- Can I use pwalkow/mongodb-acl-bundle in a Laravel application?
- No, not directly. It is a Symfony bundle that integrates Symfony Security ACL with Doctrine MongoDB ODM, while Laravel uses Gates and Policies with no native bundle or service-provider support. You would need to port the ACL logic or wrap it behind Laravel-native authorization services, and the package should be treated as a reference implementation rather than a dependency.
- What does pwalkow/mongodb-acl-bundle actually do?
- It provides a MongoDB storage layer for the Symfony ACL component so permission entries are persisted in MongoDB instead of a relational database. It is intended for Symfony applications using Doctrine MongoDB ODM and per-document access checks. The bundle wires Symfony ACL concepts such as object identities and security identities to MongoDB collections.
- Does this package work with Laravel Gates and Policies?
- There is no native integration with Laravel Gates or Policies. Laravel's authorization model is different from Symfony Security ACL, so you would need an adapter or a reimplementation of the permission checks. Bundle APIs should not leak into domain code if you attempt an integration.
- How do I install and configure it for a Symfony project?
- Install it with Composer, enable the bundle in your Symfony kernel or bundles configuration, and configure the MongoDB connection plus Doctrine MongoDB ODM and ACL services. The provided README excerpt does not include exact configuration details, so check the repository files and composer.json constraints. For Laravel there is no service provider, config publishing, or facade integration.
- Which Symfony, PHP, Doctrine MongoDB ODM, and MongoDB driver versions are supported?
- The provided evaluation does not specify exact supported version ranges, so you must inspect composer.json for Symfony, PHP, Doctrine MongoDB ODM, ext-mongodb, and MongoDB server constraints. Validate the bundle's service definitions and configuration load without deprecated Symfony APIs. This is especially important because the package appears niche and may have stale dependency constraints.
- Is pwalkow/mongodb-acl-bundle maintained and safe for production use?
- The available signals are weak: only 3 stars, 0 dependents, limited documentation, and unclear test coverage. Authorization code is security-sensitive, so assume vendor-style maintenance for dependency upgrades and security patches. Audit the source, tests, license, and dependency freshness before considering any production pilot.
- What is the ACL data model and how should MongoDB indexes be designed?
- The bundle persists Symfony ACL entries such as object identity, security identity, and permission masks in MongoDB collections. Review the source to confirm the exact schema, then ensure compound indexes support your common queries by resource, tenant, user, and permission fields. Load-test authorization checks against realistic role and resource cardinality because inheritance resolution can affect query shape.
- Are there tests, and how should I test authorization decisions with this bundle?
- The provided assessment notes that test coverage is unclear, so do not assume production-grade test coverage. Add integration tests for allow and deny cases, inheritance, tenancy boundaries, and cache invalidation after permission changes. A shadow-mode comparison against your existing authorization system is a sensible way to validate decisions before cutover.
- How hard is it to migrate from this bundle to Laravel authorization?
- For a Laravel-first application, the ramp-up is high because the package relies on Symfony bundle internals and Doctrine MongoDB ODM. Inventory roles, permissions, resources, inheritance, and tenant boundaries, then map them to Laravel Gates and Policies or a custom ACL service. Pilot in shadow mode, compare decisions, and cut over behind a feature flag with rollback.
- What are the alternatives if I need MongoDB-backed ACLs in Laravel?
- Use Laravel's native Gate and Policy system with a MongoDB-backed user, role, or permission provider, or adapt a package such as spatie/laravel-permission to MongoDB. This bundle is reasonable only for a legacy Symfony application already using MongoDB, Doctrine ODM, and Symfony Security ACL. Validate licensing and forkability if you intend to reuse its data model.