Overridable controllers, policies and default permissions (RBAC, multi-auth)

Controllers overridable from config or the container
Routes registered by a macro so apps choose prefix, middleware and guard
Nothing assumes the web guard or App\Models\User
A Policy and default permissions registered through javaabu/permissions' registration API
Policies overridable from config or Gate::policy()
Feature tests for authorization and for two guards

Add overridable role controllers, routes and API

Document v3 for people and agents; add the Boost guideline and skill

Done on next-gen (c50699a). The docs are docs/basic-usage/managing-roles.md and docs/advanced-usage/overriding-controllers-and-views.md.

Route::roles([guard, prefix, name, middleware, controller]) stores the guard in the route action (permissions_guard) and defaults the middleware to auth:{guard}.
RolesController answers JSON for API requests and renders Blade or Inertia pages by config('permissions.views'). It can be overridden from config, the route option or the container.
RolePolicy and the view_roles/edit_roles/delete_roles permissions are registered through the package's own API; turn them off with register_defaults.
The tests cover authorization for every action, and two guards.

The real Blade and React pages are tracked in #10; the controller tests use fixture views.

Navigation Menu