Assigning roles

composer require langsys/laravel-access-guard Copy

PHP 8.2+ Laravel 10 / 11 / 12

Packagist ↗ GitHub ↗ Also: API Keys

If you don’t already have a membership scheme, add the HasRolesInEntities trait to your subject and implement AuthorizableInEntity. You get entity-scoped assignment backed by the model_has_roles pivot — no custom pivot or userRoleInEntity() to write:

use Langsys\AccessGuard\Concerns\HasRolesInEntities;
use Langsys\AccessGuard\Contracts\AuthorizableInEntity;

class User extends Authenticatable implements Authorizable, AuthorizableInEntity
{
    use HasRolesInEntities;
}

$user->assignRole('project_admin', $project);   // role value, backed enum, or Role model
$user->syncRoles(['viewer'], $project);
$user->removeRole('project_admin', $project);

$user->hasRole('project_admin', $project);                // bool
$user->hasPermissionInEntity('edit_projects', $project);  // unions every role + direct grant
$user->rolesInEntity($project);                           // Collection<Role>
$user->permissionsInEntity($project);                     // array<string> (roles ∪ direct)

A subject can hold multiple roles in one entity; permission checks union them. Override entityIsDisabled($entity) to exclude a subject from an entity even when a role would grant access (e.g. a user who left a project).

Note

Already have your own pivot (like Langsys’s organization_has_users.role)? Skip the trait and implement AuthorizableByUser instead — both paths are supported. See Wiring models.

Direct permissions

Sometimes a subject needs one permission in an entity without minting a role for it. Grant it directly — backed by the model_has_permissions pivot, still entity-scoped:

$user->givePermission('export_data', $project);
$user->revokePermission('export_data', $project);

$user->directPermissionsInEntity($project);   // array<string> — just the direct grants
$user->permissionsInEntity($project);         // array<string> — roles ∪ direct grants

hasPermissionInEntity() and every Gate check see the union of role-derived and direct permissions, so the two compose freely.