blackcube/dboard

CMS Administration Panel

1.0.0 2026-03-03 18:18 UTC

Requires

• php: >=8.3
• blackcube/dcore: ^1.0
• blackcube/oauth2: ^1.0
• blackcube/yii-assets: ^1.0
• blackcube/yii-bleet: ^1.0
• blackcube/yii-bridge-model: ^1.0
• vlucas/phpdotenv: ^5.6
• web-auth/webauthn-lib: ^5.2
• yiisoft/active-record: ^1.0
• yiisoft/aliases: ^3.1
• yiisoft/db: ^2.0
• yiisoft/db-migration: ^2.0
• yiisoft/db-mysql: ^2.0
• yiisoft/rbac: ^2.1
• yiisoft/router: ^4.0
• yiisoft/router-fastroute: ^4.0
• yiisoft/strings: ^2.7

Requires (Dev)

• codeception/codeception: ^5.3
• codeception/module-asserts: ^3.3
• yiisoft/di: ^1.4
• yiisoft/event-dispatcher: ^1.1
• yiisoft/injector: ^1.2
• yiisoft/test-support: ^3.2

Suggests

• blackcube/ssr: Required for SSR route options in Type admin forms

BSD-3-Clause

• Philippe Gaultier

• admin
• oauth2
• cms
• rbac
• back-office
• yii3
• webauthn

README

Administration panel for Blackcube CMS.

Installation

composer require blackcube/dboard

Requirements

• Yii3 (active-record, router, rbac, view)
• blackcube/dcore — data layer
• blackcube/yii-bleet — UIKit
• blackcube/oauth2 — JWT authentication
• blackcube/yii-assets — Vite/Webpack asset bundles

What it is

Full back-office for dcore. CRUD for every entity, tree management, RBAC, JWT authentication with passkey support.

Managed entities

Module	Capabilities
Contents	CRUD, tree (move, reorder), blocs, tags, translations, slugs, SEO (xeo), authors, export/import Markdown
Tags	CRUD, tree, blocs, slugs, SEO
Menus	CRUD, tree
Types	CRUD, associate elastic schemas and content/tag types
Elastic Schemas	CRUD, JSON Schema editor, schema-to-type mapping
Languages	CRUD
Hosts	CRUD
Slugs	Management, sitemap configuration
SEO (Xeo)	Per-slug SEO metadata, authors, blocs
Authors	CRUD
Parameters	CRUD
Administrators	CRUD, activation, role/permission assignment
Passkeys	WebAuthn registration and management
RBAC	Roles and permissions management
Dashboard	Overview
Search	Global search across entities
Preview	Content preview with simulated dates

Authentication

Two authentication methods:

• JWT (OAuth2) — password grant via blackcube/oauth2, access token in cookie, automatic refresh
• Passkeys (WebAuthn) — FIDO2 passwordless authentication via web-auth/webauthn-lib

RBAC

Granular permissions per entity. Each entity has VIEW, CREATE, UPDATE, DELETE permissions, some add IMPORT/EXPORT. Aggregated into MANAGER roles per entity.

Role	Covers
CONTENT:MANAGER	view, create, update, delete, import, export
TAG:MANAGER	view, create, update, delete, import, export
MENU:MANAGER	view, create, update, delete
TYPE:MANAGER	view, create, update, delete
ELASTICSCHEMA:MANAGER	view, create, update, delete
LANGUAGE:MANAGER	view, create, update, delete
HOST:MANAGER	view, create, update, delete
XEO:MANAGER	view, create, update, delete
AUTHOR:MANAGER	view, create, update, delete
PARAMETER:MANAGER	view, create, update, delete
ADMINISTRATOR:MANAGER	view, create, update, delete
SITE:MANAGER	dashboard, search, preview

To enable direct permission assignment (not just roles), configure RBAC with enableDirectPermissions:

// config/common/di/rbac.php
use Yiisoft\Rbac\Manager;

return [
    ManagerInterface::class => static fn (
        ItemsStorageInterface $itemsStorage,
        AssignmentsStorageInterface $assignmentsStorage
    ) => new Manager(
        itemsStorage: $itemsStorage,
        assignmentsStorage: $assignmentsStorage,
        enableDirectPermissions: true,
    ),
];

Configuration

// config/params.php
return [
    'blackcube/dboard' => [
        'routePrefix' => '/admin',
        'rbacClasses' => [
            // Your RBAC permission classes
        ],
        'oauth2' => [
            'issuer' => 'https://your-domain.com',
            'publicKey' => '/path/to/public.key',
            'privateKey' => '/path/to/private.key',
            'algorithm' => 'RS256',
        ],
    ],
];

Migrations

DBoard ships its own migrations (administrators, passkeys, RBAC tables, refresh tokens):

php yii.php migrate:up

Let's be honest

This is Blackcube's admin, not a generic admin generator.

DBoard is purpose-built for dcore entities. It is not a scaffolding tool and does not generate CRUD from arbitrary models.

Tight coupling.

DBoard depends on dcore, Bleet, oauth2, yii-assets. It is not a standalone package — it is the admin layer of the Blackcube stack.

License

BSD-3-Clause. See LICENSE.md.

Author

Philippe Gaultier [e-mail]