Download the PHP package misaf/vendra-permission without Composer

Vendra Permission

Role and permission management for Vendra applications.

Features

• Role and permission resources in the shared Customers cluster
• Role and permission CRUD resources
• Manage role-permission relations from role pages
• Tenant-scoped Pennant feature flags for module/resource access
• Feature toggle Artisan command per tenant
• Policy classes and enums for role/permission actions
• Translation files for en, de, and fa
• Configurable Gate::after() admin bypass role

Requirements

• PHP 8.4+
• Laravel 13
• Filament 5
• Livewire 4
• Pest 4
• Tailwind CSS 4
• laravel/pennant
• misaf/vendra-support
• misaf/vendra-user
• awcodes/filament-badgeable-column
• misaf/filament-jalali
• spatie/laravel-permission

Installation

Publish Spatie Permission's configuration if it is not already present, then publish Vendra's tenant-aware permission migration:

Optional: publish module translations:

Optional: publish module config:

If you use Pennant with the database driver, ensure Pennant storage is migrated in your application.

Configuration

If you want Spatie to use this module's models everywhere in your app, set config/permission.php:

The admin bypass role is configurable in config/vendra-permission.php:

The config key is admin_role (short and local to this file). The env var is VENDRA_PERMISSION_ADMIN_ROLE (prefixed to avoid global collisions). It defaults to RoleEnum::Admin — the top-level role granted to a tenant administrator; admins may create additional scoped roles themselves. This value is used for both the Gate::after() admin bypass and excluding that role from the roles table query.

Pennant feature behavior is configured in config/vendra-permission.php:

Filament

Resources are registered on the admin panel through PermissionPlugin:

• Roles
• Permissions

Both resources live in the shared Customers cluster.

Changing a role's guard goes through ChangeRoleGuardAction: each attached permission is swapped for the permission of the same name under the new guard, and dropped when that guard has none. Permissions are shared between roles, so their own guard is never changed.

Access is feature-gated against the current scope returned by the shared TenantResolver:

• vendra-permission.module-enabled controls both resources
• vendra-permission.role-management controls role resource access
• vendra-permission.permission-management controls permission resource access
• vendra-permission.bulk-role-assignment controls attach/detach role bulk actions

Pennant Features

Feature resolution must be enabled. Tenant-aware applications reject non-tenant scopes; unresolved feature values use features.defaults.

Feature map:

Artisan Commands

Toggle tenant features with:

feature accepts:

• enum case name, e.g. RoleManagement
• full key, e.g. vendra-permission.role-management
• short key, e.g. role-management
• all

tenant accepts:

• tenant id
• tenant slug

The command requires vendra-permission.features.enabled to be true.

Examples:

Seed permissions and demo data for a tenant with:

Usage

Use this package's tenant feature flags and console command to control access in each tenant:

• vendra-permission.module-enabled
• vendra-permission.role-management
• vendra-permission.permission-management
• vendra-permission.bulk-role-assignment

Role/permission CRUD and assignment semantics follow Spatie Permission. See: https://spatie.be/docs/laravel-permission

Demo seeders use bundled JSON fixtures in production and when their declared factory classes are unavailable. Local monorepo development continues to use factories when they are autoloadable.

Testing

Run the package checks from the project root:

License

MIT. See LICENSE.