Laratrust

Laratrust is a Laravel package that adds a complete, flexible role-based access control (RBAC) layer to your application. It lets you assign multiple roles and permissions to users, scope them to teams, and check authorization through an expressive trait-based API, middleware, or Laravel’s native gates and policies.

Built for real-world multi-tenant and multi-user applications, Laratrust supports multiple user models, permission and role caching for performance, lifecycle events, and a simple bundled administration panel for managing roles and permissions.

What You Get

• A trait-based API to attach roles and permissions to any Eloquent user model
• Route and controller middleware for role, permission, and ability checks
• Team scoping so roles and permissions can differ per team or tenant
• Built-in role and permission caching to avoid repeated database queries
• Integration with Laravel gates and policies plus a bundled admin panel

Common Use Cases

• Adding admin, editor, and member roles to a Laravel SaaS application
• Scoping permissions per team or organization in a multi-tenant app
• Protecting routes and API endpoints with permission-based middleware
• Managing granular access rules through a database-driven admin panel

Under The Hood

Architecture — Laratrust registers a LaratrustServiceProvider that binds a Laratrust facade (src/Laratrust.php) as the main entry point, delegating checks to a CheckersManager that swaps between default in-memory checkers and query-based checkers (src/Checkers/) for roles and users. User models opt in through the HasRolesAndPermissions trait, which composes smaller traits for events, scopes, and dynamic relationship calls, while Role, Permission, and Team models plus Ability/Permission/Role middleware form the enforcement layer.

Tech Stack — The package targets PHP 8.1+ and Laravel 10 through 13, depending only on the framework and kkszymanowski/traitor. It ships Blade views, a Tailwind-built admin panel (webpack.mix.js, tailwind.config.js), publishable config and migration stubs, and uses Orchestra Testbench, PHPUnit, and Mockery for its test suite.

Code Quality — The codebase uses declare(strict_types=1) and typed signatures throughout, and carries an extensive PHPUnit suite covering models, middleware, checkers (including cache variants), events, scopes, and the facade under tests/. Logic is separated cleanly into checkers, traits, and contracts, making behavior easy to override.

API Design — The public surface is ergonomic and idiomatic to Laravel: a Laratrust facade plus fluent trait methods like hasRole(), hasPermission(), and can(), route middleware, and gate integration. Comprehensive external documentation and version-compatibility tables keep the getting-started path short for existing Laravel developers.