Skip to content

javaabu/permissions v3 - #15

Open
n4ff4h wants to merge 11 commits into
mainfrom
next-gen
Open

javaabu/permissions v3#15
n4ff4h wants to merge 11 commits into
mainfrom
next-gen

Conversation

@n4ff4h

@n4ff4h n4ff4h commented Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

javaabu/permissions v3, built on next-gen for the Javaabu next-gen effort (epic #14). Please review and merge when ready; main stays on 2.x until then.

What's new

  • Registration API: packages and apps declare permissions, roles and default policies in a service provider (Permissions::register(), resource(), role(), policy()), and php artisan permissions:sync (or PermissionsSeeder) writes them to the database. Registering never touches the database. --prune and --guard are supported. (Permission registration API for packages #4)
  • Overridable policies: package policies apply after boot, never replacing a policy the app set with Gate::policy(); config('permissions.policies') always wins. ResourcePolicy maps the standard abilities to view_/edit_/delete_/force_delete_ permissions, with custom abilities, ownership (edit_others_x) and a per-policy guard. (Overridable policies #5)
  • Multi-auth: permissions.guards, per-group and per-role guards, Permissions::guardFor(), Permissions::check(), and guard-aware anyPermission() / @anypermission. Tested with two guards and two user models. (Multi-auth support #6)
  • Role management: Route::roles(['guard' => 'web_admin']), an overridable RolesController that answers JSON on every action, RoleRequest, RoleResource (with can and links), and the role policy registered through the package's own API. (Overridable controllers, policies and default permissions (RBAC, multi-auth) #11)
  • Role pages in Blade (javaabu/forms v2) and Inertia React (@javaabu/forms, shipped through javaabu/manifest). Both have search, permission cards per group with select all and none, and delete confirmation, and both work right to left. Includes React components apps can reuse (RoleForm, PermissionGroupFields, RoleActions). (Blade (javaabu/forms) and Inertia React (@javaabu/forms) views #10)
  • Optional javaabu/translatable support for role descriptions: Models\Translatable\Role, Support\Translations, per-language fields in both stacks, tested with and without translatable. (Optional javaabu/translatable support #12)
  • Dhivehi: every string is in lang/dv.json. Uncertain lines are listed for review in docs/advanced-usage/translations.md. (Dhivehi localization and RTL #9)
  • Docs for docs.javaabu.com (23 pages including an upgrade guide), llms.txt, AGENTS.md, and a Laravel Boost guideline and skill. (Documentation for people and agents #7, Laravel Boost guideline and skill #8)
  • Tooling: PHP 8.4/8.5 × Laravel 12/13 × lowest/stable matrix, Pint, a JS job (typecheck, Vitest), a job without translatable, a job on activitylog v4, and Codecov. (Foundations: PHP 8.4 / Laravel 12+, CI matrix, coverage and codestyle #3)

Upgrading from v2

See docs/upgrading.md. In short:

  • Requires PHP 8.4, Laravel 12 or 13, javaabu/forms v2 and javaabu/manifest. Add their VCS repositories until they're on Packagist.
  • No longer requires javaabu/helpers or javaabu/activitylog, directly or through javaabu/forms. Role no longer implements AdminModel or uses LogsActivity; the guide shows how to extend the model to keep both. Logging of role_updated and permissions_updated uses spatie/laravel-activitylog v4 or v5 when it's installed; on v5 (javaabu/activitylog v2) the changes go in attribute_changes. (Support spatie/laravel-activitylog v5 (for javaabu/activitylog v2) #16)
  • Factories moved to Javaabu\Permissions\Database\Factories.
  • updateRole() reads config('permissions.default_role') instead of get_setting().
  • Permissions::$runsMigrations is now $runs_migrations.
  • A new migration adds nullable translations and lang columns to the roles table.
  • PermissionsSeeder arrays move to Permissions::register() in a provider.

Needs a person

🤖 Generated with Claude Code

n4ff4h and others added 9 commits November 4, 2026 12:40
@n4ff4h @claude
Foundations: PHP 8.4, Laravel 12/13, Pint, CI matrix and Codecov
e825c7b 
- Require PHP ^8.4, Testbench ^10 || ^11 and PHPUnit ^11.5.3 || ^12.5.8
- Branch alias dev-next-gen => 3.x-dev
- Pint with Javaabu codestyle (pint.json), boost-javaabu-guidelines as a dev dependency
- CI: PHP 8.4/8.5 x Laravel 12/13 x lowest/stable, a Pint job, coverage to Codecov
- README badges for tests, Codecov, Packagist and licence on next-gen
- Remove StyleCI and Scrutinizer configs

Refs #3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Add the permission and policy registration API
e308f30 
Packages register permissions, roles and policies from their service
provider; `php artisan permissions:sync` (or PermissionsSeeder) writes them.

