Security

What the package protects#

Area	Protection
`/systemroles/admin/*`	`web` + `auth` + `super_admin` (configurable via `route_middleware`)
`/api/systemroles/*`	Off by default. When on: `api` + `auth:sanctum` + `super_admin`
Users DataTables query	Bound parameters only; sort column and direction are whitelisted; page size capped at 1,000
Role assignment	Validated (`user_id` must exist in `users`, `role_id` in `system_roles`) and run in a transaction
Forms	Laravel CSRF protection via the `web` group

What you must protect#

SystemRoles does not check permissions on your own routes. Until you add middleware or checks, every logged-in user can reach every route that only has auth. See Protecting Routes with Middleware.

Checklist#

Keep super_admin in route_middleware.
Give the super admin role to as few accounts as possible. Use an Admin role with permissions for daily work.
Protect your routes with middleware, on groups, after auth.
Check permissions on the server even when you hide buttons in the UI.
Leave load_api_routes off unless you need it.
Require strong login (2FA, verified) for super admin accounts, for example by adding middleware to route_middleware.
Review user_roles_history regularly for unexpected role changes.
Don't let users change their own role. The package's assign screen is super-admin only; keep any screens you build the same.
Write feature tests that confirm each role gets 403 on routes it should not reach.
Back up the system_* and user_roles* tables with the rest of your database.

Things to know#

Session copies go stale. If you store role data in the session (rolesArray(), userPermissions()), it won't change until the user logs in again. Use live checks (roleHas()) for access decisions.
user_roles_in is a snapshot. It does not follow later changes to the matrix. Don't use it for access decisions.
Deny by default. A user with no role has role id 0 and no permissions. A controller or route with no access row is denied by the controller check and by the route middleware recipe.
The super admin bypasses everything. Every check returns "allowed" for it, regardless of matrix values.
GET routes that change data. Reordering permissions and menu items uses GET links. They are only reachable by the super admin, but treat links in the admin area with care (don't paste them into chats or emails).

Reporting a vulnerability#

Please report security problems privately to the author at solomon@tutajua.com rather than in a public GitHub issue.