Download the PHP package laraarabdev/filament-gatekeeper without Composer

Filament Gatekeeper lets you control and customize who sees and does what across your entire application — Filament resources, form fields, table columns, pages, widgets, relation managers, and API responses — all from one place.

Then assign permissions to roles in the UI — no code changes needed.

What you can control:

• Resource access (view, create, edit, delete, restore...)
• Individual form fields — visible or editable per role
• Table columns — hide sensitive data by role
• Custom actions, widgets, pages, and relation managers
• API responses — filter fields and relations per role
• Multi-guard support (web + API)
• Super admin role that bypasses all checks

Table of Contents

• Features
• Requirements
• Installation
• Quick Start
• Configuration
• Default Setup Options
• Usage
• Auto-Discovery (Field & Column Detection)
• Permission Management
• API Permissions
• Commands
• Quick Reference
• Contributing
• License

Features

Supported Languages: English, Arabic, French, Spanish, Portuguese, German, Italian, Dutch, Russian, Chinese, Japanese, Korean, Indonesian, Polish, Hindi, Ukrainian, Turkish, Persian

Requirements

• PHP 8.2, 8.3, or 8.4
• Laravel 11.x or 12.x
• Filament 5.x (latest: 5.6.3)
• Spatie Laravel Permission 6.x (must be installed and configured)

Compatibility Matrix

All combinations are verified in CI on every push.

Installation

The install command publishes the config, migrations, and updates config/permission.php automatically.

Quick Start

1. Register the Plugin

In your Filament Panel Provider (app/Providers/Filament/AdminPanelProvider.php):

2. Add HasRoles to User Model

Option A: Extend Base Class (Recommended)

Option B: Use Trait Manually

3. Apply Permissions to Resources

Option A: Extend Base Class (Recommended)

Option B: Use Traits

4. Sync Permissions

Or use the dashboard action in the Role Resource.

5. Assign Roles to Users

Navigate to the Roles page in your Filament panel, assign permissions to roles, then assign roles to users.

Configuration

The configuration file is located at config/gatekeeper.php. Key settings:

Default Setup Options

All options are in config/gatekeeper.php. Below is a complete reference of every available setting.

Super Admin

Guards

Discovery Paths

HMVC Modules (nwidart/laravel-modules)

Navigation

Cache

Permission Generator

Exclusion Lists

Usage

Resource Permissions

When using HasResourcePermissions trait or extending GatekeeperResource, these methods are automatically implemented:

Generated permissions: view_any_user, view_user, create_user, update_user, delete_user, restore_user, force_delete_user, replicate_user, reorder_user

Field Permissions

Control visibility and editability of form fields:

Generated permissions: view_field_user_email, update_field_user_email, view_field_user_salary, update_field_user_salary

Column Permissions

Control table column visibility:

Generated permissions: view_column_user_email, view_column_user_salary

Action Permissions

Control custom action execution:

Generated permissions: execute_user_export_action

Page Permissions

Control access to custom Filament pages:

Generated permissions: view_settings_page

Widget Permissions

Control widget visibility:

Generated permissions: view_stats_overview_widget

Relation Permissions

Control access to relation managers:

Generated permissions: view_relation_user_roles, view_relation_user_posts

Auto-Discovery — Field & Column Detection

Filament Gatekeeper can automatically discover which fields and columns need permissions, so you don't have to list them manually. Discovery is configured separately for fields (form inputs) and columns (table display).

Key concept: When you enable discovery, Gatekeeper scans your application using one or more sources and generates permissions for every discovered field/column. You control which sources are used, what order they're checked, and which fields/columns to exclude.

How It Works

When multiple sources are configured, results from all sources are merged and deduplicated — you will never get duplicate permissions even if the same field appears in multiple sources.

Field Discovery

Field discovery detects form fields that should have view and update permissions.

Available Sources

Source Combinations

You can combine multiple sources. Results are merged and deduplicated automatically.

Deduplication: If email appears in both $fillable and field_permissions config, it only generates one set of permissions — never duplicates.

Excluding Fields

Control which fields are excluded from discovery at three levels:

All three levels are combined before filtering. A field excluded at any level will not get permissions.

Sensitive Field Detection

Gatekeeper can flag fields as sensitive based on name patterns. This is used for reporting and UI indicators, not for blocking discovery.

A field is considered sensitive if its name contains any of these patterns (case-insensitive). For example, user_password_hash matches password.

Manual Field Permissions (No Discovery)

If you prefer full manual control, keep discovery disabled and list fields explicitly:

*Global `key:** Fields listed under'*'` are merged into every model's field list. Duplicates are automatically removed.

Generated Permission Names

For each discovered field, Gatekeeper generates permissions using these prefixes:

Example: For User model with field salary:

• view_user_salary_field
• update_user_salary_field

Column Discovery

Column discovery detects table columns that should have view permissions.

Available Sources

Note: Column discovery does not have a fillable source, because table columns are read-only and $fillable only applies to writable attributes.

Source Combinations

Deduplication: Same as fields — if a column appears in multiple sources, it only generates one permission.

Excluding Columns

Control which columns are excluded from discovery at three levels:

Sensitive Column Detection

Manual Column Permissions (No Discovery)

Generated Permission Names

For each discovered column, Gatekeeper generates permissions using this prefix:

Example: For User model with column salary:

• view_user_salary_column

Field vs Column Discovery Comparison

Sync Commands for Discovery

Permission Management

Delete Permissions

Sync Permissions

API Permissions

Middleware

Single permission check:

Auto CRUD permissions:

Register middleware in bootstrap/app.php (Laravel 11+):

Controller Permissions

There are four ways to handle permissions in controllers — choose the approach that fits your needs.

Option 1: Route-Level Middleware (Recommended)

Zero controller code — apply gatekeeper.resource:ModelName on your apiResource route:

Auto-mapping:

Your controller stays completely clean:

Option 2: Constructor-Level Middleware

Use $this->middleware() in the constructor to apply permissions once for the whole controller:

Option 3: Per-Route Middleware

Use gatekeeper.api:permission directly on individual routes for custom or non-standard routes:

Option 4: Per-Method (Manual Trait)

Use HasApiPermissions trait for full control inside each method:

Available trait methods:

Choosing an approach:

API Resources

Gatekeeper Facade

Commands

Creating Resources, Pages & Widgets

Filament Gatekeeper does not ship its own make commands. Use Filament's built-in commands after publishing Gatekeeper's stubs so generated classes include Gatekeeper permissions:

1. Publish stubs (once):

2. Create with Filament / Laravel:

Quick Reference

Permission Types

Traits Reference

Base Classes

Middleware

Contributing

Please see DEVELOPMENT.md for details on package architecture, development setup, and contribution guidelines.

Security

If you discover any security-related issues, please email [email protected] instead of using the issue tracker.

Credits

• LaraArabDev
• All Contributors

License

The MIT License (MIT). Please see the License File for more information.