Installation¶

In a Symfony application¶

composer require spomky-labs/access-control-bundle

Register the bundle. There is no enabled flag: registering it is the opt-in.

// config/bundles.php
return [
    // ...
    AccessControl\Bundle\AccessControlBundle::class => ['all' => true],
];

That is the whole of day one. If your application has SecurityBundle, nothing you can see changes: your voters keep being consulted, #[IsGranted] is read, is_granted() answers in your templates, and the rules of your security.yaml are enforced. What changed is who decides. See The Two Migrations.

In any PHP application¶

composer require spomky-labs/access-control-lib

No container and no framework are needed:

use AccessControl\AccessControlManager;
use AccessControl\AccessRequest;
use AccessControl\Strategy\PermitOverridesStrategy;

$accessControlManager = new AccessControlManager(
    strategies: [new PermitOverridesStrategy()],
    voters: [new PostVoter()],
);

$decision = $accessControlManager->decide(new AccessRequest($requester, 'EDIT', $post));

See The Manager.

Requirements¶

PHP 8.4 or later.
Symfony 8.1 or later, for the bundle.

Optional packages¶

The library requires almost nothing. These unlock features, and their absence is never an error:

Package	What it unlocks
`symfony/security-core`	Reusing voters, tokens and the role hierarchy of Symfony Security
`symfony/expression-language`	Attributes and conditions given as an `Expression`, and the `allow_if` option of a URL rule
`twig/twig`	The template functions
`symfony/workflow`	Guarding workflow transitions
`symfony/console`	Guarding console commands
`symfony/web-profiler-bundle`	The profiler panel

One exception worth knowing about. Guarding a workflow transition requires symfony/security-core to be installed, even though this component never uses it there: Symfony's FrameworkExtension refuses a guard expression at compile time without it, before this bundle gets a chance to replace the listener. Install it and nothing more. See Workflow Guards.

Checking it is on¶

bin/console debug:container --tag=access_control.voter

Or open a page with the profiler enabled: the panel says which stack answered, and lists every question the request asked. See The Profiler Panel.