spatie/laravel-permission

• Fix bound saved event from firing on all subsequent models when calling assignRole or givePermissionTo on unsaved models. However, it is preferable to save the model first, and then add roles/permissions after saving. See #971.

• Use config settings for cache reset in migration stub

• Remove use of Cache facade, for Lumen compatibility

• Add ability to specify a cache driver for roles/permissions caching

• Added the ability to reset the permissions cache via an Artisan command:
• php artisan permission:cache-reset

• minor update to de-duplicate code overhead
• numerous internal updates to cache tests infrastructure

• Substantial speed increase by caching the associations between models and permissions

NOTES:

The following changes are not "breaking", but worth making the updates to your app for consistency.

1. Config file: The config/permission.php file changed to move cache-related settings into a sub-array. You should review the changes and merge the updates into your own config file. Specifically the expiration_time value has moved into a sub-array entry, and the old top-level entry is no longer used.
2. See the original config file here:
3. https://github.com/spatie/laravel-permission/blob/main/config/permission.php
5. Cache Resets: If your app or tests are clearing the cache by specifying the cache key, it is better to use the built-in forgetCachedPermissions() method so that it properly handles tagged cache entries. Here is the recommended change:

- app()['cache']->forget('spatie.permission.cache');
+ $this->app->make(\Spatie\Permission\PermissionRegistrar::class)->forgetCachedPermissions();

1. Also this is a good time to point out that now with v2.25.0 and v2.26.0 most permission-cache-reset scenarios may no longer be needed in your app, so it's worth reviewing those cases, as you may gain some app speed improvement by removing unnecessary cache resets.

• A model's roles and permissions relations (respectively) are now automatically reloaded after an Assign/Remove role or Grant/Revoke of permissions. This means there's no longer a need to call ->fresh() on the model if the only reason is to reload the role/permission relations. (That said, you may want to call it for other reasons.)
• Added support for passing id to HasRole()

• Fix operator used on RoleOrPermissionMiddleware, and avoid throwing PermissionDoesNotExist if invalid permission passed
• Auto-reload model role relation after using AssignRole
• Avoid empty permission creation when using the CreateRole command

• Avoid unnecessary queries of user roles when fetching all permissions

• Fix Lumen issue with Route helper added in 2.22.0

• Added Route::role() and Route::permission() middleware helper functions
• Added new role_or_permission middleware to allow specifying "or" combinations

• Revert changes from 2.17.1 in order to support Lumen 5.7

• It will sync roles/permissions to models that are not persisted, by registering a saved callback.
• (It would previously throw an Integrity constraint violation QueryException on the pivot table insertion.)

• add @elserole directive:
• Usage:

@role('roleA')
 // user hasRole 'roleA'
@elserole('roleB')
 // user hasRole 'roleB' but not 'roleA'
@endrole

• Spark-related fix to accommodate missing guard[providers] config

• Add ability to pass in IDs or mixed values to role scope
• Add @unlessrole/@endunlessrole Blade directives

• Expanded CLI permission:create-role command to create optionally create-and-link permissions in one command. Also now no longer throws an error if the role already exists.

• Require laravel/framework instead of illuminate/* starting from ~5.4.0
• Removed old dependency for illuminate/database@~5.3.0 (Laravel 5.3 is not supported)

• Laravel 5.7 compatibility

• Replace static Permission::class and Role::class with dynamic value (allows custom models more easily)
• Added type checking in hasPermissionTo and hasDirectPermission

• Make assigning the same role or permission twice not throw an exception

• Allow using another key name than model_id by defining new columns array with model_morph_key key in config file. This improves UUID compatibility as discussed in #777.

• Fix issue with null values passed to syncPermissions & syncRoles

• added hasAllPermissions method

• Reverted 2.12.0. REVERTS: "Add ability to pass guard name to gate methods like can()". Requires reworking of guard handling if we're going to add this feature.

• Add ability to pass guard name to gate methods like can()

• Improve speed of permission lookups with findByName, findById, findOrCreate

• changes the type-hinted Authenticatable to Authorizable in the PermissionRegistrar.
• (Previously it was expecting models to implement the Authenticatable contract; but really that should have been Authorizable, since that's where the Gate functionality really is.)

• Now findOrCreate() exists for both Roles and Permissions
• Internal code refactoring for future dev work

• Permissions now support passing integer id for sync, find, hasPermissionTo and hasDirectPermissionTo

• add compatibility with Laravel 5.6
• Allow assign/sync/remove Roles from Permission model

• Allow a collection containing a model to be passed to role/permission scopes

• Fix compatibility with Spark v2.0 to v5.0

• Support getting guard_name from extended model when using static methods

Changes related to throwing UnauthorizedException:

• When UnauthorizedException is thrown, a property is added with the expected role/permission which triggered it
• A configuration option may be set to include the list of required roles/permissions in the message

• REVERTED: Dynamic permission_id and role_id columns according to tables name
• NOTE: This Dynamic field naming was a breaking change, so we've removed it for now.

BEST NOT TO USE v2.7.7 if you've changed tablenames in the config file.

• updated HasPermissions::getStoredPermission to allow a collection to be returned, and to fix query when passing multiple permissions
• Give and revoke multiple permissions
• Dynamic permission_id and role_id columns according to tables name
• Add findOrCreate function to Permission model
• Improved Lumen support
• Allow guard name to be null for find role by id

• added Lumen support
• updated HasRole::assignRole and HasRole::syncRoles to accept role id's in addition to role names as arguments

• fixed Gate::before for custom gate callbacks

• added cache clearing command in up migration for permission tables
• use config_path helper for better Lumen support

• refactor middleware to throw custom UnauthorizedException (which raises an HttpException with 403 response)
• The 403 response is backward compatible

• refactor PermissionRegistrar to use $gate->before()
• removed log_registration_exception as it is no longer relevant

• fixed a bug where Roles and Permissions got detached when soft deleting a model

• add support for L5.3

• add permission scope

• register the blade directives in the register method of the service provider

• register the blade directives in the boot method of the service provider

• let middleware use caching

• add getRoleNames() method to return a collection of assigned roles

• add compatibility with Laravel 5.5

• automatically detach roles and permissions when a user gets deleted

• fix processing of pipe symbols in @hasanyrole and @hasallroles Blade directives

• add PermissionMiddleware and RoleMiddleware

• allow hasAnyPermission to take an array of permissions

• fix commands not using custom models

• add create-permission and create-role commands