lomkit/laravel-access-control

Laravel Access Control

Laravel Access Control allows you to fully secure your application in two key areas: Policies and Queries. Manage everything in one place!

Requirements

PHP 8.2+ and Laravel 12+

Documentation, Installation, and Usage Instructions

See the documentation for detailed installation and usage instructions.

What it does

You first need to define the perimeters concerned by your applications.

Create the model control:

class PostControl extends Control
{
    protected function perimeters(): array
    {
        return [
            GlobalPerimeter::new()
                ->allowed(function (Model $user, string $method) {
                    return $user->can(sprintf('%s global models', $method));
                })
                ->should(function (Model $user, Model $model) {
                    return true;
                })
                ->query(function (Builder $query, Model $user) {
                    return $query;
                }),
            ClientPerimeter::new()
                ->allowed(function (Model $user, string $method) {
                    return $user->can(sprintf('%s client models', $method));
                })
                ->should(function (Model $user, Model $model) {
                    return $model->client()->is($user->client);
                })
                ->query(function (Builder $query, Model $user) {
                    return $query->where('client_id', $user->client->getKey());
                }),
        // ...

Specify the control in your model:

class Post extends Model
{
    use HasControl;
}

Then set up your policy:

class PostPolicy extends ControlledPolicy
{
    protected string $model = Post::class;
}

and you are ready to go !

App\Models\Post::controlled()->get() // Apply the Control to the query

$user->can('view', App\Models\Post::first()) // Check if the user can view the post according to the policy

A controlled query run without an authenticated user returns no rows.