Laravel Permission

Laravel Permission (Spatie)

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

1. explore-codebase - Check existing auth patterns
2. research-expert - Verify Spatie Permission docs via Context7
3. mcp__context7__query-docs - Check Laravel authorization patterns

After implementation, run sniper for validation.

Overview

Spatie Laravel Permission provides complete role-based access control (RBAC) for Laravel applications.

Critical Rules

1. Seed roles/permissions in DatabaseSeeder
2. Cache reset after changes: php artisan permission:cache-reset
3. Use kebab-case for naming: edit-articles
4. Never hardcode role checks in controllers - use middleware
5. Set team context early in request for multi-tenant apps
6. Specify guard for API - permission:edit,api
7. Clear cache in tests - Reset in setUp()/beforeEach()

Reference Guide

Core Concepts

Advanced Features

Integration

Operations & Quality

Templates (Code Examples)

Setup & Seeding

Routes & Middleware

Teams & Multi-Tenant

Super Admin & Cache

API Integration

Policies & Events

Testing

Custom Models

Quick Reference

Assign Role

$user->assignRole('admin');

Check Permission

$user->can('edit articles');

Middleware (Web)

Route::middleware(['role:admin'])->group(fn () => ...);

Middleware (API)

Route::middleware(['auth:sanctum', 'permission:edit,api'])->group(fn () => ...);

Blade

@role('admin') ... @endrole
@can('edit articles') ... @endcan

Query Scopes

User::role('admin')->get();
User::permission('edit articles')->get();

Teams

setPermissionsTeamId($team->id);

Wildcards

$role->givePermissionTo('articles.*');

Super Admin

Gate::before(fn ($user, $ability) =>
    $user->hasRole('Super-Admin') ? true : null
);

Testing

beforeEach(fn () => app(PermissionRegistrar::class)->forgetCachedPermissions());

Feature Matrix

Laravel 13 Notes

Spatie Permission 6.24 est compatible Laravel 13. Intégrations L13 :

• Cache prefix hyphens : spatie.permission.cache devient spatie-permission-cache ; configurer permission.cache.key si rétro-compat requise
• Attributes Controllers : combiner #[Authorize] (policy) et #[Middleware('role:admin')] (RBAC) — voir [[laravel-blade]]
• PHP 8.3 : final readonly class pour Role/Permission DTOs custom

#[Middleware(['auth', 'role:admin|editor'])]
#[Authorize('update', Post::class)]
public function update(UpdatePostRequest $request, Post $post) { /* ... */ }

Best Practices

DO

• Définir une seule source de vérité : Policy OU Permission (pas les deux pour la même action)
• Utiliser permission:create-post (verb-noun) pour clarté
• Activer teams uniquement si réel multi-tenant
• Cacher les permissions par utilisateur (Cache::remember('user.permissions.'.$id, ...))
• Super admin via Gate::before() (jamais via permission wildcard *)

DON'T

• Stocker permissions en session (utiliser le cache Spatie)
• Mixer hasRole() et hasPermissionTo() sans cohérence d'architecture
• Hardcoder noms de rôles dans le code (utiliser enum RoleEnum)
• Oublier de purger le cache après assignRole() en seeder
• Donner * à un super admin (préférer Gate::before() ciblé)