Download the PHP package libinkk/permission without Composer

On this page you can find all versions of the php package libinkk/permission. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of libinkk/permission

Informations about the package permission

libinkk/permission

v1.0 — production-grade Laravel authorization engine.

RBAC + ABAC + tenants + temporary access + delegation + explainable decisions + layered cache.

Authorization that explains itself.

Most permission packages answer: Does this user have this permission?

This package answers:

Is this user allowed to perform this action on this resource, in the current scope, under the current conditions — and if not, why?

This is not a thin roles CRUD helper. Blade, Vue, React, and Filament are UI only. Every write path must go Laravel → this package → ALLOW / DENY.

Doc Purpose
This README Tutorials and API
UPGRADE.md 0.x → 1.0
SECURITY.md How to report issues
CHANGELOG.md Release history
docs/tutorial.md SEO tutorial for www.libinkk.in/permission
docs/deployment.md Production checklist
docs/benchmarks.md Cache / query notes

Contents

  1. Compatibility
  2. Installation
  3. Tutorial 1 — Blog in 15 minutes
  4. Tutorial 2 — Invoice approval (ABAC + delegation)
  5. Tutorial 3 — Multi-tenant SaaS
  6. Permission naming
  7. Roles and users
  8. Wildcards, hierarchy, deny
  9. Conditions, ownership, policies
  10. Guards
  11. Temporary access and delegation
  12. Audit, history, versioning
  13. Middleware
  14. Blade
  15. Vue
  16. React
  17. Authorization API
  18. Filament
  19. Discovery
  20. Debugger and Artisan
  21. Bulk, cache, performance
  22. Testing
  23. Security
  24. Troubleshooting
  25. Architecture

Compatibility

Laravel PHP
10 8.1 – 8.3
11 8.2 – 8.4
12 8.2 – 8.5
13 8.3 – 8.5

Package version: Libinkk\Permission\Version::VERSION → 1.0.0.

CI: .github/workflows/tests.yml.

Installation

Or publish by hand:

Set permission.database.primary_key to bigint (default), uuid, or ulid before the first migrate.

Add the trait. The package does not own users. Assignments are user_type / user_id.

Tutorial 1 — Blog in 15 minutes

Goal: editors can write posts, admins can delete, guests cannot.

1. Define permissions

Or:

2. Create roles

3. Assign and check

4. Protect routes

5. Hide UI (not a grant)

6. Still check in the controller

@can only hides the link. authorize() / middleware is the security boundary.

Tutorial 2 — Invoice approval (ABAC + delegation)

Goal: finance managers approve invoices under their limit. A manager on leave can delegate.

Delegate for four hours (delegator must already hold the permission):

Only the delegator can revoke. Self-delegation is rejected. If the manager later loses invoice.approve, the cover user loses it too.

Explain in the terminal:

Tutorial 3 — Multi-tenant SaaS

Goal: the same user is an editor in Org A and a viewer in Org B.

Nested scopes (organization → workspace):

On every HTTP request (middleware):

Queue jobs must set the tenant again. Global roles (assignRole('super-admin') with no tenant) cross tenants only when teams.global_roles.cross_tenant is true.

Permission naming

Format: resource.action

Names that contain . are managed by this package through Gate::before.

Roles and users

System rows (is_system = true) cannot be deleted or unprotected.

Wildcards, hierarchy, deny

Exact matches beat wildcards. A wildcard does not cross resources (posts.* is not invoices.view).

Circular inheritance throws and is reported by permission:validate. Disable with hierarchy.enabled = false.

Default precedence:

Conditions, ownership, policies

.own also auto-checks author_id, user_id, owner_id, or permission.ownership.attribute.

Thrown or unknown conditions deny.

Laravel policies are not an engine step. Dotted abilities are resolved here. Use a host policy for non-dotted abilities, or call both yourself. POLICY_DENIED is reserved for that host wiring.

Guards

Roles and permissions have guard_name (default web). A web permission does not authorize an api user.

