README

Role, permission, and plan-based access control for Laravel applications.

Package: andmarruda/authorization-module Namespace: Andmarruda\\AuthorizationModule

Requirements

• PHP 8.1+
• Laravel 11+
• Database configured for your app

Install

composer require andmarruda/authorization-module

Provider auto-discovery is enabled.

If your app does not use Laravel package auto-discovery, register providers manually:

// config/app.php
'providers' => [
    Spatie\Permission\PermissionServiceProvider::class,
    Andmarruda\AuthorizationModule\AuthorizationModuleServiceProvider::class,
],

Publish configs:

php artisan vendor:publish --provider="Spatie\\Permission\\PermissionServiceProvider"
php artisan vendor:publish --tag=authorization-config

Publish all required migrations (Authorization Module + Spatie) with one command:

php artisan authorization:publish-migrations

Use --force to overwrite previously published files.

Run migrations:

php artisan migrate

Application Setup

1. Add the trait to your User model

<?php

namespace App\Models;

use Andmarruda\AuthorizationModule\Contracts\Authorizable;
use Andmarruda\AuthorizationModule\Traits\HasAuthorization;
use Illuminate\Foundation\Auth\User as Authenticatable;

class User extends Authenticatable implements Authorizable
{
    use HasAuthorization;
}

2. Configure config/authorization.php

Set your user model:

'user_model' => App\Models\User::class,

Adjust route prefix and middleware as needed:

'route_prefix' => 'authorization',
'middleware' => ['auth'],

3. Configure Spatie (if needed)

If you changed guards/tables in config/permission.php, keep them aligned with your app guard strategy.

Available Endpoints

By default all endpoints are under /authorization.

Roles and Permissions

• GET /authorization/roles
• POST /authorization/roles
• PUT /authorization/roles/{id}
• DELETE /authorization/roles/{id}
• POST /authorization/roles/{id}/permissions
• GET /authorization/permissions
• POST /authorization/permissions
• DELETE /authorization/permissions/{id}
• GET /authorization/users/{id}/roles
• POST /authorization/users/{id}/roles
• DELETE /authorization/users/{id}/roles
• PUT /authorization/users/{id}/roles
• GET /authorization/users/{id}/permissions

Plans

• GET /authorization/plans
• POST /authorization/plans
• PUT /authorization/plans/{id}
• DELETE /authorization/plans/{id}
• GET /authorization/users/{id}/plans
• POST /authorization/users/{id}/plans/subscribe
• POST /authorization/users/{id}/plans/cancel
• POST /authorization/users/{id}/plans/consume

Deployment Guide

Production checklist

1. Install package and publish configs.
2. Set 'user_model' in config/authorization.php.
3. Ensure APP_ENV, APP_DEBUG, DB credentials, and cache drivers are correct.
4. Run migrations in target environment.
5. Clear and rebuild caches.
6. Run smoke tests on auth routes.

Typical deploy commands

composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache
php artisan route:cache
php artisan view:cache

If your deployment creates cache before publishing config, run publish first and rebuild cache.

Post-deploy verification

• Confirm role/permission CRUD endpoints respond.
• Confirm user-role assignment works.
• Confirm plan subscription/consume flow works.
• Confirm audit logs and plan tables are being written.

Notes

• Plan enforcement behavior is controlled by authorization.plans.* options.
• Routes are unversioned by default. For API versioning, apply a v1 prefix in your application routing strategy.