Laravel RBAC

A lightweight, framework-friendly Role-Based Access Control (RBAC) package for Laravel.

Designed for projects that need a simple, flexible and extensible authorization layer based on Roles and Permissions, without unnecessary complexity.

Features

• Role and Permission management
• Polymorphic role assignments
• Full-access roles
• Route middleware for roles and permissions
• Configurable models
• Configurable table names
• Laravel 11 & 12 support
• PHP 8.2+

Requirements

• PHP 8.2+
• Laravel 11.x / 12.x

Installation

Install the package using Composer.

composer require fbpkg/laravel-rbac

Configuration

Publish the configuration file to customize the package.

php artisan vendor:publish --tag=rbac-config

Available options include:

• Role model
• Permission model
• Database table names

Database

Publish the migration.

php artisan vendor:publish --tag=rbac-migrations

Run the migration.

php artisan migrate

Usage

Add the HasRoles trait

use Fbpkg\Rbac\Traits\HasRoles;

class User extends Authenticatable
{
    use HasRoles;
}

Create a role

use Fbpkg\Rbac\Models\Role;

Role::create([
    'name' => 'admin',
    'display_name' => 'Administrator',
]);

Create a role with unrestricted access.

Role::create([
    'name' => 'developer',
    'display_name' => 'Developer',
    'has_full_access' => true,
]);

Create a permission

use Fbpkg\Rbac\Models\Permission;

Permission::create([
    'name' => 'users.create',
    'display_name' => 'Create Users',
]);

Assign roles

$user->assignRole('admin');

Assign multiple roles.

$user->assignRole(
    'admin',
    'manager'
);

Synchronize roles.

$user->syncRoles(
    'manager'
);

Remove roles.

$user->removeRole(
    'manager'
);

Check roles

$user->hasRole('admin');

$user->hasAnyRole(
    'admin',
    'manager'
);

$user->hasAllRoles(
    'admin',
    'manager'
);

Assign permissions

$role->assignPermission(
    'users.create'
);

Assign multiple permissions.

$role->assignPermission(
    'users.create',
    'users.edit'
);

Synchronize permissions.

$role->syncPermissions(
    'users.create'
);

Remove permissions.

$role->removePermission(
    'users.edit'
);

Check permissions

$user->hasPermission(
    'users.create'
);

$user->hasAnyPermission(
    'users.create',
    'users.edit'
);

$user->hasAllPermissions(
    'users.create',
    'users.edit'
);

Full Access Roles

Roles with the has_full_access flag automatically bypass all permission checks.

This is useful for roles such as Developer, Owner, or other privileged system accounts.

Route Middleware

Protect routes by role.

Route::middleware('role:admin')->group(function () {
    //
});

Protect routes by permission.

Route::middleware('permission:users.create')->group(function () {
    //
});

License

This package is open-sourced software licensed under the MIT License.