- Is epubli4/permission-bundle a Laravel package?
- No. epubli4/permission-bundle is a Symfony bundle built for API Platform microservices, not a Laravel package. It relies on Symfony dependency injection, Doctrine ORM filters, API Platform security annotations, and JWT-based access tokens. In a Laravel application the architecture fit is poor, and adopting it would mean reimplementing the concepts rather than installing the Composer package.
- How do I install epubli4/permission-bundle with Composer?
- Install it with composer require epubli4/permission-bundle. With Symfony Flex the bundle is registered automatically; without Flex you add EpubliPermissionBundle to config/bundles.php. For unit tests the README also recommends l0wskilled/api-platform-test version 0.1.21 or higher. This is a Symfony workflow, so Laravel's package discovery does not apply.
- What configuration does epubli4/permission-bundle require?
- You create config/packages/epubli_permission.yaml and set microservice_name. You also define permission_export_route and aggregated_permissions_route, including base_uri, path, and the permission key required for each call. Enable the Doctrine self-permission filter in config/packages/doctrine.yaml, and add config/packages/test/epubli_permission.yaml with is_test_environment set to true for tests.
- How does the Doctrine self-permission filter work in this bundle?
- Entities implement SelfPermissionInterface, typically via SelfPermissionTrait, so the bundle knows which column scopes records to the current user. The SelfPermissionFilter is registered as a Doctrine ORM filter and applies that scoping globally to queries. This is convenient but adds query complexity, so monitor database performance and verify filter correctness in production. Also note that global filters can mask authorization bugs if tests do not exercise failure modes.
- Can I use epubli4/permission-bundle with Laravel?
- Not directly. The bundle is Symfony and API Platform specific, so a Laravel integration would be a rewrite, not an adoption. Borrow the patterns instead: centralized permission export and aggregation plus row-level self-permission scoping. Implement them with Laravel Gate and Policy classes, middleware, or a package such as spatie/laravel-permission backed by your central permission service.
- Which Symfony, API Platform, Doctrine, and PHP versions does the bundle support?
- Expect PHP 7.4 or 8.0-era code, Symfony 4 or 5, API Platform 2.x, and Doctrine ORM 2.x. The package was last released in July 2021 and uses annotation-based configuration that is deprecated in modern PHP and Symfony. It is not verified for Symfony 6 or 7, API Platform 3, or newer Doctrine versions. Run a dependency and deprecation audit before committing to it.
- How do I test a service that uses epubli4/permission-bundle?
- Use l0wskilled/api-platform-test 0.1.21 or higher and set is_test_environment to true in config/packages/test/epubli_permission.yaml. The bundle provides test traits such as JWTMockTrait to reduce mocking effort for JWT and permission calls. Add contract tests for the central user service and explicit failure-mode tests for denied permissions. Test helpers can hide authorization mistakes if you only assert happy paths.
- What are the production risks of epubli4/permission-bundle?
- The central user service becomes a synchronous runtime dependency for permission checks and aggregation. Add caching, timeouts, circuit breakers, and fallbacks, and confirm the JWT format and permission keys match the service contract. The package has very low adoption, no release since 2021, and security-sensitive behavior around JWT handling and global Doctrine filters. Budget for internal security review, forking, patching, and dependency upgrades.
- What alternatives should I consider to epubli4/permission-bundle for Laravel?
- For Laravel, use native Gate and Policy authorization, middleware, or spatie/laravel-permission combined with a central permission service. For Symfony, consider Symfony security voters, attributes, and custom Doctrine filters rather than a 2021-era bundle. The transferable idea is permission aggregation plus row-level scoping, not the package itself. Choose alternatives that match your framework and have active maintenance.
- Is epubli4/permission-bundle actively maintained?
- No. The last release was 2021-07-02, and the repository has around 3 stars and 0 dependents. Community support is minimal, so you should rely on source code and internal expertise. If you adopt it, plan to fork the repository, pin dependencies, convert annotations to attributes where needed, and own security monitoring.