Weave Code
Abac Bundle Laravel Package
kilix/abac-bundle
A Symfony bundle for attribute-based access control (ABAC). Define policies over user, resource, and environment attributes to make fine-grained, context-aware authorization decisions, integrated with Symfony’s security system.
Symfony Bundle to add support for PHP ABAC
Frequently asked questions about Abac Bundle
- Can I install kilix/abac-bundle in a Laravel application?
- No. kilix/abac-bundle is a Symfony Bundle that depends on Symfony's Kernel, DI container, and config components. It is not installable or functional in a Laravel app. For Laravel, use the underlying kilix/php-abac library with a custom service provider and adapter.
- What is the difference between kilix/abac-bundle and kilix/php-abac?
- kilix/php-abac is the framework-agnostic ABAC evaluation library. kilix/abac-bundle is Symfony-specific glue that registers php-abac services, configuration, and security integration in Symfony. Laravel developers should depend on kilix/php-abac directly.
- How do I add ABAC to Laravel using kilix/php-abac?
- Require kilix/php-abac via Composer, then create a Laravel service provider that binds an evaluator singleton. Implement attribute resolvers for subject, resource, and environment data, and bridge decisions into Gate::before or middleware. Budget one to two engineer-weeks for a competent PHP developer.
- Does kilix/abac-bundle support Laravel 10 or Laravel 11?
- No. The bundle targets Symfony and has no Laravel service provider or facade. Its composer constraints pull Symfony components that conflict with Laravel's container assumptions. Laravel version support only applies if you integrate kilix/php-abac yourself.
- Is kilix/abac-bundle maintained and safe for production authorization?
- Maintenance signals are weak: the CraftCamp fork and original bundle show near-zero activity, with around 15 stars and no dependents. There is no security response capability for an authorization-critical dependency. Treat every behavior as unverified until you read the source and add fail-closed wrappers.
- How should ABAC policy evaluation fail in Laravel, permit or deny?
- It must fail closed: missing attributes, policy-loading errors, and evaluation exceptions should resolve to deny, not permit. Naive integration layers often fail open, creating silent security defects. The kilix packages do not provide an opinionated fail-closed wrapper for Laravel, so you must implement one.
- What are alternatives to kilix/abac-bundle for Laravel authorization?
- Laravel's native Gate and Policy closures handle many role and permission cases. For RBAC, packages like spatie/laravel-permission are mature. For true ABAC, use kilix/php-abac directly or evaluate Casbin or OPA-style external policy engines.
- How do I test ABAC combining algorithms like deny-overrides in Laravel?
- Write unit tests that feed policy sets and attribute bags into the evaluator and assert deny-overrides, permit-overrides, and first-applicable outcomes. Include cases with missing attributes and malformed policies to verify fail-closed behavior. The bundle has no test-coverage signal, so you own the test suite.
- What are the transitive Symfony constraints in kilix/abac-bundle?
- The bundle pulls symfony/config, symfony/dependency-injection, and related components for its extension and container wiring. These constraints can drift and become fragile over time, even if you only want the underlying library. Check composer why-not output against your PHP runtime before adopting.
- Can I use kilix/abac-bundle with both Symfony and Laravel in the same codebase?
- Not practically. The bundle expects Symfony's kernel and bundle registration lifecycle, which Laravel does not provide. You can share kilix/php-abac policies across both frameworks, but each framework needs its own adapter layer. Keep the Symfony bundle out of the Laravel application.
Weaver
How can I help you explore Laravel packages today?