Wildcard permissions

composer require langsys/laravel-access-guard Copy

PHP 8.2+ Laravel 10 / 11 / 12

Packagist ↗ GitHub ↗ Also: API Keys

Off by default (checks are exact-match). Enable wildcard.enabled and a held permission may use * as a segment wildcard:

// config/access-guard.php → 'wildcard' => ['enabled' => true, 'separator' => '.']

$role->grantPermissions(['projects.*']);
$user->hasPermissionInEntity('projects.edit', $project);   // true
$user->hasPermissionInEntity('projects.delete', $project); // true
$user->hasPermissionInEntity('users.edit', $project);      // false

$role->grantPermissions(['*']);                            // grants everything

Wildcards apply only to held permissions; the permission you check for is always literal. With wildcards off, projects.* is just a permission named projects.*.