Laravel Roles & Permissions Audit

Analyze a Laravel project's roles, permissions, and authorization implementation. Scan all PHP source files (excluding vendor/, node_modules/, storage/) and produce a structured report of findings with actionable suggestions.

This is NOT a security penetration test. Focus on authorization architecture, role/permission patterns, and access control implementation quality.

What to Check

1. UI-Only Authorization Without Backend Protection

Scan for cases where authorization is checked in Blade templates but NOT enforced in the corresponding controller methods.

Why it matters: Hiding a button with @can or @if(auth()->user()->isAdmin()) does not prevent a direct HTTP request to the endpoint. Every authorization check in the UI must have a matching backend check. This is a real security gap, not a style issue.

What to flag:

• @can, @if(auth()->user()->...), or role/permission checks in Blade templates where the corresponding controller method has no Gate::authorize(), $this->authorize(), #[Authorize], Policy check, or can middleware on the route
• Form actions or links hidden with @can in Blade but the POST/PUT/DELETE endpoint has no authorization
• Admin-only navigation items hidden with @if checks but the underlying routes have no middleware or Policy protection