class PermissionRegistrar

Constants

MODEL_ROLES_CACHE_KEY_PREFIX

MODEL_PERMISSIONS_CACHE_KEY_PREFIX

MODEL_CACHE_TOKEN_KEY

PERMISSION_CATALOG_CONTEXT_KEY

WILDCARD_PERMISSION_INDEX_CONTEXT_KEY

MODEL_VIA_ROLE_PERMISSIONS_CONTEXT_KEY

Properties

static protected string|null $partitionColumn
static protected null|Closure(): null|int|string $partitionResolver
static protected bool $initialized
protected string $permissionClass
protected string $roleClass
protected string|null $teamClass
string $pivotRole
string $pivotPermission
int $cacheExpirationTime
bool $teams
protected PermissionsTeamResolver $teamResolver
string $teamsKey
string $cacheKey
protected string $modelRolesCacheKeyPrefix
protected string $modelPermissionsCacheKeyPrefix
protected string $modelCacheTokenKey
protected string|null $cacheStoreName
protected PermissionRelationContext}>> $loadedRelationProvenance

Methods

__construct(CacheManager $cacheManager, Repository $config, Container $app)

Create a new permission registrar.

static void
resolvePartitionUsing(string $column, Closure $resolver)

Configure the permission row partition resolver.

static bool
partitioningEnabled()

Determine whether permission row partitioning is configured.

static string|null
partitionColumn()

Get the configured permission partition column.

resolvePartition()

Resolve the current permission partition.

partitionFromRecord(Model $model)

Resolve a permission partition from a persisted record.

void
ensureModelMatchesPartition(Model $model, PermissionPartition $partition)

Ensure a model belongs to the captured permission partition.

void
initializeCache()

Initialize cache and config-backed registrar state.

void
validateModelClasses()

Validate the configured model classes.

void
validateRoleClass(string $roleClass)

Validate a configured role model class.

void
validatePermissionClass(string $permissionClass)

Validate a configured permission model class.

configuredCacheRepository()

Get the configured cache repository.

cacheRepository()

Get the memoized cache repository for the current coroutine.

void
setPermissionsTeamId(int|string|Model|null $id)

Set the current permissions team id.

int|string|null
getPermissionsTeamId()

Get the current permissions team id.

bool
registerPermissions(Gate $gate)

Register the permission check method on the gate.

bool
forgetCachedPermissions()

Flush the permission cache.

bool
forgetCachedPermissionsFor(PermissionPartition|null $partition)

Flush the permission cache for an explicit partition.

void
forgetModelAssignmentCache(Model $model)

Forget a model's direct role and permission assignment caches.

void
forgetModelAssignmentCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's assignment caches for an explicit partition and team.

void
forgetModelAssignmentCacheForIdentity(string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Forget assignment caches for an explicit morph identity, partition, and team.

void
forgetModelRoleCache(Model $model)

Forget a model's cached role assignments.

void
forgetModelRoleCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's role assignment cache for an explicit partition and team.

void
forgetModelPermissionCache(Model $model)

Forget a model's cached permission assignments.

void
forgetModelPermissionCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's permission assignment cache for an explicit partition and team.

rememberModelViaRolePermissions(Model $model, Closure $callback)

Remember a model's permissions granted through roles.

void
forgetModelViaRolePermissions(Model $model)

Forget a model's permissions granted through roles.

array
rememberModelRoleAssignments(Model $model, Closure $callback)

Remember a model's role assignment ids.

array
rememberModelPermissionAssignments(Model $model, Closure $callback)

Remember a model's permission assignment ids.

string
modelCacheKey(string $prefix, Model $model)

Build the cache key for model assignment caches.

string
modelCacheKeyForIdentity(string $prefix, string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Build an assignment cache key for an explicit identity and context.

string
modelRuntimeCacheKey(Model $model)

Build the runtime cache key segment for coroutine-local model state.

string
modelRuntimeCacheKeyForIdentity(string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Build a coroutine-local cache key for an explicit identity and context.

