The auth package exports RBAC services and models for users, roles, and permissions. The plugin package can use role/permission metadata to describe navigation and extension visibility, but hiding a UI item is not authorization.
Enforce access on the server#
A robust authorization flow should:
- Resolve the current authenticated user on the server.
- Load or evaluate the required role/permission using the auth service API for the installed version.
- Deny by default if the user, permission, or policy result is missing.
- Perform the protected operation only after the check succeeds.
- Test both allowed and denied cases.
The package exposes RbacService and user role/permission types. Inspect the installed public declarations for the exact method names and return types; do not assume Laravel's Gate/Policy API is implemented identically.
Plugin navigation#
Plugin navigation items and extensions may declare roles and permissions metadata. Use those fields to control what appears in the interface, but repeat authorization at the server action, route handler, or service boundary that performs the protected operation.
Multi-tenant applications#
RBAC does not automatically guarantee tenant isolation. Include tenant identity in data access and policy checks, constrain queries to the current tenant, and enforce critical boundaries at the database or repository layer when possible.
