switon/authz

Permission-based authorization with attributes, voters, and role-to-permission lookup for Switon Framework

v1.0.0 2026-06-06 13:43 UTC

Requires

• php: >=8.3
• switon/core: ^1.0
• switon/event: ^1.0
• switon/http: ^1.0
• switon/principal: ^1.0
• switon/router: ^1.0

Requires (Dev)

• phpstan/extension-installer: ^1.4
• phpstan/phpstan: ^2.0
• switon/testing: ^1.0

MIT

• switon

• authorization
• rbac
• policies
• switon

README

Switon's HTTP authorization layer for controller and action policies, identity states, and voter-based access control.

Highlights

• Attribute-based access rules: #[Authorize] lets controllers and actions declare policy in place.
• Layered defaults: class-level rules set the baseline, and method rules can override them.
• Policy aliases: @edit-style references stay tied to their targets.
• Decision hooks: VoterInterface can grant, deny, or abstain before the default check runs.
• Identity states: authenticated, anonymous, and superuser access are handled explicitly.

Installation

composer require switon/authz

Quick Start

use Switon\Authorizing\Attribute\Authorize;

#[Authorize(Authorize::AUTHENTICATED)]
class UserController
{
    public function indexAction(): void
    {
    }

    public function profileAction(): void
    {
    }

    #[Authorize(Authorize::ANONYMOUS)]
    public function publicAction(): void
    {
    }

    #[Authorize('@index')]
    public function deleteAction(): void
    {
    }
}

Docs: https://docs.switon.dev/latest/authz

License

MIT.