- Can I install alchemy/acl-bundle in a Laravel application with Composer?
- Not practically. The package is a Symfony bundle built around a Bundle class, DI extension, config tree and tagged services, none of which boot inside Laravel's container. Release 1.5.0 pins it to Symfony 8 while Laravel 11 and 12 ship Symfony 7.x components, so a plain composer require collides and even a forced install leaves dead weight. Use it as a reference design or run it as a separate Symfony service instead.
- What does alchemy/acl-bundle actually do?
- It adds an access control entry (ACE) layer on top of any configured entity, letting you grant permissions to a single user or a group. Each ACE is keyed by userType, userId, objectType and objectId, with a mask holding the permission bits. A NULL userId means everybody, and a NULL objectId means every object of that type. It also ships REST endpoints and Redis-cached access tokens for fast checks.
- How do I configure which entities are ACL-enabled?
- You list them under alchemy_acl.objects in config/packages/alchemy_acl.yaml, mapping a short objectType key to an entity class such as publication: App\Entity\Publication. Those keys become the valid objectType values used by the API. You must also alias your UserRepository service to Alchemy\AclBundle\Repository\UserRepositoryInterface in config/services.yaml, otherwise the bundle cannot resolve users.
- What do userType, userId, objectType, objectId and mask mean in an ACE?
- userType is either user or group and decides how userId is interpreted. userId holds a user or group identifier, or NULL to allow everybody. objectType must match a key defined in the YAML configuration, and objectId scopes the entry to one record, or NULL to apply it to all objects of that type. mask carries the permission bits, but the README never documents their meaning, so treat the bit legend as an inherited, undocumented contract.
- Which REST endpoints does the bundle expose?
- GET /permissions/aces lists entries and accepts userType, userId, objectType and objectId query filters. PUT /permissions/ace creates or updates an entry from a JSON body containing userType, userId, objectType, objectId and mask. DELETE /permissions/ace removes an entry using the same identifiers. These routes are loaded by the bundle's own router, so they are Symfony routes and will not appear in a Laravel route list.
- How does the Redis access token cache work?
- The bundle expects a cache pool named exactly accessToken.cache, wired through framework.cache.pools in config/packages/cache.yaml with adapter cache.adapter.redis. That pool name is a hard-coded auto-wiring contract, not a configurable option. Under Laravel you would have to replace it with your own Redis facade or cache store binding, since the bundle never boots there.
- What is the closest Laravel alternative to alchemy/acl-bundle?
- For a native solution, a single aces table plus Gate::before or policy hooks reproduces the same semantics, while spatie/laravel-permission covers conventional role and permission assignment. If you need the bundle's exact REST contract and tested behaviour, run it in a small Symfony 8 sidecar and call it over HTTP from Laravel. Porting the ACE entity, mask semantics and repository interface into a first-party Laravel package is the middle option.
- Which Laravel and PHP versions are compatible with this package?
- None directly. Version 1.5.0 targets Symfony 8, which implies PHP 8.4 or newer, while Laravel 11 and 12 run on Symfony 7.x components, a full major apart. The release notes state no PHP minimum and list no deprecations, so you cannot confirm requirements without reading the diff of PR #7. The only way to pin Symfony 8 independently of your Laravel app is the sidecar approach.
- Is alchemy/acl-bundle safe to use in production?
- Treat it with caution. The project has four stars, zero dependents and a bus factor of one, and version 1.5.0 was a single-contributor change that bumped framework major support under a minor version, which is a semver smell. It is also a security-critical permission layer whose mask contract is undocumented. Pin exact versions and review every upgrade by hand.
- How do I migrate the ACE model from this bundle to Laravel?
- Create an aces table with user_type, user_id, object_type, object_id and mask columns, keeping NULL for the wildcard scopes the bundle defines. Resolve permissions through Gate::before or a policy that queries that table and replicates the mask bit checks you extract from the Symfony code. Cache the resolved masks in Redis under your own key naming. This keeps the tested semantics and discards the Symfony plumbing you cannot reuse.