Powerful package for handling roles and permissions in Laravel 5
Alternatives To Roles
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
Laravel Permission11,4651,3883827 days ago176March 22, 20231mitPHP
Associate users with roles and permissions
Bouncer3,2971173012 days ago55February 21, 202242mitPHP
Laravel Eloquent roles and abilities.
Laratrust2,05636451a month ago88April 24, 202310mitPHP
Handle roles and permissions in your Laravel application
Sentinel1,4667861362 months ago51August 10, 202338bsd-3-clausePHP
A framework agnostic authentication & authorization system.
Laravel Roles8456757 months ago43February 17, 20221mitPHP
A Powerful package for handling roles and permissions in Laravel with GUI. Supports Laravel 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 6.0, 7.0, 8.0, and 9.0
Laravel Acl78268136 months ago11May 14, 202070mitPHP
Light-weight role-based permissions system for Laravel 6+ built in Auth system.
Filament Shield711
2 days ago44November 16, 20221mitPHP
The easiest and most intuitive way to add access management to your Filament Admin Resources, Pages & Widgets through `spatie/laravel-permission`
Laravel Acl546227 months ago55June 06, 20221mitPHP
This package helps you to associate users with permissions and permission groups with laravel framework
5 months ago1mitPHP
An .env sharing tool for your whole team.
Laravel Roles Permissions Manager499
4 years ago4PHP
Laravel 6 adminpanel starter boilerplate project with roles-permissions management.
Alternatives To Roles
Select To Compare

Alternative Project Comparisons

Build Status Scrutinizer Code Quality StyleCI Coverage Status

#Abandoned The Roles and permissions for laraval 5 package is abandoned and will no longer be maintained by Ultraware. Feel free to fork the project and submit it to packagist. We can share the url to your package on this page if you send us a message.

Roles And Permissions For Laravel 5

Powerful package for handling roles and permissions in Laravel 5.


This package is very easy to set up. There are only couple of steps.


Pull this package in through Composer

composer require ultraware/roles

If you are still using Laravel 5.0, you must pull in version 1.7.*.

Service Provider

Add the package to your application service providers in config/app.php file.

'providers' => [
     * Third Party Service Providers...


Config File And Migrations

Publish the package config file and migrations to your application. Run these commands inside your terminal.

php artisan vendor:publish --provider="Ultraware\Roles\RolesServiceProvider" --tag=config
php artisan vendor:publish --provider="Ultraware\Roles\RolesServiceProvider" --tag=migrations

And also run migrations.

php artisan migrate

This uses the default users table which is in Laravel. You should already have the migration file for the users table available and migrated.

HasRoleAndPermission Trait And Contract

Include HasRoleAndPermission trait and also implement HasRoleAndPermission contract inside your User model.

Migrate from bican roles

If you migrate from bican/roles to ultraware/roles yoe need to update a few things.

  • Change all calls to can, canOne and canAll to hasPermission, hasOnePermission, hasAllPermissions.
  • Change all calls to is, isOne and isAll to hasRole, hasOneRole, hasAllRoles.


Creating Roles

use Ultraware\Roles\Models\Role;

$adminRole = Role::create([
    'name' => 'Admin',
    'slug' => 'admin',
    'description' => '', // optional
    'level' => 1, // optional, set to 1 by default

$moderatorRole = Role::create([
    'name' => 'Forum Moderator',
    'slug' => 'forum.moderator',

Because of Slugable trait, if you make a mistake and for example leave a space in slug parameter, it'll be replaced with a dot automatically, because of str_slug function.

Attaching, Detaching and Syncing Roles

It's really simple. You fetch a user from database and call attachRole method. There is BelongsToMany relationship between User and Role model.

use App\User;

$user = User::find($id);

$user->attachRole($adminRole); // you can pass whole object, or just an id
$user->detachRole($adminRole); // in case you want to detach role
$user->detachAllRoles(); // in case you want to detach all roles
$user->syncRoles($roles); // you can pass Eloquent collection, or just an array of ids

Checking For Roles

You can now check if the user has required role.

if ($user->hasRole('admin')) { // you can pass an id or slug

You can also do this:

if ($user->isAdmin()) {

And of course, there is a way to check for multiple roles:

if ($user->hasRole(['admin', 'moderator'])) { 
    | Or alternatively:
    | $user->hasRole('admin, moderator'), $user->hasRole('admin|moderator'),
    | $user->hasOneRole('admin, moderator'), $user->hasOneRole(['admin', 'moderator']), $user->hasOneRole('admin|moderator')

    // The user has at least one of the roles

if ($user->hasRole(['admin', 'moderator'], true)) {
    | Or alternatively:
    | $user->hasRole('admin, moderator', true), $user->hasRole('admin|moderator', true),
    | $user->hasAllRoles('admin, moderator'), $user->hasAllRoles(['admin', 'moderator']), $user->hasAllRoles('admin|moderator')

    // The user has all roles


When you are creating roles, there is optional parameter level. It is set to 1 by default, but you can overwrite it and then you can do something like this:

if ($user->level() > 4) {

If user has multiple roles, method level returns the highest one.