Temporary access and delegation

After expiry, can() is false with EXPIRED_PERMISSION or DELEGATION_EXPIRED.

Delegation rules: delegator must hold the permission; no self-delegate; no re-delegate; only the delegator revokes; expired/revoked never authorize.

Audit, history, versioning

Audit rows are append-only (no update / delete / soft delete).

Middleware

Aliases: permission, role.

Blade

Frontend checks are UI-only.

Vue

React

Authorization API

Off until permission.frontend.enabled is true.

/access is self-only unless frontend.access_user_permission is set (for example users.access) and the viewer can() that ability.

Filament

Not a Composer requirement. Set filament.enabled when Filament is installed.

Admin CRUD / matrix UI is a separate package (libinkk/permission-filament). Use FilamentAuthorization::debug() on a custom page for the debugger report.

Discovery

Debugger and Artisan

GET /api/authorization/explain?permission=… is off until debug.enabled. Current user only. Not a grant.

Bulk, cache, performance

Prefix: libinkk:permission:v1. Redis L3 is off until cache.redis.enabled is true.

Data Default TTL
Permissions / roles 86400
User roles / permissions 3600
Scopes 1800
Decisions 300

Mutations invalidate after DB commit. Octane and queue workers flush request state each cycle.

Details: docs/benchmarks.md.

Testing

Permission::fake() is disabled in production unless permission.testing.allow_fake is true.

Security

  1. Fail closed.
  2. Database is source of truth.
  3. Never trust Blade / Vue / React / Filament for enforcement.
  4. No privilege escalation via cache, fakes, or client payloads.
  5. Tenant isolation when teams are on.

See SECURITY-CERTIFICATE.md (8.0 / 10, not a third-party cert).

Production settings: docs/deployment.md.

Configuration (defaults)

Troubleshooting

Symptom Check
Always deny permission.enabled, user trait, permission:doctor
Tenant deny AuthorizationContext::tenant() on the request; teams.require_context
Stale allow after revoke permission:cache:clear; confirm after-commit ran
Wildcard too wide Wildcards do not cross resources; prefer exact + deny
Delegation not working Delegator must can() the permission now; not expired; not self
Fake in production Blocked unless testing.allow_fake
Explain 404 debug.enabled is false (default)
Frontend 404 frontend.enabled is false (default)
UUID attach failed Upgrade to 1.0 pivot id generation; set key type before first migrate

Architecture

Tables

Table Purpose
roles / permissions Definitions
role_permissions Role ↔ permission (allow / deny)
user_roles / user_permissions Polymorphic assignments + expiry
role_inheritances Hierarchy
permission_conditions / permission_condition_values ABAC
scopes / *_scopes Hierarchical boundaries
tenants / tenant_users Optional package tenants
permission_delegations Delegated access
permission_versions Snapshots
authorization_audits Append-only log

Soft deletes: roles and permissions only.

Events

RoleCreated / Updated / Deleted, PermissionCreated / Updated / Deleted, RoleAssigned / Removed, PermissionGranted / Revoked, AuthorizationAllowed / Denied, DelegationCreated / Revoked, PolicyChanged.

Roadmap

Version Status
v0.1 – v0.9 Shipped in 1.0
v1.0 Docs, upgrade guide, CI matrix, production guide ✅

Package layout

Ecosystem

Integrates with Libinkk OneAuth, Modular, and API Starter without replacing auth or tenant models.

All versions of permission with dependencies

PHP Build Version
Package Version
Requires php Version ^8.1
illuminate/auth Version ^10.0|^11.0|^12.0|^13.0
illuminate/cache Version ^10.0|^11.0|^12.0|^13.0
illuminate/console Version ^10.0|^11.0|^12.0|^13.0
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0
illuminate/database Version ^10.0|^11.0|^12.0|^13.0
illuminate/events Version ^10.0|^11.0|^12.0|^13.0
illuminate/http Version ^10.0|^11.0|^12.0|^13.0
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
illuminate/view Version ^10.0|^11.0|^12.0|^13.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package libinkk/permission contains the following files

Loading the files please wait ...