How to Setup Roles and Permissions in Laravel 12: Complete Guide

Laravel is one of the most popular PHP frameworks, known for its elegant syntax and robust features. Among these features is its ability to handle user authentication and authorization seamlessly. When building applications with multiple user types—such as admins, editors, or regular users—managing roles and permissions becomes essential.

In this guide, we’ll explore how to set up roles and permissions in Laravel 12 using the popular spatie/laravel-permission package. By the end, you’ll have a fully functional role-based access control (RBAC) system.

Prerequisites

• Laravel 12 installed (you can install it via Composer: composer create-project laravel/laravel my-app "12.*")
• A configured database (MySQL, PostgreSQL, or SQLite)
• Basic knowledge of Laravel’s Eloquent ORM, migrations, and middleware
• Composer installed on your system

Step 1: Install the Laravel Permission Package

The spatie/laravel-permission package is a widely-used solution for managing roles and permissions in Laravel. It provides an intuitive API to assign roles to users and define permissions for specific actions.

Installation

composer require spatie/laravel-permission

After installation, publish the package’s configuration and migration files:

php artisan vendor:publish --provider="Spatie\Permission\PermissionServiceProvider"

This will create a config/permission.php file and migration files in the database/migrations directory.

Run Migrations

php artisan migrate

The package adds tables for roles, permissions, and their relationships with users. You should now see the following tables in your database:

• roles: Stores role names (e.g., "admin", "editor").
• permissions: Stores permission names (e.g., "edit posts", "delete users").
• model_has_roles: Pivot table linking users (or other models) to roles.
• model_has_permissions: Pivot table linking users to specific permissions.
• role_has_permissions: Pivot table linking roles to permissions.

Step 2: Set Up the User Model

To use roles and permissions with your User model, add the HasRoles trait provided by the package. Open app/Models/User.php and update it as follows:

namespace App\Models;

use Illuminate\Foundation\Auth\User as Authenticatable;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasRoles;

    protected $fillable = [
        'name', 'email', 'password',
    ];

    protected $hidden = [
        'password', 'remember_token',
    ];
}

Step 3: Create Roles and Permissions

Now, let’s define some roles and permissions. You can do this programmatically (e.g., in a seeder) or via a controller. For this guide, we’ll use a database seeder.

Create a Seeder

php artisan make:seeder RolePermissionSeeder

Open database/seeders/RolePermissionSeeder.php and add the following code:

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Spatie\Permission\Models\Role;
use Spatie\Permission\Models\Permission;

class RolePermissionSeeder extends Seeder
{
    public function run()
    {
        // Create Permissions
        Permission::create(['name' => 'create posts']);
        Permission::create(['name' => 'edit posts']);
        Permission::create(['name' => 'delete posts']);
        Permission::create(['name' => 'manage users']);

        // Create Roles and Assign Permissions
        $adminRole = Role::create(['name' => 'admin']);
        $editorRole = Role::create(['name' => 'editor']);
        $userRole = Role::create(['name' => 'user']);

        // Assign Permissions to Roles
        $adminRole->givePermissionTo(['create posts', 'edit posts', 'delete posts', 'manage users']);
        $editorRole->givePermissionTo(['create posts', 'edit posts']);
        $userRole->givePermissionTo('create posts');
    }
}

Run the Seeder

php artisan db:seed --class=RolePermissionSeeder

Conclusion

Setting up roles and permissions in Laravel 12 with the spatie/laravel-permission package is straightforward and powerful. By following this guide, you’ve learned how to install the package, define roles and permissions, assign them to users, protect routes, and check authorization in your application.

Whether you’re building a simple blog or a complex enterprise system, this RBAC setup will help you manage access efficiently. Happy coding! 🚀