Weave Code
Permissions Bundle Laravel Package
orbitale/permissions-bundle
Symfony bundle for managing permissions and access control with simple annotations. Define permissions in YAML, attach them to controller actions, and check user rights through a lightweight, cache-friendly API that integrates cleanly into existing Symfony security setups.
Use expression based permissions instead of roles or voters to simplify your security in Symfony. Feel free to contribute ! :+1: Project was initiated after this discussion: https://github.com/symfony/symfony/issues/21029
Frequently asked questions about Permissions Bundle
- Can I use orbitale/permissions-bundle in a Laravel application?
- No. It is a Symfony bundle built around Kernel::registerBundles, a bundle DI extension, and Symfony's config tree, none of which exist in Laravel. Composer installation would also conflict with Laravel's shared Symfony components, so treat the repository as a design reference only.
- How do I install Orbitale PermissionsBundle?
- In Symfony you would require orbitale/permissions-bundle with Composer and register the bundle in AppKernel or bundles.php depending on the Symfony version. There is no equivalent install path for Laravel. The last release was 2017-12-26 and targets the Symfony 2.8/3.x era, so do not add it to a Laravel composer.json.
- Is Orbitale PermissionsBundle still maintained?
- No. The last release was 2017-12-26, roughly eight years stale, with 18 stars, 0 dependents, and no security policy or CVE monitoring. Treat it as part of the unmaintained long tail. There is no upstream maintainer to patch authorization defects.
- What is the Laravel equivalent of Orbitale PermissionsBundle?
- Laravel's native Gate::define, policies, and AuthServiceProvider cover the same ground. The bundle's core idea, one voter driven by declarative permissions, maps to a single Gate::before or a custom ability resolver backed by config/permissions.php. For role-permission tables, use spatie/laravel-permission.
- Does Orbitale PermissionsBundle support Laravel 10 or 11?
- No. The code targets PHP 5.6/7.x and Symfony 2.8/3.x, and VoterInterface::vote() changed in Symfony 4.1+/5.x while PHP 8.x tightens signatures and dynamic-property behavior. Expect hard fatals rather than deprecation warnings. Laravel 10/11 depend on Symfony 6/7 components, so resolution is impossible or forces a framework downgrade.
- Why does Composer fail when I require orbitale/permissions-bundle in Laravel?
- The bundle pulls symfony/framework-bundle, symfony/security-bundle, symfony/dependency-injection, and symfony/config. Laravel already depends on those shared Symfony packages at modern versions. Composer either refuses to resolve or forces a downgrade of shared components, which is a non-starter for a production Laravel app.
- Is it safe to use an abandoned bundle for authorization code?
- High risk. Authorization defects are security incidents, and this package has no maintainer, security policy, or CVE monitoring. You would own any fork and its ongoing patching cost. Prefer maintained, Laravel-native authorization instead.
- How do I migrate Symfony expression-based permissions to Laravel Gates?
- Extract the rule model from the bundle's voter and config tree: how permissions are declared, matched, and short-circuited. Then implement a config-driven ability resolver in AuthServiceProvider using a single Gate::before or a custom Gate subclass that reads config/permissions.php. Cache it with php artisan config:cache. This reproduces the pattern in roughly 100 to 200 lines with full Laravel idiom and testability.
- Should I use spatie/laravel-permission instead of Orbitale PermissionsBundle?
- For Laravel, yes, if you need RBAC or role-permission tables. It is actively maintained, widely installed, and Laravel-native. Orbitale PermissionsBundle is Symfony-only and unmaintained, so it is not a viable dependency for a Laravel codebase.
- How do I test config-driven permissions in Laravel?
- Use Laravel's Gate testing helpers and feature tests against the ability resolver, asserting allows and denies for each config rule. Because rules live in config/permissions.php, you can swap config in tests and cover edge cases such as short-circuiting and missing users. Keep the resolver thin so it is unit-testable without HTTP.
Weaver
How can I help you explore Laravel packages today?