Level has also big effect on inheriting permissions. About it later.

Creating Permissions

It's very simple thanks to Permission model.

use Ultraware\Roles\Models\Permission;

$createUsersPermission = Permission::create([
    'name' => 'Create users',
    'slug' => 'create.users',
    'description' => '', // optional

$deleteUsersPermission = Permission::create([
    'name' => 'Delete users',
    'slug' => 'delete.users',

Attaching, Detaching and Syncing Permissions

You can attach permissions to a role or directly to a specific user (and of course detach them as well).

use App\User;
use Ultraware\Roles\Models\Role;

$role = Role::find($roleId);
$role->attachPermission($createUsersPermission); // permission attached to a role

$user = User::find($userId);
$user->attachPermission($deleteUsersPermission); // permission attached to a user
$role->detachPermission($createUsersPermission); // in case you want to detach permission
$role->detachAllPermissions(); // in case you want to detach all permissions
$role->syncPermissions($permissions); // you can pass Eloquent collection, or just an array of ids

$user->syncPermissions($permissions); // you can pass Eloquent collection, or just an array of ids

Checking For Permissions

if ($user->hasPermission('create.users')) { // you can pass an id or slug

if ($user->canDeleteUsers()) {

You can check for multiple permissions the same way as roles. You can make use of additional methods like hasOnePermission or hasAllPermissions.

Permissions Inheriting

Role with higher level is inheriting permission from roles with lower level.

There is an example of this magic:

You have three roles: user, moderator and admin. User has a permission to read articles, moderator can manage comments and admin can create articles. User has a level 1, moderator level 2 and admin level 3. It means, moderator and administrator has also permission to read articles, but administrator can manage comments as well.

If you don't want permissions inheriting feature in you application, simply ignore level parameter when you're creating roles.

Entity Check

Let's say you have an article and you want to edit it. This article belongs to a user (there is a column user_id in articles table).

use App\Article;
use Ultraware\Roles\Models\Permission;

$editArticlesPermission = Permission::create([
    'name' => 'Edit articles',
    'slug' => 'edit.articles',
    'model' => 'App\Article',


$article = Article::find(1);

if ($user->allowed('edit.articles', $article)) { // $user->allowedEditArticles($article)

This condition checks if the current user is the owner of article. If not, it will be looking inside user permissions for a row we created before.

if ($user->allowed('edit.articles', $article, false)) { // now owner check is disabled

Blade Extensions

There are four Blade extensions. Basically, it is replacement for classic if statements.

@role('admin') // @if(Auth::check() && Auth::user()->hasRole('admin'))
    // user has admin role

@permission('edit.articles') // @if(Auth::check() && Auth::user()->hasPermission('edit.articles'))
    // user has edit articles permissison

@level(2) // @if(Auth::check() && Auth::user()->level() >= 2)
    // user has level 2 or higher

@allowed('edit', $article) // @if(Auth::check() && Auth::user()->allowed('edit', $article))
    // show edit button

@role('admin|moderator', true) // @if(Auth::check() && Auth::user()->hasRole('admin|moderator', true))
    // user has admin and moderator role
    // something else


This package comes with VerifyRole, VerifyPermission and VerifyLevel middleware. You must add them inside your app/Http/Kernel.php file.

 * The application's route middleware.
 * @var array
protected $routeMiddleware = [
    'auth' => \App\Http\Middleware\Authenticate::class,
    'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
    'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
    'role' => \Ultraware\Roles\Middleware\VerifyRole::class,
    'permission' => \Ultraware\Roles\Middleware\VerifyPermission::class,
    'level' => \Ultraware\Roles\Middleware\VerifyLevel::class,

Now you can easily protect your routes.

$router->get('/example', [
    'as' => 'example',
    'middleware' => 'role:admin',
    'uses' => 'ExampleController@index',

$router->post('/example', [
    'as' => 'example',
    'middleware' => 'permission:edit.articles',
    'uses' => 'ExampleController@index',

$router->get('/example', [
    'as' => 'example',
    'middleware' => 'level:2', // level >= 2
    'uses' => 'ExampleController@index',

It throws \Ultraware\Roles\Exceptions\RoleDeniedException, \Ultraware\Roles\Exceptions\PermissionDeniedException or \Ultraware\Roles\Exceptions\LevelDeniedException exceptions if it goes wrong.

You can catch these exceptions inside app/Exceptions/Handler.php file and do whatever you want.

 * Render an exception into an HTTP response.
 * @param  \Illuminate\Http\Request  $request
 * @param  \Exception  $e
 * @return \Illuminate\Http\Response
public function render($request, Exception $e)
    if ($e instanceof \Ultraware\Roles\Exceptions\RoleDeniedException) {
        // you can for example flash message, redirect...
        return redirect()->back();

    return parent::render($request, $e);

Config File

You can change connection for models, slug separator, models path and there is also a handy pretend feature. Have a look at config file for more information.

More Information

For more information, please have a look at HasRoleAndPermission contract.


This package is free software distributed under the terms of the MIT license.

Popular Laravel Projects
Popular Permission Projects
Popular Frameworks Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.