PHPackages                             nahid/permit - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. nahid/permit

ActiveLibrary[Authentication & Authorization](/categories/authentication)

nahid/permit
============

Permit is a laravel ACL and authorization package

v2.3.1(2y ago)732.9k23[1 PRs](https://github.com/nahid/permit/pulls)CC-BY-3.0PHPPHP >=5.5.9CI failing

Since May 23Pushed 1y ago4 watchersCompare

[ Source](https://github.com/nahid/permit)[ Packagist](https://packagist.org/packages/nahid/permit)[ RSS](/packages/nahid-permit/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (2)Versions (17)Used By (0)

Laravel Permit
==============

[](#laravel-permit)

Laravel Permit is an authorization and ACL package for laravel. Its fast and more customizable. You can easily handle role based ACL or specific user wise permission. So, Lets start a journey with Laravel Permit.

Installation
------------

[](#installation)

You can start it from composer. Go to your terminal and run this command from your project root directory.

```
composer require nahid/permit
```

Wait for a while, its download all dependencies.

Configurations
--------------

[](#configurations)

After complete installation then you have to configure it. First copy these line paste it in `config/app.php` where `providers` array are exists.

```
Nahid\Permit\PermitServiceProvider::class,
```

and add the line for facade support

```
'Permit'    => Nahid\Permit\Facades\Permit::class,
```

hmm, Now you have to run this command to publish necessary files.

```
php artisan vendor:publish --provider="Nahid\Permit\PermitServiceProvider"
```

and then go to `config/permit.php` and edit with your desire credentials.

```
return [
    'users' => [
        'model' => \App\Models\User::class,
        'table' => 'users',
        'role_column'   => 'type'
    ],

    'super_user'    =>  'admin',

    'abilities'   => [
       // "module"  => ['ability1', 'ability2', 'ability3'=>'policy_module.policy'],
    ],

    'policies'  => [
        /*'module' => [
            'update'    => '\App\Permit\Policies\PostPolicy@update',
        ],*/
    ],

    'roles' => [
        /*'role_name' => [
            'module.ability',
        ],*/
    ]
];
```

Now run this command for migrations

```
php artisan migrate
```

You are all most done, just add this trait `Nahid\Permit\Users\Permitable` in your `User` model. Example

```
namespace App;

use Illuminate\Database\Eloquent\Model;
use Nahid\Permit\Users\Permitable;

class User extends Model
{
    use Permitable;
}
```

Yeh, its done.

How does it work?
-----------------

[](#how-does-it-work)

Its a common question. But first you have to learn about our database architecture. When you run migrate command then we create a table 'permissions' with field 'role\_name' and 'permission', and add two column 'role' and 'permissions' in `users` table. `role` column store users role and `permissions` column store user specific controls. Here `role` column has a relation with `permissions.role_name` column with its controls. `permissions.permission` handle role based control.

We store permissions as JSON format with specific modules and abilities.

```
{
    "user": {
        "create": true,
        "update": true
    },
    "post": {
        "create": false,
        "update":"\\App\\Permit\\Policies\\PostPolicy@update",
        "delete": true
    }
}
```

Here `user` and `post` is a service/module name and `create`, `update` and `delete` or others are abilities.

### Set User Role

[](#set-user-role)

##### Syntax

[](#syntax)

`bool Permit::setUserRole(int $user_id, string $role_name)`

##### Example

[](#example)

```
Permit::setUserRole(1, 'admin');
```

### Set User Permission

[](#set-user-permission)

##### Syntax

[](#syntax-1)

`bool Permit::setUserPermissions(int $user_id, string $module, array $abilities)`

##### Example

[](#example-1)

```
Permit::setUserPermissions(1, 'post', ['create'=>true, 'update'=>true]);
```

### Set Role Permission

[](#set-role-permission)

##### Syntax

[](#syntax-2)

`bool Permit::setRolePermissions(string $role_name, string $module, array $abilities)`

##### Example

[](#example-2)

```
Permit::setRolePermissions('admin', 'post', ['create'=>true, 'update'=>true]);
```

How to Authorize an event?
--------------------------

[](#how-to-authorize-an-event)

### Check user ability

[](#check-user-ability)

```
$user = User::find(1);

if (Permit::userCan($user, 'post.create')) {
    //do something
}
```

In `post.create` is an event with module/service. Here `post` is a module and `create` is an ability.

