drago-ex/permission

Lightweight ACL and role management.

dev-main 2026-01-11 18:21 UTC

Requires

• php: >=8.3 <9
• drago-ex/application: ^1.0
• drago-ex/database: ^2.0
• drago-ex/form: ^1.0
• latte/latte: ^3.0
• nette/application: ^3.1
• nette/di: ^3.1
• nette/robot-loader: ^4.1
• nette/security: ^3.1

Requires (Dev)

• nette/bootstrap: ^3.1
• nette/tester: ^2.5
• phpstan/phpstan-nette: ^1.2.9

MIT

• Zdeněk Papučík

README

Lightweight ACL and role management.

The package provides a central ACL factory, modular permission registration per module, and automatic authorization checks in presenters.

Requirements

• PHP >= 8.3
• Nette Framework
• Composer

Installation

composer require drago-ex/permission

Features

• Central ACL creation
• Modular permission providers per module
• Default roles: guest, member, admin
• Automatic presenter authorization
• Action and signal based privileges

Roles

Default roles:

• guest
• member (inherits from guest)
• admin (inherits from member)

Roles are registered automatically.

Permission Factory

PermissionFactory creates a Nette\Security\Permission instance, registers default roles, and runs all registered permission providers.

Providers are collected via DI tags.

Permission Providers

Each module registers its own permissions using a Provider implementation.

Providers:

• register ACL resources
• define allow / deny rules
• live inside the module they belong to

Typical resource naming:

• Backend:Sign
• Frontend:Article

DI Configuration

Permission factory:

services:
	permissionFactory:
		class: App\UI\PermissionFactory
		arguments: [tagged(PermisionTag)]

	- @permissionFactory::create

Module provider:

services:
	signPermission:
		class: Drago\Permission\PermissionFactory
		tags: [PermisionTag]

Presenter Authorization

Authorization is handled by the Authorization trait.

• runs automatically on presenter startup
• checks ACL using presenter name and action or signal

Unauthorized access:

• not logged in → redirect to Sign:in
• logged in but forbidden → HTTP 403