PHP code example of libinkk / permission

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

libinkk / permission example snippets

$user->can('invoice.approve', $invoice);
$user->explain('invoice.approve', $invoice);

use Illuminate\Foundation\Auth\User as Authenticatable;
use Libinkk\Permission\Concerns\HasAuthorization;

class User extends Authenticatable
{
    use HasAuthorization;
}

use Libinkk\Permission\Permissions\Permission;
use Libinkk\Permission\Roles\Role;

Permission::crud('posts'); // posts.view / create / update / delete
Permission::define('posts.publish', ['group' => 'Posts']);

Role::findOrCreate('viewer')->givePermissionTo('posts.view');
Role::findOrCreate('editor')->givePermissionTo('posts.view', 'posts.create', 'posts.update');
Role::findOrCreate('admin')->givePermissionTo('posts.*');

$editor = User::find(1);
$editor->assignRole('editor');

$editor->can('posts.update'); // true
$editor->can('posts.delete'); // false
$editor->explain('posts.delete');
// ['allowed' => false, 'reason' => 'PERMISSION_MISSING', ...]

Route::post('/posts', [PostController::class, 'store'])
    ->middleware(['auth', 'permission:posts.create']);

Route::delete('/posts/{post}', [PostController::class, 'destroy'])
    ->middleware(['auth', 'permission:posts.delete']);

public function store(Request $request)
{
    $this->authorize('posts.create');

    Post::query()->create($request->validated());
}

use Libinkk\Permission\Conditions\Condition;
use Libinkk\Permission\Permissions\Permission;

Permission::define('invoice.approve', ['group' => 'Finance', 'is_dangerous' => true]);

Condition::define('within_approval_limit', function ($user, $invoice) {
    return (int) $invoice->amount <= (int) $user->approval_limit;
});

Permission::define('invoice.approve')->when('within_approval_limit');

$manager = User::find(10);
$manager->givePermissionTo('invoice.approve');
$manager->approval_limit = 50_000;
$manager->save();

$ok = Invoice::query()->create(['amount' => 20_000]);
$over = Invoice::query()->create(['amount' => 125_000]);

$manager->can('invoice.approve', $ok);   // true
$manager->can('invoice.approve', $over); // false — CONDITION_FAILED

$decision = $manager->authorizeFor('invoice.approve', $over);
$decision->reason;      // CONDITION_FAILED
$decision->conditions;  // ['within_approval_limit' => false]

$cover = User::find(11);

$delegation = $manager->delegate(
    'invoice.approve',
    to: $cover,
    until: now()->addHours(4),
    reason: 'On leave',
    resource: $ok, // optional: only this invoice
);

$cover->can('invoice.approve', $ok); // true until expiry or revoke
$manager->revokeDelegation($delegation);

// config/permission.php
'teams' => [
    'enabled' => true,
    '

use Libinkk\Permission\Authorization\AuthorizationContext;

$user->assignRole('editor', $orgA);
$user->assignRole('viewer', $orgB);

AuthorizationContext::tenant($orgA);
$user->can('posts.create'); // editor in A

AuthorizationContext::switch($orgB);
$user->can('posts.create'); // isolated — viewer in B

use Libinkk\Permission\Scopes\Scope;

$orgScope = Scope::for($organization, 'organization');
$wsScope = Scope::for($workspace, 'workspace', $orgScope);

AuthorizationContext::scope($workspace);

public function handle($request, Closure $next)
{
    if ($tenant = $request->route('organization')) {
        AuthorizationContext::tenant($tenant);
    }

    return $next($request);
}

Permission::defineResource('posts', ['view', 'create', 'update', 'delete', 'publish'], [
    'group' => 'Posts',
]);

Permission::crud('invoices'); // view/create/update/delete

Permission::inGroup('Posts');

$role = Role::findOrCreate('admin');
$role->givePermissionTo('posts.create', 'posts.delete');
$role->revokePermissionTo('posts.delete');
$role->syncPermissions(['posts.view', 'posts.create']);
$role->hasPermissionTo('posts.view');

$user->assignRole('editor');
$user->removeRole('editor');
$user->syncRoles('editor', 'author');
$user->hasRole('editor');
$user->hasAnyRole('editor', 'admin');
$user->hasAllRoles('editor', 'author');

$user->givePermissionTo('reports.export');
$user->revokePermissionTo('reports.export');
$user->getRoleNames();
$user->getPermissionNames();

$export = $user->exportAccess();
$export['totals'];
$export['effective_permissions'];

$role->givePermissionTo('posts.*');
$user->can('posts.view');   // true
$user->can('posts.delete'); // true

