Repository navigation
Operations and Upgrades
Follow the README installation sequence: configure the host user model, ensure its UUID table exists, publish migrations once, review and migrate. Package discovery registers only config/publication resources. No migrations run automatically and no consumer source files are modified.
The user model and all package tables must share the default database connection. Supported storage is canonical UUID strings, not binary UUIDs, polymorphic users or multiple authentication models/guards. The configured user model must be an Eloquent authenticatable. Its primary-key column may have a custom name if the table and UUID type are compatible. Keep the model/table/key/connection configuration stable after installation; changes require an explicit migration plan.
Run with foreign-key checks enabled, MariaDB InnoDB and strict SQL mode, or supported SQLite with foreign keys enabled on every connection. Disabling integrity constraints defeats cleanup and membership enforcement. The package currently permits SQLite and MariaDB drivers; the Laravel mysql driver is used for MariaDB verification, but that driver name does not establish MySQL server support.
Definition names follow the API's bounded lowercase ASCII convention. Team lookup names are unique stable lowercase ASCII identifiers. Their separate display labels are bounded text and may repeat. Updating a label leaves both lookup name and UUID intact. No assignment audit trail, actor storage, events, suspension state or reversible membership removal is provided. Hosts requiring audit records must record actor, target, scope and outcome in their own trusted operations.
No cache stores effective permissions. No manual reset command, queues, scheduler, network service or long-running package worker is needed. A reused service keeps no user/team state. Revocations and role-set changes affect subsequent fresh checks subject to normal database transaction isolation and in-flight operations. Host-created caches and loaded Eloquent collections remain host responsibilities.
Global roles and permissions are never considered in a team context without active membership. Membership is hard-delete state; soft-deleting a host user does not itself remove grants or memberships. The host owns suspended/deleted account authentication and lifecycle policy. Host user hard deletion cascades package relationships.
All public mutation methods are trusted PHP operations. They do not authenticate callers or prevent arbitrary trusted code from invoking them. Use the host's Gates/policies before management operations. Check a resource's actual team and apply host query filters; Access never isolates application data automatically.
Database errors are not swallowed by checks. Mutations retry recognized deadlocks up to five times; exhausted deadlocks, lock timeouts, unsupported topology and integrity failures surface to the host. Translate domain/validation/database errors deliberately at the host boundary and never turn an integrity error into a successful management response.
Use the service for supported mutations. Direct model/relationship/raw SQL mutations bypass validation and serialization. No entity ID update API is provided; IDs are stable. Team deletion, member removal and definition deletion cascade dependent records permanently. Back up before destructive operations; restoring a backup is distinct from rejoining a team.
No authentication, OAuth, OTP, invitations, nested teams, role inheritance, explicit deny rules, wildcard permission matching, billing, data tenancy, frontend, HTTP routes, automatic policy override or administrator bypass. There is one configured user model and one database connection. No persistent caching or benchmark-based performance guarantee is claimed. Inspection returns effective definitions, not grant provenance. SQLite writer serialization limits write throughput.
The first public release was 0.9.0 — Padlock. The current branding update is 0.9.1 — Padlock, using numeric Git tag 0.9.1; the original 0.9.0 Git tag remains immutable. The owner authorized MIT licensing, PR integration to develop and main, GitHub release publication and Packagist distribution as moztopia/access. Packagist should retain only the latest 0.9.x release plus dev-main and dev-develop; finished WIP branches are removed after their exact commits are preserved. Future release operations still require the owning project's controls. Sponsorship follows the Notifications model: Buy Me a Coffee.
Before upgrading a future release, read its changelog, verify PHP/Laravel/database compatibility, back up the package tables and test in a separate host. Do not republish an already-installed create migration under a new timestamp. New schema changes must arrive through separate forward migrations, with rollback consequences documented. Do not drop/recreate production authorization tables as an upgrade strategy.
Copyright © 2026 Moztopia. This package is released under the owner-approved MIT License, matching the Notifications licensing model. The earlier missing-license validation warning is resolved.
Copyright © 2026 Moztopia · Source · Licensing status · Security