- Is olivier127/rbac-bundle compatible with Laravel?
- It is a Symfony 7 bundle, not a Laravel package, and it depends on compiler passes and bundle conventions that Laravel does not provide. There is no Laravel service provider, Gate binding, or middleware wired up, so installing it in a Laravel app will not yield working authorization out of the box. Unless you deliberately vendor Symfony security components, evaluate a Laravel-native option first.
- How do I install olivier127/rbac-bundle?
- Install it with Composer and register the bundle class in your Symfony kernel's bundle configuration. The reviewed material shows no Laravel-facing service provider or publishable config, so there is nothing for Laravel package discovery to hook into. Confirm the exact bundle registration class and required configuration in the repository before adopting it.
- Does it support Laravel 10, 11 or 12?
- No Laravel version constraints appear in the material reviewed, and the package describes itself as a Symfony 7 bundle. Laravel has no bundle or compiler-pass layer, so Laravel support is unproven rather than merely untested. Treat compatibility as an open question until the maintainer publishes framework constraints and a CI matrix.
- What does NIST Level 2 hierarchical RBAC mean?
- It is the NIST standard model in which roles inherit permissions from parent roles, so permissions assigned high in the tree flow down to children. That hierarchy removes most duplicated role-permission rows you would otherwise maintain in a flat table. The library is a rework of the OWASP phprbac.net implementation.
- How do I define roles and permissions with this library?
- The package provides a full access control library for creating roles, permissions, and their inheritance relationships in PHP. The reviewed material does not enumerate the concrete service classes or method signatures you call. Read the repository source and any tests before designing your permission schema around it.
- Can I enforce authorization in Laravel middleware, gates, and Blade directives?
- The package blurb advertises middleware, gates, and Blade directives, but the underlying artifact is a Symfony bundle and none of that Laravel wiring is evidenced in the source material. Do not plan an enforcement layer on that claim alone. Verify against the actual code, or use Gates, Policies, and middleware you control.
- Does the package work on PHP 8.5?
- Version 1.1.3 removes an invalid Attribute declaration from RBACAttributeInterface, because PHP attributes cannot legally target interfaces; that construct was fatal on PHP 8.5. Upgrading from 1.1.2 to 1.1.3 therefore fixes a hard failure, not a cosmetic one. It also suggests the project may not run a PHP version matrix in CI.
- What are the best Laravel alternatives for role-based access control?
- For most Laravel apps, native Gates and Policies combined with spatie/laravel-permission cover roles, permissions, and enforcement with first-class framework support. silber/bouncer is another solid choice when abilities need to attach to models. These avoid bridging Symfony security voters into Laravel's Gate contract and duplicating authorization logic.
- Is olivier127/rbac-bundle production ready and actively maintained?
- The project has roughly 27 lifetime pull requests and a single maintainer, which raises bus-factor, security-response, and backport questions. No composer.json constraints, CI matrix, or coverage data were available in the reviewed material. Confidence in long-term support is low, so weigh that against the cost of migrating later.
- Will upgrading from 1.1.2 to 1.1.3 break anything?
- No application code changes are required, and the release removes a PHP 8.5 fatal error plus a compiler-pass deprecation message. Deleting an attribute from a public interface is technically observable through reflection, but realistic exposure is near zero. If your fleet runs PHP 8.2 to 8.4, absorb the update at your next natural upgrade rather than scheduling a change.