- Can I use this bundle in a vanilla Laravel project without ApiBoxSym?
- Yes, but with adjustments. The bundle relies on ApiBoxSym’s architecture, so you’ll need to abstract or replace framework-specific components like service providers. Core dependencies (e.g., API Platform, Symfony) must align with Laravel’s ecosystem. Start by checking the `composer.json` for conflicts and replace ApiBoxSym-specific logic with Laravel equivalents.
- How do I integrate this with Laravel Sanctum or Passport for authentication?
- UserBundle handles RBAC but doesn’t include auth logic. Pair it with Sanctum/Passport by extending their user providers or creating custom middleware to bridge permission checks. For example, override Sanctum’s `authenticate` method to include UserBundle’s `hasPermission()` logic. Ensure your auth tokens reference the UserBundle’s user model.
- Does this bundle support custom user fields like profile_data or tags?
- Yes, but you’ll need to extend the User model. UserBundle provides a base schema, so you can add custom fields via migrations or model attributes. For API exposure, use API Platform’s `@ApiResource` annotations to include new fields in serialization groups. Test custom fields with the bundle’s seeders to ensure they persist correctly.
- What Laravel versions and dependencies does this bundle support?
- UserBundle targets Laravel 10+ and requires Symfony 6.x and API Platform 3.x. Verify compatibility by checking the `composer.json` constraints. If using older Laravel versions, you may need to downgrade dependencies or fork the package. Always test migrations and API resources in a staging environment before production.
- How does permission caching work, and can I optimize it for high traffic?
- UserBundle likely caches permissions in memory (e.g., via Symfony’s cache system). For high-traffic apps, enable Redis or database caching for `hasPermission()` checks. Optimize further by using Eloquent’s `with()` to eager-load roles/permissions and avoid N+1 queries. Monitor cache hit ratios with Laravel Debugbar or Blackfire.
- Are there built-in tests for edge cases like circular role dependencies?
- The bundle may include basic tests, but edge cases like circular dependencies aren’t guaranteed. Review the `tests/` directory for RBAC-specific scenarios. For production, add custom tests using Laravel’s `assertPermission()` or mock UserBundle’s `PermissionManager`. Consider fuzz testing with tools like Pest to simulate real-world permission conflicts.
- How do I migrate an existing user/permission system to this bundle?
- Start by comparing your current schema (e.g., `users`, `roles`, `permissions`) with UserBundle’s migrations. Use Laravel’s `Schema::hasTable()` to avoid conflicts. Write a custom migration to transform old data into UserBundle’s format, then seed initial roles/permissions using the bundle’s seeders. Test with a subset of users before full migration.
- What are the performance implications of using RBAC with this bundle?
- RBAC adds overhead, especially with deep role hierarchies. UserBundle’s `hasPermission()` may trigger multiple queries if not optimized. Mitigate this by using query scopes, caching, or denormalizing permissions into a `user_permissions` pivot table. Profile with Laravel Telescope to identify bottlenecks in permission checks.
- Are there alternatives to this bundle for Laravel RBAC?
- Yes, consider Spatie’s [Laravel-Permission](https://github.com/spatie/laravel-permission) for a more mature, Laravel-native solution with better documentation and community support. Entrust is another option, though less actively maintained. Evaluate based on your needs: UserBundle excels in API-first apps, while Spatie offers broader Laravel integration.
- How do I expose UserBundle’s resources via REST/GraphQL without API Platform?
- If you’re not using API Platform, create custom controllers or routes to interact with UserBundle’s models. For REST, use Laravel’s `Route::apiResource` for CRUD operations. For GraphQL, integrate with tools like Laravel GraphQL to expose UserBundle’s entities. Ensure your routes/mutations respect the bundle’s authorization logic, even if you’re not using its API resources.