$user->givePermissionTo('posts.view.*');
$user->can('posts.view.own'); // true

Role::inherit('admin', 'manager');   // admin inherits manager
Role::inherit('manager', 'editor');
Role::uninherit('admin', 'manager');

$user->denyPermissionTo('posts.delete'); // beats role allow
$role->denyPermissionTo('posts.publish');

Permission::define('posts.update.own')
    ->when(fn ($user, $post) => $post->author_id === $user->id);

$user->can('posts.update.own', $post);

Role::findOrCreate('editor', 'api');
Permission::findOrCreate('posts.view', 'api');

$user->givePermissionTo('reports.export', expiresAt: now()->addDays(7));
$user->givePermissionTo('reports.export', startsAt: now()->addDay(), expiresAt: now()->addWeek());
$user->assignRole('contractor', expiresAt: now()->addHours(4));

'audit' => [
    'enabled' => true,
    'decisions' => false, // every can() — leave off in production
],

$permission->history();
$permission->rollbackTo(1);

Route::middleware('permission:posts.create')->group(...);
Route::middleware('permission:posts.create|posts.update')->group(...);
Route::middleware('role:admin|editor')->group(...);

'middleware' => [
    'permission_logic' => 'or', // or 'and'
    'role_logic' => 'or',
],

permission_payload(); // current user — UI only

use Libinkk\Permission\Filament\AuthorizesFilamentResource;
use Libinkk\Permission\Filament\FilamentAuthorization;

class PostResource extends Resource
{
    use AuthorizesFilamentResource;

    protected static ?string $permissionResource = 'posts';
}

Action::make('approve')->visible(FilamentAuthorization::visible('invoice.approve'));
BulkAction::make('delete')->authorize(FilamentAuthorization::bulkCallback('posts.delete'));

$panel->middleware(\Libinkk\Permission\Filament\PermissionFilamentPlugin::middleware());

use Libinkk\Permission\Attributes\Permission;

class PostController
{
    #[Permission('posts.publish', description: 'Publish posts', group: 'Posts')]
    public function publish() {}
}

$report = $user->debugAuthorization('invoice.approve', $invoice);
$report['final'];  // ALLOWED | DENIED
$report['text'];
$report['checks'];

$user->preloadAuthorization();
$user->permissionsFor('posts');
// ['view' => true, 'create' => true, 'update' => false, ...]

$decisions = $user->authorizeMany('posts.update', $posts);

use Libinkk\Permission\Permissions\Permission;
use Libinkk\Permission\Testing\InteractsWithAuthorization;

Permission::fake();
Permission::allow('posts.create');
Permission::deny('posts.delete');

$this->assertCan($user, 'posts.update');
$this->assertCannot($user, 'posts.delete', $post);

return [
    'enabled' => true,
    'default_guard' => 'web',
    'database' => [
        'primary_key' => 'bigint', // bigint | uuid | ulid
        'user_key' => 'bigint',
    ],
    'cache' => [
        'enabled' => true,
        'prefix' => 'libinkk:permission:v1',
        'redis' => ['enabled' => false, 'store' => 'redis'],
        'decision_cache' => ['enabled' => true],
    ],
    'teams' => ['enabled' => false, '

bash
php artisan vendor:publish --tag=libinkk-permission-config
php artisan migrate

bash
php artisan permission:doctor

bash
php artisan permission:resource posts --actions=view,create,update,delete,publish --group=Posts

bash
php artisan permission:explain 10 invoice.approve

bash
php artisan permission:export 42 --type=App\\Models\\User --format=table

bash
php artisan vendor:publish --tag=libinkk-permission-frontend

jsx
import { PermissionProvider, usePermission, Can, CanAny, CanAll } from '@/js/vendor/libinkk-permission/react';

<PermissionProvider value={window.__LIBINKK_PERMISSION__}>
    <Can permission="posts.create"><CreatePostButton /></Can>
    <CanAny permissions={['posts.create', 'posts.update']}><PostActions /></CanAny>
    <CanAll permissions={['posts.view', 'posts.create']}><AdvancedEditor /></CanAll>
</PermissionProvider>

bash
php artisan permission:discover --path=app/Http/Controllers
php artisan permission:sync
php artisan permission:sync --dry-run

bash
php artisan permission:install
php artisan permission:resource posts
php artisan permission:discover
php artisan permission:sync
php artisan permission:validate
php artisan permission:doctor
php artisan permission:graph --json
php artisan permission:unused
php artisan permission:explain {userId} invoice.approve
php artisan permission:cache
php artisan permission:cache:clear
php artisan permission:export {userId}

bash
php artisan permission:doctor --json
php artisan permission:validate
php artisan permission:explain {id} posts.delete --json