Granular access control
Freeze accounts instantly
Track every admin action
Stop reinventing the wheel. Tyro delivers granular role-based access control, intelligent user suspension, and robust authentication for modern Laravel 12 and Laravel 13 apps. Zero lock-in. Total control.
Handling authentication, granular roles, and permissions securely takes weeks to build from scratch. Tyro abstracts away the complexity of Role-Based Access Control, delivering an enterprise-ready architecture that natively bridges Laravel's Gate, Sanctum tokens, and your application's business logic.
~ php artisan tyro:install
Tyro seamlessly integrates with Laravel's native Gate and Policy engines while giving you a beautifully fluent API to manage access control.
Check permissions in controllers, middleware, or Blade templates with intuitive helpers. Support for wildcard matching and heavily cached checks ensures sub-millisecond response times.
// Check specific privilege via Gate
if ($user->can('reports.run')) {
return $this->generateReport();
}
// Check if user has admin role
if ($user->hasRole('admin')) {
return $this->generateAllReports();
}
// Require all listed privileges explicitly
$hasAccess = $user->hasPrivileges([
'reports.run',
'billing.view'
]);Eight purpose-built middleware aliases for enforcing role and privilege checks directly on your routes. Require all or any abilities with flexible, elegant syntax.
use Illuminate\Support\Facades\Route;
// Require the admin role
Route::middleware(['auth', 'role:admin'])
->get('/dashboard', DashboardController::class);
// Allow either editor OR admin
Route::middleware(['auth', 'roles:editor,admin'])
->post('/articles', ArticleController::class);
// Require ALL listed privileges
Route::middleware('privilege:reports.run,billing.view')
->get('/reports', ReportsController::class);
// Transparently audit sensitive routes
Route::middleware(['auth', 'role:admin', 'tyro.log'])
->delete('/users/{user}', [UserController::class, 'destroy']);Keep your Blade templates pristine. Tyro injects custom directives to handle UI rendering conditionally based on the user's roles and privileges. No more messy PHP logic in your views.
@hasRole('admin')
<div class="admin-panel">
Rendered only for admins
</div>
@endhasRole
@hasAnyRole('admin', 'editor')
<div class="editor-tools">
Rendered for admins OR editors
</div>
@endhasAnyRole
@hasPrivilege('reports.export')
<button class="btn">Export CSV</button>
@endhasPrivilege
{{-- Wraps Laravel's native Gate check --}}
@userCan('users.delete')
<button class="text-red">Delete</button>
@enduserCanTyro comes packed with advanced capabilities to secure your application and streamline your development workflow.
Freeze malicious or inactive accounts instantly. All active Sanctum tokens and sessions are revoked automatically upon suspension.
Track every critical administrative action. Store comprehensive before/after logs that can be viewed via the CLI or queried via the API.
Prevent accidental lockouts. System-critical roles like admin and super-admin are protected at the database layer from being deleted.
Tokens automatically mirror user role and privilege slugs as abilities. Revoke tokens effortlessly. Emergency token rotation is just one command away.
Ship faster with pre-built, standardized REST endpoints for user authentication, registration, and comprehensive RBAC management.
No black boxes. Publish config files, migrations, and factories. Adapt the schema, swap out traits, or selectively disable API routes per environment.
Tyro transforms your Artisan console into an extremely powerful, handy CLI tool. Manage users, roles, privileges, tokens, and inspect audit logs directly from your terminal without ever touching a database GUI.
tyro:user-createCreate usertyro:user-updateUpdate detailstyro:user-deleteDelete usertyro:user-listList userstyro:user-list-with-rolesUsers & rolestyro:user-suspendSuspend usertyro:user-unsuspendRestore usertyro:user-suspendedList suspendedtyro:user-rolesUser's rolestyro:user-privilegesUser's privstyro:user-tokenMint tokentyro:role-createCreate roletyro:role-updateUpdate roletyro:role-deleteDelete roletyro:role-listList all rolestyro:role-list-with-privilegesRoles & privstyro:role-assignAssign to usertyro:role-removeRemove from usertyro:role-usersUsers with roletyro:role-purgePurge rolestyro:privilege-createCreate privtyro:privilege-updateUpdate privtyro:privilege-deleteDelete privtyro:privilege-listList privstyro:privilege-attachAttach to roletyro:privilege-detachDetach from roletyro:privilege-purgePurge privstyro:auth-loginMint tokentyro:auth-logoutRevoke tokentyro:auth-logout-allRevoke user'styro:auth-logout-all-usersEmergency rot.tyro:auth-meInspect tokentyro:installFull installtyro:user-prepareAdd User traittyro:seed-allSeed all RBACtyro:seed-rolesSeed rolestyro:seed-privilegesSeed privstyro:publish-configPublish configtyro:publish-migrationsPublish migstyro:versionVersion infotyro:aboutAbout tooltyro:postmanAPI collectiontyro:audit-listView logstyro:audit-purgePurge old logsInstall Tyro, run the artisan command, and instantly gain a robust authentication layer with seeded default roles, privileges, and an admin user.
Require Tyro via Composer. The service provider is automatically discovered.
composer require hasinhayder/tyro
Automatically configure Sanctum, run migrations, seed initial roles, wire up your User model, and bootstrap your first super-admin account.
php artisan tyro:install
Protect routes, check permissions, and build interfaces. You're ready to ship.
@hasRole('admin')
<div class="admin-panel">
Welcome back, Admin.
</div>
@endhasRole
@userCan('users.delete')
<button class="btn-danger">Delete User</button>
@enduserCanRoute::middleware(['auth', 'role:admin'])
->group(function () {
// Your protected admin routes
});Stop wrestling with boilerplate authentication. Let Tyro handle roles, privileges, and API tokens - so you can focus on building your actual product.