Rbac Bundle Laravel Package

Getting Started

Minimal Setup

1. Install the Bundle

   composer require olivier127/rbac-bundle
   

   Add to config/bundles.php:

   return [
       // ...
       Olivier127\RbacBundle\RbacBundle::class => ['all' => true],
   ];
   

2. Configure RBAC Update config/packages/rbac.yaml (auto-generated after installation):

   rbac:
       roles:
           - { name: 'admin', permissions: ['*'] } # Wildcard for all permissions
           - { name: 'editor', permissions: ['post:edit'] }
       users:
           - { username: 'admin', roles: ['admin'] }
   

3. First Use Case: Check Permissions In a controller or service:

   use Olivier127\RbacBundle\Security\RbacVoter;
   
   $rbacVoter = $this->container->get(RbacVoter::class);
   if ($rbacVoter->hasPermission('editor', 'post:edit')) {
       // Grant access
   }
   

Implementation Patterns

Core Workflows

1. Role-Permission Mapping Define roles and permissions in config/packages/rbac.yaml:

   rbac:
       roles:
           - { name: 'moderator', permissions: ['post:approve', 'comment:delete'] }
           - { name: 'user', permissions: ['post:view'] }
   

2. Dynamic Permission Checks Use the RbacVoter in controllers/services:

   $rbacVoter = $this->get(RbacVoter::class);
   if ($rbacVoter->hasPermission($user->getRoles(), 'post:publish')) {
       return $this->render('post/edit.html.twig');
   }
   

3. Hierarchical Role Inheritance Leverage parent-child role relationships:

   rbac:
       roles:
           - { name: 'super_admin', permissions: ['*'] }
           - { name: 'admin', parent: 'super_admin', permissions: ['user:manage'] }
   

4. Twig Integration Display UI based on permissions:

   {% if is_granted('post:edit') %}
       <a href="/posts/edit">Edit Post</a>
   {% endif %}
   

5. CLI Management Use Symfony commands to manage RBAC:

   php bin/console rbac:role:create admin --permissions="*"
   php bin/console rbac:user:add admin --roles="admin"
   

Integration Tips

• Symfony Security Integration Combine with Symfony’s security system for seamless authentication:

   security:
       providers:
           rbac_provider:
               entity: { class: App\Entity\User, property: username }
       firewalls:
           main:
               rbac: true
  

• Doctrine ORM Store roles/permissions in a database table (e.g., rbac_role, rbac_permission) and sync with the bundle’s configuration.

• Event Listeners Listen to rbac.role.created or rbac.user.assigned events for custom logic:

   use Olivier127\RbacBundle\Event\RbacEvents;
  
   $eventDispatcher->addListener(RbacEvents::ROLE_CREATED, function ($event) {
       // Log or notify when a role is created
   });
  

Gotchas and Tips

Pitfalls

1. Wildcard Permissions (*) Overuse can lead to security risks. Prefer explicit permissions where possible.

2. Caching Issues Clear Symfony cache after modifying rbac.yaml:

   php bin/console cache:clear
   

3. Case Sensitivity Role/permission names are case-sensitive. Use consistent casing (e.g., snake_case).

4. CLI Command Conflicts Ensure no other bundle uses similar command names (e.g., rbac:role).

5. Database Sync If using Doctrine, manually sync rbac_role/rbac_permission tables with YAML config to avoid desyncs.

Debugging

• Enable Debug Mode Set debug: true in rbac.yaml to log permission checks:

  rbac:
      debug: true
  

• Check Logs Look for rbac entries in var/log/dev.log for denied permissions or errors.

• Validate Configuration Use the rbac:validate command to check for syntax errors:

  php bin/console rbac:validate
  

Extension Points

1. Custom Voters Extend RbacVoter for domain-specific logic:

   class CustomRbacVoter extends RbacVoter {
       protected function supports($attribute, $subject) {
           return $attribute === 'custom:permission';
       }
   }
   

2. Dynamic Role Assignment Assign roles programmatically:

   $rbacManager = $this->get('rbac.manager');
   $rbacManager->assignRole('user', 'editor');
   

3. Permission Groups Group permissions for easier management (e.g., post:* for all post-related actions).

4. API Integration Use the RbacVoter in API controllers to validate requests:

   if (!$rbacVoter->hasPermission($user, 'api:write')) {
       throw new AccessDeniedException();
   }