string
modelAssignmentCacheToken(PermissionPartition|null $partition = null)

Get the current model assignment cache token.

string
bumpModelAssignmentCacheToken()

Bump the model assignment cache token.

string
bumpModelAssignmentCacheTokenFor(PermissionPartition|null $partition)

Bump the model assignment cache token for an explicit partition.

string
newModelAssignmentCacheToken()

Create a new model assignment cache namespace token.

void
forgetWildcardPermissionIndex(Model|null $record = null)

Forget the cached wildcard permission index.

array
getWildcardPermissionIndex(Model $record)

Get the wildcard permission index for a model.

string
wildcardPermissionIndexKey(Model $record)

Build the coroutine-local wildcard permission index key.

void
forgetRuntimeCacheItem(string $contextKey, string $itemKey)

Forget one item from a coroutine-local permission cache.

void
forgetRuntimeCacheItemsForPartition(string $contextKey, PermissionPartition|null $partition)

Forget coroutine-local permission cache items for a partition.

void
clearPermissionsCollection()

Clear already-loaded permissions collection.

void
clearAllPermissionRuntimeState()

Clear all permission runtime state in the current coroutine.

void
clearPermissionRuntimeStateFor(PermissionPartition|null $partition)

Clear permission runtime state for an explicit partition.

void
markLoadedRelation(Model $model, string $relation, Collection $collection, PermissionRelationContext $context)

Mark the context that produced a loaded permission relation.

bool
loadedRelationIsCurrent(Model $model, string $relation)

Determine whether a loaded permission relation matches current context.

void
forgetLoadedRelationProvenance(Model $model, string|null $relation = null)

Forget loaded permission relation provenance for a model.

getPermissions(array $params = [], bool $onlyOne = false, string|null $permissionClass = null)

Get the permissions based on the passed params.

getRoles(array $params = [], bool $onlyOne = false, string|null $roleClass = null)

Get the roles based on the passed params.

Collection|null
indexedModels(array $params, bool $onlyOne, string $modelType)

Get indexed models for supported exact lookup shapes.

filterModels(Collection $models, array $params, bool $onlyOne)

Filter a model collection by attributes.

static bool
attributeMatches(mixed $actual, mixed $expected)

Determine if an attribute matches a requested value.

string
getPermissionClass()

Get the permission model class.

string
getCacheKey()

Get the current global permission cache key.

string
partitionedCacheKey(string $key, PermissionPartition|null $partition = null)

Add the permission partition to a cache key.

resolvedPartitionArgument(PermissionPartition|null $partition)

Resolve an optional explicit partition argument.

string
partitionRuntimePrefix(PermissionPartition|null $partition)

Build the runtime key prefix for a partition.

setPermissionClass(string $permissionClass)

Set the permission model class.

string
getRoleClass()

Get the role model class.

setRoleClass(string $roleClass)

Set the role model class.

string|null
getTeamClass()

Get the team model class.

setTeamClass(string|null $teamClass)

Set the team model class.

getCacheRepository()

Get the cache repository.

getCacheStore()

Get the cache store.

getPermissionsWithRoles(string|null $permissionClass = null)

Get permissions with their roles.

getRolesForCache()

Get roles for cache.

bool
hasDeniedRolePermissions()

Determine if any cached role-permission edge is denied.

bool
pivotIsDenied(Model $model)

Determine if a hydrated pivot marks the permission as denied.

relationCollection(Model $model, string $relation)

Get a hydrated relation collection.

static bool
isUid(mixed $value)

Determine if a value is a UUID or ULID.

static void
flushState()

Flush all static state.

Details

at line 99
__construct(CacheManager $cacheManager, Repository $config, Container $app)

Create a new permission registrar.

Parameters

CacheManager $cacheManager
Repository $config
Container $app

at line 119
static void resolvePartitionUsing(string $column, Closure $resolver)

Configure the permission row partition resolver.

Register before resolving the Permission registrar or Gate.

