Roles and Permissions for Laravel's Authorization

Language: PHP

Keywords: acl, authorization, laravel, permissions, php, roles

Laravel Fortress

Roles and Permissions for Laravel's Authorization

Laravel 5.1.11 already ships with a great Authorization system. Fortress aims to add the funcionality of Roles and Permissions in an easy to use, non-invasive manner.

Installation in 3 easy steps

Require the package with composer:

composer require lbausch/laravel-fortress

Add the Service Provider in config/app.php:


Publish database migration and config file:

php artisan vendor:publish --provider="Bausch\LaravelFortress\ServiceProvider"

Run php artisan migrate to finish installation (the Facade Fortress is added automagically).

Using Laravel Fortress

Guard your Models

Every Model (User, Group, ...) that should be protected by Fortress needs to implement the Contract FortressGuardContract and may use the Trait FortressGuardTrait (in addition to AuthorizableContract and Authorizable).

use Bausch\LaravelFortress\Contracts\FortressGuardContract;
use Bausch\LaravelFortress\Traits\FortressGuardTrait as FortressGuard;

class User extends Model implements AuthenticatableContract,
    use Authenticatable, Authorizable, CanResetPassword, FortressGuard;

After that the following methods are available on the Model:

  • assignRole($role_name, $resource = null): Assign a Role (for a Resource) to the Model
  • revokeRole($role_name, $resource = null): Revoke a Role (for a Resource) from the Model
  • hasRole($role_name, $resource = null): Check for a Role (for a Resource)
  • hasPermission($permission_name, $resource = null): Check for a Permission (for a Resource)
  • destroyRoles(): Destroy all Roles a Model has

You also can define a method called fortress_relations() on your model and return a \Illuminate\Support\Collection of additional Models which should be checked (e.g. Groups):

     * Fortress Relations.
     * @return \Illuminate\Support\Collection
    public function fortress_relations()
        return $this->groups;

     * Groups.
     * @return \Illuminate\Database\Eloquent\Relations\BelongsToMany
    public function groups()
        return $this->belongsToMany(Group::class, 'group_members');

Global Roles

As you may have noticed the $resource parameter is optional. You can assign Roles which only apply to a specific Resource or - if you omit the $resource parameter - assign so called "global Roles". Global Roles do not apply to a specific Resource (Post, Blog, ...) and are defined in the config file config/laravel-fortress.php:


 * Define Roles here which do not apply to a specific Resource.
 * role_name => [permissions]
return [
    'admin' => [

Global Roles can be verified like normal Roles - simply use the can() method: $user->can('broadcast');. Of course $user->hasRole($global_role_name) and $user->hasPermission($global_permission_name) works as well.


To be able to assign Roles for a Resource you need to have a Policy for the Resource. All you need to do is to implement the fortress_roles() method as required by the FortressPolicy. Inside the fortress_roles() method you can specify Roles and Permissions which ONLY apply to the Resource the Policy belongs to. Make sure to name your Permissions as you would name your Policy methods (e.g. do not use whitespaces).

use Bausch\LaravelFortress\Contracts\FortressPolicy;

class BlogPolicy implements FortressPolicy
     * Fortress Roles.
     * @return array
    public function fortress_roles()
        return [
            'owner' => [


To use the provided Middleware you need to add it your Kernel (app/Http/Kernel.php):

     * The application's route middleware.
     * @var array
    protected $routeMiddleware = [
        'role' => \Bausch\LaravelFortress\Http\Middleware\VerifyGlobalRole::class,
        'permission' => \Bausch\LaravelFortress\Http\Middleware\VerifyGlobalPermission::class,

The Middleware can be used as shown in the following snippet (app/Http/routes.php):

Route::group(['middleware' => 'role:admin'], function () {

Route::group(['middleware' => 'permission:broadcast'], function () {

Note that the Middleware right now is only capable of verifying global Roles and Permissions.

Retrieving all permitted Resources

Often you may want to retrieve all Resources for which your User/Group has a certain Permission. Fortress has you covered:

$readable_blogs = $user->myAllowedResources('read', Blog::class);

This method will return all Blogs where the User has the "read" Permission.

Important: The myAllowedResources method is quite limited when it comes to resolving the requested Resources as it produces a lot of queries (one for every found Resource). Luckily you can pass in a Closure as the third argument and come up with your own resolving logic (e.g. also retrieve certain relations):

$readable_blogs = $user->myAllowedResources('read', Blog::class, function($resources) {
    // $resources contains a Collection of all found Resources
    return Blogs::whereIn('id', $resources->pluck('resource_id'));

Retrieving all Models whith specific Permission

In case you want to find all Models with a specifc Permission on a given Resource just call the allowedModels() method on the Fortress Facade:

$users_who_can_read_this_blog = \Fortress::allowedModels('read', $blog_instance');

Of course allowedModels() also accepts a Closure as the third argument allowing you to use your own resolving logic.

If you want to use Dependency Injection use \Bausch\LaravelFortress\Contracts\Fortress::class.

A Note on deleting Models

Fortress hooks into the deleting process of a Model. This means if you delete a Model from your database which uses the FortressGuardTrait all assigned Roles will be deleted from the database. In case your Model makes use of the Soft Deletes feature all assigned Roles are kept until your Model is deleted permanently.

Project Statistics

Sourcerank 2
Repository Size 28.3 KB
Stars 5
Forks 0
Watchers 1
Open issues 0
Dependencies 2
Contributors 1
Tags 14
Last updated
Last pushed

Top Contributors See all


Packages Referencing this Repo

Roles and Permissions for Laravel's Authorization
Latest release v0.4.1 - Updated - 5 stars

Recent Tags See all

v0.4.1 October 31, 2018
v0.4.0 June 22, 2017
v0.3.1 May 11, 2017
v0.3.0 May 11, 2017
v0.2.1 August 28, 2016
v0.2.0 December 30, 2015
v0.1.7 November 17, 2015
v0.1.6 October 09, 2015
v0.1.5 October 09, 2015
v0.1.4 September 29, 2015
v0.1.3 September 29, 2015
v0.1.2 September 20, 2015
v0.1.1 September 19, 2015
v0.1.0 September 19, 2015

Something wrong with this page? Make a suggestion

Last synced: 2019-11-14 04:43:02 UTC

Login to resync this repository