So if the user is authorized with post create event then the user will be passed.

`Permit::userCan()` method return boolean. If you want to throw Unauthorized exception you may use

`Permit::userAllows()` with same parameters.

### Check user role ability

[](#check-user-role-ability)

```
$user = User::find(1);

if (Permit::roleCan($user, 'post.create')) {
    //do something
}
```

Here when given users role allowed this event then its passed. Here is a similar method for throw exception

`Permit::roleAllows()`

### Check Users all ability

[](#check-users-all-ability)

You can check user ability from user or user role. Here we check both(user and role) permissions but if user specific permission was set then its priority will be first.

```
$user = User::find(1);

if (Permit::can($user, 'post.create')) {
    //do something
}
```

and here is a alternate method for throw exception

`Permit::allows()`

Policy
------

[](#policy)

Policy is a feature like laravel native authorization but its quite easy. Permit allows you to manage ACL and Authorization in a same line. I know your first question is where we use `Policy`?

Lets see an example, suppose you have a user commenting system where every user comment under a blog post and comment owner can edit and deletes their comments. So you have to apply an authorization system where user can modify his/her own comment. So here we have to implement our custom policy. Take a look

#### Make a policy

[](#make-a-policy)

First we have to create a class for policy.

```
namespace App\Policies;

use App\Comment;
use App\User;

class CommentPolicy
{
    public function update(User $user, Comment $comment)
    {
        return $user->id == $comment->user_id;
    }
}
```

and now map this policy with our config file. Go to `config/permit.php` and update this section in `policies

```
    ,'policies'  => [
        'comment'  => [
            'update'    => '\App\Policies\CommentPolicy@update'
        ]
    ]
```

Now you have bind this policy with an ability. Suppose we have a module about comment. so this ability will look like in `config/permit.php` `abilities` section

```
"comment"  => ['create', 'update'=>'comment.update', 'delete'],
```

here `'update'=>'comment.update'` update is an ability and `comment.update` is a policy. This system are bind policy with ability. so now you can use this policy like a general ability.

You can predefined your all roles permissions in config file. First set your aprox abilities and then assign abilities to roles. Take a look

```
'abilities'   => [
        "comment"  => ['create', 'update'=>'comment.update', 'delete'],
        "user"  => ['create', 'update', 'delete'],
    ],

    'roles' => [
        'admin' => [
            'post.*',
            'user.*',
        ],

        'user'    => [
            'post.create',
            'post.update',
            'user.create',
            'user.update',
        ]
    ],

    'policies'  => [
        'comment'  => [
            'update'    => '\App\Policies\CommentPolicy@update'
        ]
    ]
```

Here admin and user are role and its value is permissions or abilities. But you can't use this because its not synced with database. so run this command from your terminal

```
php artisan permit:sync
```

#### How to use policy based ability

[](#how-to-use-policy-based-ability)

In previous section we are bind `comment.update` policy with an ability and thats are same name. Lets check currently opened comment is authorized for logged in user.

```
$comment = Comment::find(1);
Permit::allows(auth()->user(), 'comment.update', [$comment]);
```

here first parameter is authorized user, second one is permission and third one is policy method's parameter. we are always automatically bind authenticated user as a first parameter and then others parameter will pass.

You can use others method like `roleCan`, 'userCan', all helper functions and blade directives as same procedure.

Sometimes you have to check if the given user able to perform for any ability. so we make it easy. lets see

```
Permit::allows(auth()->user(), ['post.create', 'comment.create']);
```

But if your ability was bind with a policy and its required paramters, then you can pass abilities with associative array.

```
$comment = Comment::find(1);
Permit::allows(auth()->user(), ['post.create', 'comment.update'=>[$comment], 'comment.create']);
```

Here if the given user is assigned to any one abilities then its allows.

### Commands

[](#commands)

We provide several command for make user experience better

### `php artisan permit:sync`

[](#php-artisan-permitsync)

Sync with your composed permissions with database.

