README

Sylius RBAC Plugin

This plugin adds role-based access control to the Sylius admin: you define your own roles, one permission per operation on one resource, and it enforces them everywhere.

What you get

One permission per operation: sylius.product.update and sylius.product.delete are separate permissions. Wildcards keep it manageable: sylius.product.*, *.*.index, *.*.*.
Every admin route covered: Permissions are discovered from Sylius' own resource metadata, so routes added by Sylius or by other plugins are covered automatically.
Admin API coverage: This plugin covers all the APIs operations.
Deny by default: An unprotected route is denied, not allowed. Exceptions are explicit, in config.
UI filtered, not just routes: Menu entries, grid buttons and dashboard widgets check the same permission, so what a role can't use isn't rendered.
Workflow transitions have their own permission: Cancelling an order asks for sylius.order.cancel, not sylius.order.update.
Multiple roles per administrator: Roles are additive, with a lockout guard on the roles screen.
Console tooling: Grant access from the CLI, list permissions, find orphaned ones, migrate v2 data.
18 locales: Including English, Spanish, French, German, Polish, Portuguese, Simplified Chinese and Arabic.

Screenshots

_{Roles: The ones you define, not a fixed list}	_{Assignment: An administrator may hold several roles}
_{Menu: Trimmed to what the role can reach}	_{Grids: No Create, no Delete, for a role without them}

What a permission looks like

Every permission is {package}.{subject}.{operation}, the same code Sylius' own resource metadata produces:

sylius.product.update                  one operation on one resource
sylius.product.*                       everything on products
sylius.order.ship                      an operation that is not CRUD
*.*.index                              a read-only role, across the whole application
*.*.*                                  a super administrator

A role stores the pattern as written, not the list of operations it matches today, so sylius.product.* keeps working when Sylius adds a new operation to products later. See The permission model.

Documentation


Installation	Three steps with Flex, plus the two the recipe cannot do
The permission model	Identifiers, patterns, wildcards, how the tree is built
What gets enforced	The six surfaces, and what happens to a route nobody covered
Managing roles	Day-to-day use of the admin screens
Configuration reference	Every key under `odiseo_sylius_rbac`
Extending	Declaring permissions for your own routes and plugins
Console commands	`grant`, `debug`, `migrate-permissions`
Troubleshooting	Locked out, unexpected 403, orphaned declarations
Upgrading to 3.0	What breaks, and how stored roles are migrated
Contributing	Running the test application and the suites

Compatibility

Plugin	Sylius	PHP	Symfony	Database
`^3.0`	2.0 · 2.1 · 2.2	8.2 · 8.3 · 8.4	6.4 · 7.x	MySQL · MariaDB · PostgreSQL
`^2.0`	1.12 · 2.0	8.0+	5.4 · 6.x	MySQL · MariaDB

The schema migrations ship for MySQL/MariaDB and PostgreSQL. On any other engine they skip, and Doctrine records them as executed even so, so write your own before upgrading a 2.x database, see Upgrading to 3.0.

Only the latest minor is supported. Security fixes land on master.

Demo

Want a live walkthrough of this plugin? Get in touch, or browse all our Sylius plugins at odiseo.io.

Credits

This plugin is maintained by Odiseo. Want us to help you with this plugin or any Sylius project? Get in touch.

Running a marketplace? Vendor role separation is one of the things a multi-vendor marketplace for Sylius has to get right, and this plugin is how we do it.

License

MIT.

odiseoteam / sylius-rbac-plugin

Package info

Security

Statistics