Roles and permissions#

Roles are defined in config or per panel. Each carries a label, an optional description and the permissions it grants; owners implicitly hold every permission and * grants all.

TeamsPlugin::make()->roles([
    'owner'  => ['label' => 'Owner', 'permissions' => ['*']],
    'admin'  => ['label' => 'Admin', 'description' => 'Manages members and settings.', 'permissions' => ['create', 'read', 'update', 'delete']],
    'editor' => ['label' => 'Editor', 'permissions' => ['create', 'read', 'update']],
    'viewer' => 'Viewer',
], default: 'viewer', managers: ['admin']);

Checking#

$user->hasTeamRole($team, ['owner', 'admin']);
$user->hasTeamPermission($team, 'update');
Teams::userCan($user, $team, 'update');

Route::get('/reports', ReportsController::class)->middleware('team.can:reports.view');

@teamcan('update')
    <x-filament::button>Edit</x-filament::button>
@endteamcan

All of them resolve against the current Filament tenant; pass a team explicitly to @teamcan('update', $team).

Role providers#

The RoleProvider decides where roles come from and what they mean:

Pick one explicitly with roles.provider or TeamsPlugin::make()->roleProvider('spatie'), or implement Packstub\Teams\Roles\RoleProvider yourself (roles(), assigned(), removed(), can(), describe()).

Read more: Filament Shield →