Boot-only. The column and callback persist in static properties for the worker lifetime and affect every subsequent permission operation.

Parameters

string $column
Closure $resolver

Return Value

void

at line 139
static bool partitioningEnabled()

Determine whether permission row partitioning is configured.

Return Value

bool

at line 147
static string|null partitionColumn()

Get the configured permission partition column.

Return Value

string|null

at line 155
PermissionPartition|null resolvePartition()

Resolve the current permission partition.

Return Value

PermissionPartition|null

at line 181
PermissionPartition partitionFromRecord(Model $model)

Resolve a permission partition from a persisted record.

Parameters

Model $model

Return Value

PermissionPartition

at line 211
void ensureModelMatchesPartition(Model $model, PermissionPartition $partition)

Ensure a model belongs to the captured permission partition.

Parameters

Model $model
PermissionPartition $partition

Return Value

void

at line 229
void initializeCache()

Initialize cache and config-backed registrar state.

Boot or tests only. The values are stored on the singleton registrar and affect every later permission lookup in this worker.

Return Value

void

at line 269
protected void validateModelClasses()

Validate the configured model classes.

Return Value

void

at line 280
protected void validateRoleClass(string $roleClass)

Validate a configured role model class.

Parameters

string $roleClass

Return Value

void

at line 300
protected void validatePermissionClass(string $permissionClass)

Validate a configured permission model class.

Parameters

string $permissionClass

Return Value

void

at line 318
protected Repository configuredCacheRepository()

Get the configured cache repository.

Return Value

Repository

at line 326
protected Repository cacheRepository()

Get the memoized cache repository for the current coroutine.

Return Value

Repository

at line 334
void setPermissionsTeamId(int|string|Model|null $id)

Set the current permissions team id.

Parameters

int|string|Model|null $id

Return Value

void

at line 342
int|string|null getPermissionsTeamId()

Get the current permissions team id.

Return Value

int|string|null

at line 350
bool registerPermissions(Gate $gate)

Register the permission check method on the gate.

Parameters

Gate $gate

Return Value

bool

at line 372
bool forgetCachedPermissions()

Flush the permission cache.

Return Value

bool

at line 380
bool forgetCachedPermissionsFor(PermissionPartition|null $partition)

Flush the permission cache for an explicit partition.

Parameters

PermissionPartition|null $partition

Return Value

bool

at line 393
void forgetModelAssignmentCache(Model $model)

Forget a model's direct role and permission assignment caches.

Parameters

Model $model

Return Value

void

at line 405
void forgetModelAssignmentCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's assignment caches for an explicit partition and team.

Parameters

Model $model
PermissionPartition|null $partition
int|string|null $team

Return Value

void

at line 421
void forgetModelAssignmentCacheForIdentity(string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Forget assignment caches for an explicit morph identity, partition, and team.

Parameters

string $morphType
int|string $modelKey
PermissionPartition|null $partition
int|string|null $team

Return Value

void

at line 458
void forgetModelRoleCache(Model $model)

Forget a model's cached role assignments.

Parameters

Model $model

Return Value

void

at line 470
void forgetModelRoleCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's role assignment cache for an explicit partition and team.

Parameters

Model $model
PermissionPartition|null $partition
int|string|null $team

Return Value

void

at line 497
void forgetModelPermissionCache(Model $model)

Forget a model's cached permission assignments.

Parameters

Model $model

Return Value

void

at line 509
void forgetModelPermissionCacheFor(Model $model, PermissionPartition|null $partition, int|string|null $team)

Forget a model's permission assignment cache for an explicit partition and team.

Parameters

Model $model
PermissionPartition|null $partition
int|string|null $team

Return Value

void

at line 537
Collection rememberModelViaRolePermissions(Model $model, Closure $callback)

Remember a model's permissions granted through roles.

Parameters

Model $model
Closure $callback

Return Value

Collection

at line 555
void forgetModelViaRolePermissions(Model $model)

Forget a model's permissions granted through roles.