- Permissions facade over a PermissionRegistry singleton: register(),
  resource(), role(), policy(), group lookups, guard helpers, check()
- PermissionSyncer: idempotent, per guard, optional --prune; `*` roles
  stay in sync, pattern roles and group grants only add permissions
- Package policies apply after boot and never replace a policy the app
  set with Gate::policy(); config('permissions.policies') always wins
- ResourcePolicy base: standard abilities to view_/edit_/delete_/
  force_delete_ permissions, custom $abilities, ownership, guard
- Multi-auth: default guards from config, per-group and per-role guards,
  anyPermission($permissions, $guard), @anypermission($permissions, $guard),
  Role/Permission forGuard() scopes, updateRole() scoped to the model's guard
- Drop the hard javaabu/helpers and javaabu/activitylog dependencies;
  activity logging is optional via spatie/laravel-activitylog
- Factories and seeders move under Javaabu\Permissions\Database

Refs #4, #5, #6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Add overridable role controllers, routes and API
31f9029 
- Route::roles([guard, prefix, name, middleware, controller]) registers the
  role routes; apps choose prefix, name, middleware and guard
- RolesController manages the roles of the route's guard; answers JSON for
  API requests and renders Blade or Inertia pages by config('permissions.views')
- Controller overridable through config('permissions.controllers.roles'),
  the route option or the container
- RolePolicy (view_roles, edit_roles, delete_roles) and the role permissions
  are registered through the package's own registration API
- RoleRequest validates names per guard and permissions of the guard only
- RoleResource, PermissionResource and PermissionGroups for page props
- Dhivehi strings for the controller messages

Refs #11

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Document v3 for people and agents; add the Boost guideline and skill
c50699a 
- Docusaurus docs: installation, upgrading from v2, registering and syncing
  permissions, roles, policies, checking permissions, managing roles (routes,
  JSON API, page props), package authors, multiple guards, configuration,
  overriding controllers and views, activity log, translations, API reference
- llms.txt with the rules and an index of every page
- AGENTS.md and CLAUDE.md for agents working on the repo
- resources/boost guideline and javaabu-permissions skill with references
- lang/en.json beside lang/dv.json, and a test that every source string has both
- README and CHANGELOG for v3; docs, llms.txt and resources/boost ship in the package

Closes #4
Closes #5
Closes #6
Closes #8
Closes #11
Refs #7, #9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Add the role pages in Blade and Inertia React (work in progress)
f3b6384 
Blade pages built with javaabu/forms v2, React pages with @javaabu/forms,
shipped through javaabu/manifest. Optional translatable role descriptions.
Refs #10, #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Test the role pages in both stacks and with translatable; CI for JS a…
75a5f46 
…nd without translatable

Refs #10, #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Document the role pages, translatable descriptions and right to left;…
5fa5a41 
… update Boost

Closes #10
Closes #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Check that every string in the Blade views has English and Dhivehi lines
5629790 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h @claude
Note that javaabu/forms still installs javaabu/helpers
5120bbf 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 4, 2026
Open
Open
@n4ff4h @claude
Support spatie/laravel-activitylog v5 alongside v4
f3fd84f 
On v5 the role and permission changes go in attribute_changes through
withChanges(); on v4 they stay in properties. CI covers v5 on the
prefer-stable legs, v4.10 on prefer-lowest, and the latest v4 in its own
job. Docs show the v5 and javaabu/activitylog v2 imports. Fixes #16.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@n4ff4h n4ff4h mentioned this pull request Nov 5, 2026
Closed
@n4ff4h @claude
Declare the React pages' npm dependencies for pages only
d44e831 
manifest:check no longer asks Blade apps for @javaabu/forms, @javaabu/onu,
React or @inertiajs/react (Javaabu/manifest#17); roles.ts imports nothing.
Tests run manifest:check against Blade and Inertia app fixtures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@n4ff4h