PHPackages casbin/yii-permission - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Database & ORM](/categories/database) 4. / 5. casbin/yii-permission ActiveLibrary[Database & ORM](/categories/database) casbin/yii-permission ===================== Use Casbin in Yii3 PHP Framework, Casbin is a powerful and efficient open-source access control library. v3.0.0(2w ago)458.9k↑95.3%9Apache-2.0PHPPHP >=8.2CI failing Since Jun 2Pushed 7mo ago5 watchersCompare [ Source](https://github.com/php-casbin/yii-permission)[ Packagist](https://packagist.org/packages/casbin/yii-permission)[ RSS](/packages/casbin-yii-permission/feed)WikiDiscussions master Synced 2w ago READMEChangelog (10)Dependencies (20)Versions (14)Used By (0) Yii-Permission ============== [](#yii-permission) [![Build Status](https://github.com/php-casbin/yii-permission/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/php-casbin/yii-permission/actions/workflows/build.yml)[![Coverage Status](https://camo.githubusercontent.com/306af6091304513eb1f06652ceed6283a6718fd49c9dcba8e4ff5209edf6e262/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f7068702d63617362696e2f7969692d7065726d697373696f6e2f62616467652e737667)](https://coveralls.io/github/php-casbin/yii-permission)[![Latest Stable Version](https://camo.githubusercontent.com/48a6f06ab88ad241388c5eb6ed14df8f213fba5051fb24899b3891a348c4d6e9/68747470733a2f2f706f7365722e707567782e6f72672f63617362696e2f7969692d7065726d697373696f6e2f762f737461626c65)](https://packagist.org/packages/casbin/yii-permission)[![Total Downloads](https://camo.githubusercontent.com/1b4f553ca44ee3bcb4c43133bec6c471b665e82d9bd89c1ac6e6d8d905046f35/68747470733a2f2f706f7365722e707567782e6f72672f63617362696e2f7969692d7065726d697373696f6e2f646f776e6c6f616473)](https://packagist.org/packages/casbin/yii-permission)[![License](https://camo.githubusercontent.com/aa8adab5d2ca9a5035a8c6217e2155ddff82bf48aa1ffd18c9185af9d052b13a/68747470733a2f2f706f7365722e707567782e6f72672f63617362696e2f7969692d7065726d697373696f6e2f6c6963656e7365)](https://packagist.org/packages/casbin/yii-permission) An authorization library for the Yii 3.0 PHP Framework, based on [Casbin](https://github.com/php-casbin/php-casbin). - [Installation](#installation) - [Getting Composer package](#getting-composer-package) - [Configuring application](#configuring-application) - [Database Migration](#database-migration) - [Usage](#usage) - [Quick start](#quick-start) - [Using Enforcer Api](#using-enforcer-api) - [Using a middleware](#using-a-middleware) - [Basic Enforcer Middleware](#basic-enforcer-middleware) - [HTTP Request Middleware (RESTful is also supported)](#http-request-middleware--restful-is-also-supported-) - [Using Yii3 AccessChecker ($user->can())](#using-yii3-accesschecker-user-can) - [Define your own model.conf](#define-your-own-modelconf) - [Learning Casbin](#learning-casbin) Installation ------------ [](#installation) ### Getting Composer package [](#getting-composer-package) Require this package in the `composer.json` of your Yii 3.0 project. > **Note**: This package requires a database driver implementation for `yiisoft/db` (such as `yiisoft/db-mysql`, `yiisoft/db-sqlite`, `yiisoft/db-pgsql`, etc.) in your application. Make sure your project has installed a database driver. > > If your project doesn't have a database driver yet, install one first (for example, SQLite or MySQL): > > ``` > composer require yiisoft/db-mysql # or yiisoft/db-sqlite or yiisoft/db-pgsql > ``` ``` composer require casbin/yii-permission ``` ### Configuring application [](#configuring-application) Yii-Permission automatically registers its parameters and DI container definitions via `yiisoft/config`. You can customize parameters in your project's `config/params.php`: ``` return [ 'casbin/yii-permission' => [ 'model' => [ // Available Settings: "file", "text" 'config_type' => 'file', 'config_file_path' => dirname(__DIR__) . '/config/casbin-basic-model.conf', 'config_text' => '', ], 'database' => [ // Connection service ID in DI container, defaults to Yiisoft\Db\Connection\ConnectionInterface::class 'connection' => null, 'casbin_rules_table' => 'casbin_rule', ], 'log' => [ 'enabled' => false, 'logger' => null, ], 'adapter' => \Yii\Permission\Adapter::class, ], ]; ``` ### Database Migration [](#database-migration) `casbin/yii-permission` automatically registers its database migration path (`src/migrations`) via `yiisoft/config` under `"db-migration"`. Run the Yii 3.0 database migration command to create the `casbin_rule` table (requires `yiisoft/db-migration` in your application): ``` composer require yiisoft/db-migration # if not installed yet ./yii migrate:up ``` > **Troubleshooting: ConnectionInterface Not Found** > > If running `./yii migrate:up` throws an exception: `No definition or class found or resolvable for "Yiisoft\Db\Connection\ConnectionInterface"` > > It means your Yii 3 application has not