### `php artisan permit:set`

[](#php-artisan-permitset)

Add permission to an user or role

### `php artisan permit:remove`

[](#php-artisan-permitremove)

Remove permissions from an user or role

### `php artisan permit:fetch`

[](#php-artisan-permitfetch)

Get permissions of an user or a role

### `php artisan permit:role`

[](#php-artisan-permitrole)

Create a new role

### Helper functions

[](#helper-functions)

Here you can use helper function instead of facades.

#### user\_can()

[](#user_can)

You can use `user_can()` instead of `Permit::userCan()`

#### user\_allows()

[](#user_allows)

You can use `user_allows()` instead of `Permit::userAllows()`

#### role\_can()

[](#role_can)

You can use `role_can()` instead of `Permit::roleCan()`

#### role\_allows()

[](#role_allows)

You can use `role_allows()` instead of `Permit::roleAllows()`

#### canDo()

[](#cando)

You can use `canDo()` instead of `Permit::can()`

#### allows()

[](#allows)

You can use `allows()` instead of `Permit::allows()

Blade Directives
----------------

[](#blade-directives)

Sometimes you may want to use this functionalities in you view. Permit comes with all blade directives.

#### Example

[](#example-3)

```
@userCan($user, 'post:create')
    Link
@endUserCan

```

You can also use else directive

```
@userCan($user, 'post:create')
    Link
@elseDo
    Link 2
@endUserCan

```

#### List of directives

[](#list-of-directives)

- `@userCan()`
- `@elseUserCan`
- `@endUserCan()`
- `@roleCan()`
- `@elseRoleCan()`
- `@endRoleCan()`
- `@allows()`
- `@endAllows()`
- `@elseAllows()`

If you have any kind of query, please feel free to share with me

Thank you

###  Health Score

41

—

FairBetter than 89% of packages

Maintenance31

Infrequent updates — may be unmaintained

Popularity37

Limited adoption so far

Community18

Small or concentrated contributor base

Maturity66

Established project with proven stability

 Bus Factor1

Top contributor holds 93.5% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~163 days

Recently: every ~507 days

Total

16

Last Release

826d ago

Major Versions

v0.1.1 → v1.0.02018-01-15

v1.0.0 → v2.0.02018-01-16

v2.3.0 → v3.0.x-dev2019-12-23

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/3167309?v=4)[Nahid Bin Azhar](/maintainers/nahid)[@nahid](https://github.com/nahid)

---

Top Contributors

[![nahid](https://avatars.githubusercontent.com/u/3167309?v=4)](https://github.com/nahid "nahid (58 commits)")[![Ivanshamir](https://avatars.githubusercontent.com/u/29983451?v=4)](https://github.com/Ivanshamir "Ivanshamir (2 commits)")[![abdurrahmanriyad](https://avatars.githubusercontent.com/u/16055472?v=4)](https://github.com/abdurrahmanriyad "abdurrahmanriyad (1 commits)")[![ssi-anik](https://avatars.githubusercontent.com/u/2676602?v=4)](https://github.com/ssi-anik "ssi-anik (1 commits)")

---

Tags

accessibilityaclauthorizationlaravelpermissionsuser-rolesauthorizationaclpermit

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/nahid-permit/health.svg)

```
[![Health](https://phpackages.com/badges/nahid-permit/health.svg)](https://phpackages.com/packages/nahid-permit)
```

###  Alternatives

[santigarcor/laratrust

This package provides a flexible way to add Role-based Permissions to Laravel

2.3k5.4M43](/packages/santigarcor-laratrust)[casbin/casbin

a powerful and efficient open-source access control library for php projects.

1.3k1.4M54](/packages/casbin-casbin)[nette/security

🔑 Nette Security: provides authentication, authorization and a role-based access control management via ACL (Access Control List)

3839.3M279](/packages/nette-security)[casbin/laravel-authz

An authorization library that supports access control models like ACL, RBAC, ABAC in Laravel.

324339.9k4](/packages/casbin-laravel-authz)[pktharindu/nova-permissions

Laravel Nova Grouped Permissions (ACL)

136387.1k](/packages/pktharindu-nova-permissions)[dereuromark/cakephp-tinyauth

A CakePHP plugin to handle user authentication and authorization the easy way.

129228.6k10](/packages/dereuromark-cakephp-tinyauth)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)