Tyro

Tyro is the complete authentication, roles & privileges package for Laravel 12 & 13: a modern RBAC/ACL solution built on Laravel Sanctum, with a fantastic CLI that manages everything for you.

Set up in under a minute. No complicated configuration. No boilerplate.

📖 Full documentation

• Instant install: one command bootstraps Sanctum, runs migrations, seeds roles & privileges, and prepares your User model.
• RBAC & ACL: unlimited roles with granular privileges; check access in controllers, middleware, Blade, or anywhere with $user->can(), hasRole(), hasPrivileges(), and more.
• 40+ Artisan commands: manage users, roles, privileges, tokens, suspensions, and audit logs from the CLI, perfect for automation and CI/CD.
• Ready for APIs: Sanctum token auth, REST endpoints for auth, user, role & privilege management, and a ready-made Postman collection.
• Middleware & Blade directives: role:, privilege:, ability: middleware plus 7 directives like @hasRole and @hasPrivilege.
• User suspension: freeze accounts instantly with an optional reason; all active tokens are revoked automatically, and users can be restored anytime.
• Audit trail: every role/privilege assignment, user suspension, and admin action is logged, with CLI commands to review and purge history.
• Security hardened: token abilities mirror roles & privileges, suspension instantly revokes tokens, and protected roles can't be deleted.
• Zero lock-in: publish config, migrations, and factories; disable API routes or CLI commands per environment.

• PHP ^8.2
• Laravel 12 or 13
• Laravel Sanctum ^4.0

composer require hasinhayder/tyro
php artisan tyro:install

That's it. tyro:install sets up Sanctum, prepares your User model, runs migrations, and seeds the default roles & privileges, including a ready-to-use admin@tyro.project superuser (password: tyro).

Want the ready-made API client? Run php artisan tyro:postman to open the official Postman collection.

$user->hasRole('admin');                                // check single role
$user->hasRoles(['admin', 'editor']);                  // must have ALL roles
$user->hasAnyRole(['admin', 'editor']);                // must have ANY role
$user->hasPrivilege('reports.run');                     // check single privilege
$user->hasPrivileges(['reports.run', 'billing.view']); // must have ALL privileges
$user->can('reports.run');                             // check privilege, role, or Laravel Gate

use HasinHayder\Tyro\Models\Role;
use HasinHayder\Tyro\Models\Privilege;

$user->assignRole($adminRole);                  // attach a role
$user->removeRole($editorRole);                 // detach a role
$role->privileges()->attach($privilege->id);    // grant a privilege
$role->privileges()->detach($privilege->id);    // revoke a privilege

Route middleware aliases available out of the box:

Example route definitions:

Route::middleware(['auth:sanctum', 'role:admin'])->get('/admin', AdminController::class);
Route::middleware(['auth:sanctum', 'roles:admin,editor'])->get('/dashboard', DashboardController::class);
Route::middleware(['auth:sanctum', 'privilege:reports.run'])->get('/reports', ReportsController::class);
Route::middleware(['auth:sanctum', 'privileges:reports.run,billing.view'])->get('/finance', FinanceController::class);

In addition to basic role/privilege checks (hasRole, hasRoles, hasAnyRole, hasPrivilege, hasPrivileges, can), HasTyroRoles includes convenient helper methods:

// Role & privilege checking methods
$user->hasRole('admin');                                // check single role
$user->hasRoles(['admin', 'editor']);                  // check user has ALL roles
$user->hasAnyRole(['admin', 'editor']);                // check user has ANY role
$user->hasPrivilege('reports.run');                     // check single privilege
$user->hasPrivileges(['reports.run', 'billing.view']); // check user has ALL privileges
$user->can('reports.run');                             // check privilege, role, or Laravel Gate

// Quick boolean role checks
$user->isAdmin();        // checks for 'admin' role
$user->isSuperAdmin();   // checks for 'super-admin' role
$user->isEditor();       // checks for 'editor' role
$user->isCustomer();     // checks for 'customer' role
$user->isUser();         // checks for 'user' role

// Inspection helpers
$user->hasNoRoles();     // true if user has 0 roles assigned
$user->rolesCount();     // count of assigned distinct roles (excluding super-admin wildcard)
$user->privileges();     // returns Eloquent Collection of all unique user privileges

$user->suspend('Pending account review');  // instantly revokes all tokens
$user->isSuspended();                      // true/false
$user->getSuspensionReason();
$user->unsuspend();

Every role assignment, privilege change, suspension, and admin action is recorded automatically:

php artisan tyro:audit-list              # recent activity
php artisan tyro:audit-list --event=role.assigned
php artisan tyro:audit-purge             # purge logs per retention policy

@hasRole('admin')
    Welcome, Admin!
@endhasRole

@hasPrivilege('reports.run')
    <a href="/reports">View Reports</a>
@endhasPrivilege

@hasRoles(['admin', 'editor'])
    Full editing permissions active.
@endhasRoles

One of Tyro's most powerful features: you can manage everything from the CLI (users, roles, privileges, tokens, suspensions, and audit logs) without touching the database directly. Perfect for automation, CI/CD pipelines, and incident response.

Run php artisan list tyro to see every available command. Most commands also have shorter aliases (for example, tyro:login, tyro:users, tyro:roles, tyro:me, tyro:audit).

Tyro ships REST endpoints for auth, user management, and role/privilege CRUD (enabled by default, prefix api). Disable them whenever you want:

TYRO_DISABLE_API=true

Publish and customize everything:

php artisan vendor:publish --tag=tyro-config
php artisan vendor:publish --tag=tyro-migrations

Every option in config/tyro.php

API & routes

Users & roles

Passwords

Sessions & tokens

Audit trail

Cache

• Tyro Labs: complete Auth & Admin platform for Laravel.
• tyro-login: production-ready login UI with OTP, TOTP, magic login, social login, and password reset.
• tyro-dashboard: admin dashboard for CRUD, roles, privileges, users, and permissions.

Tyro is open-sourced software licensed under the MIT license.