registered a default `ConnectionInterface` in the DI container yet. Ensure your application's DI container (e.g. `config/common/di/db.php`) defines `Yiisoft\Db\Connection\ConnectionInterface::class`. > > Alternatively, if your database connection service has a custom ID in your container, set it in `config/params.php`: > > ``` > 'casbin/yii-permission' => [ > 'database' => [ > 'connection' => 'your_custom_db_service_id', > ], > ], > ``` > > > > For more details, see the [Yii Database Documentation](https://github.com/yiisoft/db). For custom or manual database setups, see the [Migration Class File](src/migrations/M240729000000CreateCasbinRuleTable.php) for the detailed `casbin_rule` table schema. Usage ----- [](#usage) ### Quick start [](#quick-start) In Yii 3.0, you can directly inject native `\Casbin\Enforcer` into your actions, controllers or services to get 100% IDE auto-completion and full type safety: ``` use Casbin\Enforcer; use Psr\Http\Message\ResponseFactoryInterface; use Psr\Http\Message\ResponseInterface; final readonly class Action { public function __construct( private Enforcer $enforcer, private ResponseFactoryInterface $responseFactory ) {} public function __invoke(): ResponseInterface { // adds permissions to a user with full IDE autocomplete $this->enforcer->addPermissionForUser('eve', 'articles', 'read'); // adds a role for a user $this->enforcer->addRoleForUser('eve', 'writer'); // adds permissions to a policy $this->enforcer->addPolicy('writer', 'articles', 'edit'); // checks permission if ($this->enforcer->enforce('eve', 'articles', 'edit')) { // permit eve to edit articles $response = $this->responseFactory->createResponse(); $response->getBody()->write('permit is: true'); return $response; } else { // deny the request $response = $this->responseFactory->createResponse(); $response->getBody()->write('permit is: false'); return $response; } } } ``` ### Using Enforcer Api [](#using-enforcer-api) It provides a very rich API to facilitate various operations on the Policy: Gets all roles: ``` $enforcer->getAllRoles(); // ['writer', 'reader'] ``` Gets all the authorization rules in the policy: ``` $enforcer->getPolicy(); ``` Gets the roles that a user has: ``` $enforcer->getRolesForUser('eve'); // ['writer'] ``` Gets the users that have a role: ``` $enforcer->getUsersForRole('writer'); // ['eve'] ``` Determines whether a user has a role: ``` $enforcer->hasRoleForUser('eve', 'writer'); // true or false ``` Adds a role for a user: ``` $enforcer->addRoleForUser('eve', 'writer'); ``` Adds a permission for a user or role: ``` // to user $enforcer->addPermissionForUser('eve', 'articles', 'read'); // to role $enforcer->addPermissionForUser('writer', 'articles', 'edit'); ``` Deletes a role for a user: ``` $enforcer->deleteRoleForUser('eve', 'writer'); ``` Deletes all roles for a user: ``` $enforcer->deleteRolesForUser('eve'); ``` Deletes a role: ``` $enforcer->deleteRole('writer'); ``` Deletes a permission: ``` $enforcer->deletePermission('articles', 'read'); // returns false if the permission does not exist (aka not affected). ``` Deletes a permission for a user or role: ``` $enforcer->deletePermissionForUser('eve', 'articles', 'read'); ``` Deletes permissions for a user or role: ``` // to user $enforcer->deletePermissionsForUser('eve'); // to role $enforcer->deletePermissionsForUser('writer'); ``` Gets permissions for a user or role: ``` $enforcer->getPermissionsForUser('eve'); // return array ``` Determines whether a user has a permission: ``` $enforcer->hasPermissionForUser('eve', 'articles', 'read'); // true or false ``` See [Casbin API](https://casbin.apache.org/docs/management-api) for more APIs. ### Using a middleware [](#using-a-middleware) `casbin/yii-permission` provides two PSR-15 middlewares for HTTP route access control in Yii 3.0 applications. #### Basic Enforcer Middleware [](#basic-enforcer-middleware) `\Yii\Permission\Middleware\EnforcerMiddleware` is used to check explicit permission parameters (e.g. resource and action). It provides an immutable `withParams(array $params)` method returning a cloned instance for safe route-level parameter binding. ``` use Yii\Permission\Middleware\EnforcerMiddleware; use Yiisoft\Router\Route; // Checks if current user has permission on 'articles' resource with 'read' action Route::get('/articles') ->action([ArticleController::class, 'index']) ->middleware( fn (EnforcerMiddleware $middleware) => $middleware->withParams(['articles', 'read']) ); ``` #### HTTP Request Middleware ( RESTful is also supported ) [](#http-request-middleware--restful-is-also-supported-) `\Yii\Permission\Middleware\RequestMiddleware` automatically extracts the request **Path** as the resource and HTTP **Method** as the action (`$enforcer->enforce($userId, $path, $method)`). ``` use Yii\Permission\Middleware\RequestMiddleware; use Yiisoft\Router\Group; use Yiisoft\Router\Route; // Automatically checks