Download the PHP package andmarruda/authorization-module without Composer

Authorization Module

Role, permission, and plan-based access control for Laravel applications.

Package: andmarruda/authorization-module Namespace: Andmarruda\\AuthorizationModule

Requirements

• PHP 8.1+
• Laravel 11+
• Database configured for your app

Install

Provider auto-discovery is enabled.

If your app does not use Laravel package auto-discovery, register providers manually:

Publish configs:

Publish all required migrations (Authorization Module + Spatie) with one command:

Use --force to overwrite previously published files.

Run migrations:

Application Setup

1. Add the trait to your User model

2. Configure config/authorization.php

Set your user model:

Adjust route prefix and middleware as needed:

3. Configure Spatie (if needed)

If you changed guards/tables in config/permission.php, keep them aligned with your app guard strategy.

Available Endpoints

By default all endpoints are under /authorization.

Roles and Permissions

• GET /authorization/roles
• POST /authorization/roles
• PUT /authorization/roles/{id}
• DELETE /authorization/roles/{id}
• POST /authorization/roles/{id}/permissions
• GET /authorization/permissions
• POST /authorization/permissions
• DELETE /authorization/permissions/{id}
• GET /authorization/users/{id}/roles
• POST /authorization/users/{id}/roles
• DELETE /authorization/users/{id}/roles
• PUT /authorization/users/{id}/roles
• GET /authorization/users/{id}/permissions

Plans

• GET /authorization/plans
• POST /authorization/plans
• PUT /authorization/plans/{id}
• DELETE /authorization/plans/{id}
• GET /authorization/users/{id}/plans
• POST /authorization/users/{id}/plans/subscribe
• POST /authorization/users/{id}/plans/cancel
• POST /authorization/users/{id}/plans/consume

Deployment Guide

Production checklist

1. Install package and publish configs.
2. Set 'user_model' in config/authorization.php.
3. Ensure APP_ENV, APP_DEBUG, DB credentials, and cache drivers are correct.
4. Run migrations in target environment.
5. Clear and rebuild caches.
6. Run smoke tests on auth routes.

Typical deploy commands

If your deployment creates cache before publishing config, run publish first and rebuild cache.

Post-deploy verification

• Confirm role/permission CRUD endpoints respond.
• Confirm user-role assignment works.
• Confirm plan subscription/consume flow works.
• Confirm audit logs and plan tables are being written.

Notes

• Plan enforcement behavior is controlled by authorization.plans.* options.
• Routes are unversioned by default. For API versioning, apply a v1 prefix in your application routing strategy.