RBAC Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.1.0] - 2026-07-21

Added

• Lifecycle hooks powered by artisanpack-ui/hooks:
  • ap.rbac.abilitiesForUser filter — passes the resolved ability list through user-space filters, letting external packages graft permissions from LDAP, feature flags, or tenant policies onto a user without subclassing.
  • ap.rbac.role.assigned action — fired from HasRoles::assignRole() after a role is attached, with (User $user, Role $role).
  • ap.rbac.role.revoked action — fired from HasRoles::removeRole() after a role is detached, with (User $user, Role $role).
  • ap.rbac.checkingAbility action — fired from the RBAC Gate::before shim before ability resolution, with (User $user, string $ability, mixed $arguments), giving compliance-heavy apps a low-friction audit seam.
• HasPermissions::getAbilities() — returns the flat list of ability strings (names + slugs) the user can perform, after the ap.rbac.abilitiesForUser filter has run. hasPermissionTo() now resolves through this method, so grafted abilities are honored by $user->can(), Gate::allows(), and @can.

Changed

• artisanpack-ui/hooks: ^1.3 is now a hard dependency. The rbac package no longer works without it — hook fire sites are called unconditionally.

[1.0.1] - 2026-06-14

Added

• Laravel 13 support. The illuminate/support constraint now accepts ^10.0|^11.0|^12.0|^13.0, and the test toolchain (orchestra/testbench, pestphp/pest, pestphp/pest-plugin-laravel) was widened so the Laravel 13 leg installs cleanly.

Changed

• CI now runs the test suite as a matrix across Laravel 12 and 13 × PHP 8.2-8.4 (Laravel 13 / PHP 8.2 excluded — Laravel 13 requires PHP 8.3+). CI also triggers on release/** branches and overrides composer config platform.php per matrix row so the Laravel 13 leg resolves correctly despite the repo's PHP 8.2 platform pin.

[1.0.0] - 2026-05-18

Added

• Initial release of the standalone RBAC package, extracted from artisanpack-ui/security 1.x as part of the Security 2.0 package split.
• Role Eloquent model with parent / child hierarchy, name + auto-derived slug, optional description, and collision-detecting save().
• Permission Eloquent model with name + auto-derived slug and collision-detecting save().
• HasRoles user trait: roles() relationship, hasRole(), assignRole(), removeRole() helpers; idempotent assignment and removal.
• HasPermissions user trait: hasPermissionTo() (recursive resolution through the role hierarchy), hasPermission() alias, flushPermissionCache() manual invalidation.
• permission route middleware alias (permission:posts.publish,posts.review) — accepts one or more permission slugs and aborts 401 / 403 as appropriate.
• @role and @permission Blade directives for view-layer permission gating.
• Gate integration via Gate::before so $user->can('slug'), Gate::allows('slug'), and @can('slug') resolve through RBAC permissions while still falling through to standard policies for non-RBAC abilities.
• Artisan commands: role:create, permission:create, user:assign-role, user:revoke-role — idempotent and configurable user lookup fields.
• Eloquent observers dispatching rbac.role.{created,updated,deleted} and rbac.permission.{created,updated,deleted} events for downstream auditing.
• Pivot events rbac.user.role_assigned and rbac.user.role_removed dispatched directly from the HasRoles trait.
• Migrations for roles, permissions, role_user, and permission_role tables.
• Configurable model bindings (artisanpack.rbac.models.role/permission) so downstream packages can extend the base models without forking.
• Configurable table names, foreign keys, and user lookup fields for legacy schema integration.
• Permission-name cache backed by Laravel's tagged cache where available, with automatic invalidation on permission CRUD; user-permission cache with configurable TTL.
• Rbac Facade and rbac() helper as the public entry point for future API expansion.

Changed

• (none — initial release)

Removed

• This package contains the role / permission / Blade directive / Gate integration content previously bundled in artisanpack-ui/security 1.x. See the artisanpack-ui/security UPGRADE guide for migration instructions from 1.x.