Subject resolution

composer require langsys/laravel-access-guard Copy

PHP 8.2+ Laravel 10 / 11 / 12

Packagist ↗ GitHub ↗ Also: API Keys

On each authorize() call, Access Guard:

1. checks for a super admin (the resolved user implements Authorizable and isSuperAdmin() is true) → allow;
2. otherwise picks the API key if one is present on the request, else the authenticated user;
3. runs the key path (keyHasPermission and keyBelongsToEntity) or the user path (userRoleInEntity → the role’s hasPermission, and not userHasDisabledEntity).

By default the user comes from Auth::user() and the API key from the api_key request attribute (set by langsys/laravel-api-keys). Override either from a service provider:

AccessGuard::resolveUserUsing(fn () => /* ... */);
AccessGuard::resolveApiKeyUsing(fn () => /* ... */);

Caution

The resolvers run on every authorization check, and whatever they return is the identity every decision is made for. If your resolver memoises (a per-request cache, a function-static), it must invalidate when the identity changes, not only when it disappears — a cache that survives a subject swap serves the previous subject’s authorization to the next one, which under Octane or queue workers means across requests.