Parameters

Model $model

Return Value

void

at line 569
array rememberModelRoleAssignments(Model $model, Closure $callback)

Remember a model's role assignment ids.

Parameters

Model $model
Closure $callback

Return Value

array

at line 584
array rememberModelPermissionAssignments(Model $model, Closure $callback)

Remember a model's permission assignment ids.

Parameters

Model $model
Closure $callback

Return Value

array

at line 596
protected string modelCacheKey(string $prefix, Model $model)

Build the cache key for model assignment caches.

Parameters

string $prefix
Model $model

Return Value

string

at line 610
protected string modelCacheKeyForIdentity(string $prefix, string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Build an assignment cache key for an explicit identity and context.

Parameters

string $prefix
string $morphType
int|string $modelKey
PermissionPartition|null $partition
int|string|null $team

Return Value

string

at line 629
protected string modelRuntimeCacheKey(Model $model)

Build the runtime cache key segment for coroutine-local model state.

Parameters

Model $model

Return Value

string

at line 642
protected string modelRuntimeCacheKeyForIdentity(string $morphType, int|string $modelKey, PermissionPartition|null $partition, int|string|null $team)

Build a coroutine-local cache key for an explicit identity and context.

Parameters

string $morphType
int|string $modelKey
PermissionPartition|null $partition
int|string|null $team

Return Value

string

at line 660
string modelAssignmentCacheToken(PermissionPartition|null $partition = null)

Get the current model assignment cache token.

Parameters

PermissionPartition|null $partition

Return Value

string

at line 673
string bumpModelAssignmentCacheToken()

Bump the model assignment cache token.

Return Value

string

at line 681
string bumpModelAssignmentCacheTokenFor(PermissionPartition|null $partition)

Bump the model assignment cache token for an explicit partition.

Parameters

PermissionPartition|null $partition

Return Value

string

at line 697
protected string newModelAssignmentCacheToken()

Create a new model assignment cache namespace token.

Return Value

string

at line 705
void forgetWildcardPermissionIndex(Model|null $record = null)

Forget the cached wildcard permission index.

Parameters

Model|null $record

Return Value

void

at line 733
array getWildcardPermissionIndex(Model $record)

Get the wildcard permission index for a model.

Parameters

Model $record

Return Value

array

at line 756
protected string wildcardPermissionIndexKey(Model $record)

Build the coroutine-local wildcard permission index key.

Parameters

Model $record

Return Value

string

at line 764
protected void forgetRuntimeCacheItem(string $contextKey, string $itemKey)

Forget one item from a coroutine-local permission cache.

Parameters

string $contextKey
string $itemKey

Return Value

void

at line 774
protected void forgetRuntimeCacheItemsForPartition(string $contextKey, PermissionPartition|null $partition)

Forget coroutine-local permission cache items for a partition.

Parameters

string $contextKey
PermissionPartition|null $partition

Return Value

void

at line 793
void clearPermissionsCollection()

Clear already-loaded permissions collection.

Return Value

void

at line 801
protected void clearAllPermissionRuntimeState()

Clear all permission runtime state in the current coroutine.

Return Value

void

at line 811
protected void clearPermissionRuntimeStateFor(PermissionPartition|null $partition)

Clear permission runtime state for an explicit partition.

Parameters

PermissionPartition|null $partition

Return Value

void

at line 836
void markLoadedRelation(Model $model, string $relation, Collection $collection, PermissionRelationContext $context)

Mark the context that produced a loaded permission relation.

Parameters

Model $model
string $relation
Collection $collection
PermissionRelationContext $context

Return Value

void

at line 857
bool loadedRelationIsCurrent(Model $model, string $relation)

Determine whether a loaded permission relation matches current context.

Parameters

Model $model
string $relation

Return Value

bool

at line 898
void forgetLoadedRelationProvenance(Model $model, string|null $relation = null)

Forget loaded permission relation provenance for a model.

