laravel-permission VS PermissionManager

For example, let's take look at the metrics for Spatie's Laravel Permission package at the time of this writing:

I am not sure how Passport would be used for handling permissions, Passport is for authentication. I would recommend using Laravel Permission to handle your requirements. You can assign roles to users to scope out general permissions but ultimately the permissions are what should be used to limit functionality.

If I remember correctly Spatie's permissions package allows for logic like "let this specific user edit models of this type" but does not allow for logic like "let this specific user edit only that specific model".

Despite this I pointed in the conversation above a super interesting point made by the guys at Spatie making the Laravel permissions package, where they recommend to encapsulate the authorization logic inside policies, and it is a great way to keep things clean, but in this case its not straightforward to do so, at least not if we follow the pure "Laravel-way" of doing things.

https://github.com/jeremykenedy/laravel-logger#authentication-middleware-usage https://github.com/beyondcode/laravel-dump-server https://github.com/barryvdh/laravel-debugbar https://github.com/laravel-shift/blueprint https://github.com/spatie/laravel-backup https://github.com/spatie/laravel-permission https://github.com/spatie/laravel-activitylog https://github.com/realrashid/sweet-alert https://github.com/rappasoft/laravel-livewire-tables https://github.com/yajra/laravel-datatables https://github.com/Labs64/laravel-boilerplate https://github.com/creativetimofficial/argon-dashboard-laravel https://github.com/the-control-group/voyager https://github.com/beyondcode/laravel-er-diagram-generator

In this article, we'll be using the Laravel Permission package from Spatie.

There are a few open source Laravel packages for managing roles and permissions. See https://github.com/spatie/laravel-permission or https://github.com/JosephSilber/bouncer.

I've been reading the docs on spatie about middleware, but the PermissionManager docs have me a bit confused in steps 7A&B. I'm thinking I need to publish the Routes first and then apply my custom middleware rules for not allowing suppliers to access User/Role/Permission. Is that right? Any help would be greatly appreciated. Thank you!