Laravel AccessProof v1.2.1

Laravel AccessProof v1.2.1

This backwards-compatible patch focuses on field-tested documentation and installation assurance. The public PHP API and runtime implementation are unchanged from v1.2.0.

Independent SaaS verification

The published package was installed as a Composer dev dependency in a separate private multi-tenant Laravel SaaS application and executed against actual application routes with disposable fixtures.

• Nine authorization defects were reproduced in the host application before fixes: two tenant-selection issues, four same-tenant object/role issues, and three cross-tenant related-record references.
• After application fixes, 34 tests / 86 assertions passed on SQLite and again on MySQL 8.
• The host repository and customer systems remain private; this is a scoped regression-testing field report, not a comprehensive security certification.

See the anonymized field report and updated scenario cookbook.

Publication quality

A dedicated independent Laravel 13 consumer job now installs the current stable Packagist package, while another consumer job installs the checked-out source. The fixture also exercises watchRows() with actual SQLite records.

Install

composer require --dev mykholy/laravel-accessproof:^1.2

Supported: PHP 8.3+, Laravel 12/13; verified with PHP 8.3/8.4, SQLite, MySQL 8, PostgreSQL 16 and an independent Laravel 13 application.

Use only with isolated test databases and synthetic fixtures. AccessProof neither installs authorization policies nor crawls routes or monitors remote side effects.

Laravel AccessProof v1.2.0

Laravel AccessProof v1.2.0

A backwards-compatible feature release for more complete persisted-state regression tests.

New: watchRows()

AccessProof::request($this)
    ->as($outsider)
    ->watchRows('orders', ['tenant_id' => $targetTenantId], ['status'])
    ->postJson('/api/orders/batch-action')
    ->send()
    ->assertDenied()
    ->assertUnchanged();

The new watch compares matching row identities and selected persisted values. It catches unauthorized updates or row replacements even when counts stay constant. It requires an explicit equality predicate and a unique single-column key, uses raw query builder reads, and refuses to capture more than 500 matching rows.

The existing watch() and watchCount() methods remain available and unchanged.

Package correctness

PHPUnit is now explicitly declared in the runtime dependency set. This is needed because the public API uses PHPUnit assertion classes and test-case type hints.

Compatibility

The test suite runs with PHP 8.3/8.4, Laravel 12/13, SQLite, MySQL 8, PostgreSQL 16 and an independent Laravel installation. New negative fixtures cover updates to other rows, net-zero row replacements and bounded snapshot validation.

Install

composer require --dev mykholy/laravel-accessproof:^1.2

AccessProof runs only in Laravel testing environments. It neither discovers routes automatically nor certifies application security.

Laravel AccessProof v1.1.0

Laravel AccessProof v1.1.0

A backwards-compatible feature release that closes a common authorization-testing blind spot: a 404 response can come from a missing route, not from a correct access policy.

New: paired read boundary verification

AccessProof::compareRead($this)
    ->owner($owner)
    ->outsider($outsider)
    ->getJson('/api/orders/'.$order->getKey())
    ->withoutBodyMarker('PRIVATE_TEST_MARKER')
    ->verify();

This tests the exact same URI with an authorized owner (HTTP 200 by default) and an unauthorized outsider (HTTP 403 or 404); the optional marker must not appear in the outsider response. Use expectedOwnerStatus(204) for a different successful 2xx contract.

Test coverage

New intentionally failing fixtures for non-existent routes, exposed resources and denied responses that still leak protected markers. Exercised in the independent Laravel application as well as SQLite, MySQL 8 and PostgreSQL 16 CI matrix.

Boundaries

The new helper only handles GET requests. Use the explicit watched database assertions for mutating requests. Authentication and tenant switching remain the host application's responsibility. It does not crawl routes, enumerate tenants or certify application security.

Install

composer require --dev mykholy/laravel-accessproof:^1.1

See README and Scenario cookbook for examples and safety requirements.

Laravel AccessProof v1.0.1

Laravel AccessProof v1.0.1

A documentation and regression-testing maintenance update, with no changes to the public API.

Improvements

• Thorough README with install instructions, tested scenarios, sample PHPUnit feature tests and full API reference.
• New test cookbook for ownership, cross-tenant access, denied writes and response-body leaks.
• Clarified test-environment safety, unobserved side effects and 404 false positives.
• Updated package description, discovery keywords and maintainer/support links.
• A new negative regression fixture ensures that a 403 response containing protected data is caught by the leak assertion.

Compatibility

• PHP 8.3+; Laravel 12/13.
• PHPUnit, PHPStan, Pint, MySQL 8, PostgreSQL 16 and independent consumer installation are exercised in CI.

Installation

composer require --dev mykholy/laravel-accessproof:^1.0

See README for usage and limitations. AccessProof is an explicit test library, not an automatic security scanner.

Laravel AccessProof v1.0.0

Laravel AccessProof v1.0.0

The first stable release of the deliberately narrow AccessProof HTTP authorization testing API.

Included

• In-process JSON GET/POST/PUT/PATCH/DELETE feature-test probes with an explicit authenticated actor.
• Status assertions for allowed, forbidden, denied or unauthenticated requests.
• Response-body marker checks to detect disclosure of synthetic protected values.
• Eloquent model snapshots using unscoped SQL reads to catch watched row updates/deletes after denied requests.
• Scoped row-count watches to catch changes to matching record counts, including unauthorized inserts.
• Explicit test-environment guard and single-use request builders.
• Tests covering intentionally broken authorization boundaries.

Verified compatibility

• PHP 8.3/8.4 with Laravel 12/13, using matching Orchestra Testbench versions.
• SQLite, MySQL 8 and PostgreSQL 16 integration runs.
• Independent Laravel 13 consumer installation and HTTP authorization fixture.
• Composer validation, PHPUnit, PHPStan and Pint.

Boundaries

AccessProof verifies only the HTTP interactions and database state a test explicitly declares. A 404 may originate from a missing route. Unwatched records, asynchronous jobs, external services and transient writes are not inspected. The package is not a security certification or an automatic authorization scanner.

Installation

After registering the GitHub repository with Packagist, install with:

composer require --dev mykholy/laravel-accessproof:^1.0

The author must perform the initial Packagist repository submission. A GitHub Release does not automatically register a new package with Packagist.

MIT © 2026 Ahmed El-Kholy.