Parameters

Model $model
string|null $relation

Return Value

void

at line 980
Collection getPermissions(array $params = [], bool $onlyOne = false, string|null $permissionClass = null)

Get the permissions based on the passed params.

Parameters

array $params
bool $onlyOne
string|null $permissionClass

Return Value

Collection

at line 1006
Collection getRoles(array $params = [], bool $onlyOne = false, string|null $roleClass = null)

Get the roles based on the passed params.

Parameters

array $params
bool $onlyOne
string|null $roleClass

Return Value

Collection

at line 1032
protected Collection|null indexedModels(array $params, bool $onlyOne, string $modelType)

Get indexed models for supported exact lookup shapes.

Parameters

array $params
bool $onlyOne
string $modelType

Return Value

Collection|null

at line 1135
protected Collection filterModels(Collection $models, array $params, bool $onlyOne)

Filter a model collection by attributes.

Parameters

Collection $models
array $params
bool $onlyOne

Return Value

Collection

at line 1156
static protected bool attributeMatches(mixed $actual, mixed $expected)

Determine if an attribute matches a requested value.

Parameters

mixed $actual
mixed $expected

Return Value

bool

at line 1176
string getPermissionClass()

Get the permission model class.

Return Value

string

at line 1184
string getCacheKey()

Get the current global permission cache key.

Return Value

string

at line 1192
protected string partitionedCacheKey(string $key, PermissionPartition|null $partition = null)

Add the permission partition to a cache key.

Parameters

string $key
PermissionPartition|null $partition

Return Value

string

at line 1206
protected PermissionPartition|null resolvedPartitionArgument(PermissionPartition|null $partition)

Resolve an optional explicit partition argument.

Parameters

PermissionPartition|null $partition

Return Value

PermissionPartition|null

at line 1216
protected string partitionRuntimePrefix(PermissionPartition|null $partition)

Build the runtime key prefix for a partition.

Parameters

PermissionPartition|null $partition

Return Value

string

at line 1229
PermissionRegistrar setPermissionClass(string $permissionClass)

Set the permission model class.

Boot or tests only. The model class is stored on the singleton registrar and affects every later permission lookup in this worker.

Parameters

string $permissionClass

Return Value

PermissionRegistrar

at line 1244
string getRoleClass()

Get the role model class.

Return Value

string

at line 1257
PermissionRegistrar setRoleClass(string $roleClass)

Set the role model class.

Boot or tests only. The model class is stored on the singleton registrar and affects every later role lookup in this worker.

Parameters

string $roleClass

Return Value

PermissionRegistrar

at line 1272
string|null getTeamClass()

Get the team model class.

Return Value

string|null

at line 1285
PermissionRegistrar setTeamClass(string|null $teamClass)

Set the team model class.

Boot or tests only. The model class is stored on the singleton registrar and affects every later team permission lookup in this worker.

Parameters

string|null $teamClass

Return Value

PermissionRegistrar

at line 1296
Repository getCacheRepository()

Get the cache repository.

Return Value

Repository

at line 1304
Store getCacheStore()

Get the cache store.

Return Value

Store

at line 1312
protected Collection getPermissionsWithRoles(string|null $permissionClass = null)

Get permissions with their roles.

Parameters

string|null $permissionClass

Return Value

Collection

at line 1322
protected Collection getRolesForCache()

Get roles for cache.

Return Value

Collection

at line 1382
bool hasDeniedRolePermissions()

Determine if any cached role-permission edge is denied.

Return Value

bool

at line 1390
protected bool pivotIsDenied(Model $model)

Determine if a hydrated pivot marks the permission as denied.

Parameters

Model $model

Return Value

bool

at line 1404
protected Collection relationCollection(Model $model, string $relation)

Get a hydrated relation collection.

Parameters

Model $model
string $relation

Return Value

Collection

at line 1534
static bool isUid(mixed $value)

Determine if a value is a UUID or ULID.

Parameters

mixed $value

Return Value

bool

at line 1554
static void flushState()

Flush all static state.

Return Value

void