permission based on Request Path & HTTP Method Group::create('/api') ->middleware(RequestMiddleware::class) ->routes( Route::get('/posts')->action([PostController::class, 'index']), Route::post('/posts')->action([PostController::class, 'create']) ); ``` > **Note**: Both middlewares automatically fetch the current logged-in user ID via `Yiisoft\User\CurrentUser::getId()`. If your project needs automatic logged-in user resolution, you can install the `yiisoft/user` package: > > ``` > composer require yiisoft/user > ``` > > > > If `CurrentUser` is not available or the user is a guest, it falls back to the `user_id` request attribute or `'guest'`. ### Using Yii3 AccessChecker ($user->can()) [](#using-yii3-accesschecker-user-can) `casbin/yii-permission` provides `\Yii\Permission\AccessChecker` implementing `Yiisoft\Access\AccessCheckerInterface`. #### 1. Register as `AccessCheckerInterface` in DI Container (`config/common/di/auth.php`) [](#1-register-as-accesscheckerinterface-in-di-container-configcommondiauthphp) Bind `AccessCheckerInterface` to `AccessChecker` so that `Yiisoft\User\CurrentUser` uses Casbin under the hood: ``` use Yiisoft\Access\AccessCheckerInterface; use Yii\Permission\AccessChecker; return [ AccessCheckerInterface::class => AccessChecker::class, ]; ``` #### 2. Check Permission via `$user->can()` in Controllers [](#2-check-permission-via-user-can-in-controllers) Once registered, you can use Yii 3.0's native `$user->can()` method directly: ``` use Yiisoft\User\CurrentUser; final readonly class PostController { public function __construct( private CurrentUser $user ) {} public function update(): ResponseInterface { // 1. Passing resource and action as separate arguments (Recommended for Casbin) if ($this->user->can('articles', ['write'])) { // Permission granted } // 2. Or using comma-separated string format if ($this->user->can('articles,write')) { // Permission granted } // 3. Or checking a single permission string if ($this->user->can('updatePost')) { // Permission granted } } } ``` Define your own model.conf -------------------------- [](#define-your-own-modelconf) You can customize your own model configuration file (e.g. `casbin-basic-model.conf`). For full syntax and pre-defined model examples, see [Casbin Supported Models](https://casbin.apache.org/docs/supported-models) and [PHP-Casbin Models](https://github.com/php-casbin/php-casbin#supported-models). Learning Casbin --------------- [](#learning-casbin) You can find the full documentation of Casbin [on the website](https://casbin.apache.org/). License ------- [](#license) This project is licensed under the [Apache-2.0 License](LICENSE). ### Health Score 56 — FairBetter than 97% of packages Maintenance78 Regular maintenance activity Popularity37 Limited adoption so far Community17 Small or concentrated contributor base Maturity76 Established project with proven stability Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~204 days Recently: every ~198 days Total 12 Last Release 20d ago Major Versions v1.6.0 → 2.x-dev2024-10-28 v2.0.0 → v3.0.02026-07-30 PHP version history (2 changes)2.x-devPHP >=8.0 v3.0.0PHP >=8.2 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/35752209?v=4)[Jon](/maintainers/leeqvip)[@leeqvip](https://github.com/leeqvip) --- Top Contributors [![leeqvip](https://avatars.githubusercontent.com/u/35752209?v=4)](https://github.com/leeqvip "leeqvip (8 commits)")[![basakest](https://avatars.githubusercontent.com/u/47746206?v=4)](https://github.com/basakest "basakest (6 commits)")[![Dobmod](https://avatars.githubusercontent.com/u/33273950?v=4)](https://github.com/Dobmod "Dobmod (4 commits)")[![zolbet](https://avatars.githubusercontent.com/u/11454583?v=4)](https://github.com/zolbet "zolbet (1 commits)") --- Tags abacaccess-controlacladapterauthcasbinpermissionrbacyiidatabaseaclpermissionrbacyiiabaccasbincasbin-adapter ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/casbin-yii-permission/health.svg) ``` [![Health](https://phpackages.com/badges/casbin-yii-permission/health.svg)](https://phpackages.com/packages/casbin-yii-permission) ``` ### Alternatives [getgrav/grav Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS 15.6k88.1k1](/packages/getgrav-grav)[skeeks/cms SkeekS CMS — control panel and tools based on php framework Yii2 13926.0k66](/packages/skeeks-cms)[casbin/laravel-authz An authorization library that supports access control models like ACL, RBAC, ABAC in Laravel. 336375.8k4](/packages/casbin-laravel-authz)[casbin/dbal-adapter Database Abstraction Layer adapter for php-casbin. 15108.8k1](/packages/casbin-dbal-adapter)[casbin/think-authz An authorization library that supports access control models like ACL, RBAC, ABAC for ThinkPHP. 27522.0k7](/packages/casbin-think-authz)[casbin/webman-permission webman casbin permission plugin 543.6k2](/packages/casbin-webman-permission) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)