions and roles
Documentation, Installation, and Usage Instructions
See the documentation for detailed installation and usage instructions.
What It Does
This package allows you to manage user permissions and roles in a database.
Once installed you can do stuff like this:
// Adding permissions to a user
$user->givePermissionTo('edit articles');
// Adding permissions via a role
$user->assignRole('writer');
$role->givePermissionTo('edit articles');
Because all permissions will be registered on Laravel's gate, you can check if a user has a permission with Laravel's default can
function:
$user->can('edit articles');
Support us
We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products.
We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on our contact page. We publish all received postcards on our virtual postcard wall.
Changelog
Please see CHANGELOG for more information what has changed recently.
Contributing
Please see CONTRIBUTING for details.
Testing
composer test
Security
If you discover any security-related issues, please email security@spatie.be instead of using the issue tracker.
Postcardware
You're free to use this package, but if it makes it to your production environment we highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using.
Our address is: Spatie, Kruikstraat 22, 2018 Antwerp, Belgium.
We publish all received postcards on our company website.
Credits
This package is heavily based on Jeffrey Way's awesome Laracasts lessons on permissions and roles. His original code can be found in this repo on GitHub.
Special thanks to Alex Vanderbist who greatly helped with v2
, and to Chris Brown for his longtime support helping us maintain the package.
And a special thanks to Caneco for the logo â¨
Alternatives
- Povilas Korop did an excellent job listing the alternatives in an article on Laravel News. In that same article, he compares laravel-permission to Joseph Silber's Bouncer, which in our book is also an excellent package.
- santigarcor/laratrust implements team support
- ultraware/roles (archived) takes a slightly different approach to its features.
- zizaco/entrust offers some wildcard pattern matching
License
The MIT License (MIT). Please see License File for more information.
Top Related Projects
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot