Controversial opinion: spatie/laravel-permissions doesn't help a whole lot with authorization.
... so I decided to write my own permissions library. https://laravel-warrant.dev
A while back I was adding permissions to an app and a friend told me to just use spatie/laravel-permission, since everyone does. So I read through it and... I kind of walked away confused about what it was actually doing for me. As far as I could tell it mostly gives you some tables and methods to track which roles and permissions a user has. Basically inserting and deleting rows.
Which is fine, but that was never the part I was stuck on. My hard part was stuff like "a user can edit a document if it's theirs, or if they manage the team it's in, but not once it's locked, unless they're an admin." A permission string like edit documents can't say any of that.
So I still have to hand-write a Policy for it. And then write the same logic AGAIN as a query scope so my list pages could show only the rows they're allowed to touch. Two copies of one rule that slowly drift apart.
So Spatie handles the easy 10% (storing the assignment) and leaves me the 90% that's actually annoying.
So I built Laravel Warrant for the 90%. You write the rule once as text and it compiles to SQL:
if is_self or manages_team they can update
if is_locked and not is_admin they cannot update
if is_admin they can *
And that one rule answers all three of the questions I would have had to rewrite by hand:
$document->hasAbility('update'); // can they?
Document::query()->hasAbility('update')->paginate(); // which rows?
Document::query()->selectAbilities()->get(); // what can they do to each row?
The "which rows" one is just a WHERE clause, so the database does the filtering instead of me loading every row into PHP.
It's still in beta and I'm actively testing it, so the API might change. Honestly I'm mostly posting to see if this resonates with anyone else or if I'm just weird. Do you think you would want to use something like this and would it solve a real pain point for you? Any ideas on how to make this better?
Docs: https://laravel-warrant.dev GitHub: https://github.com/patrickjames242/laravel-warrant
Would love any feedback.