PHPackages                             kinetis/authorization - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. kinetis/authorization

ActiveLibrary

kinetis/authorization
=====================

Ability-based authorization for Kinetis — Gate wraps a callable Policy check, normalizing a bool/AuthorizationResponse result and turning a denial into a 403 through one registered middleware.

v1.0.0(today)00MITPHPPHP ^8.4

Since Aug 24Pushed todayCompare

[ Source](https://github.com/kinetis-dev/authorization)[ Packagist](https://packagist.org/packages/kinetis/authorization)[ RSS](/packages/kinetis-authorization/feed)WikiDiscussions main Synced today

READMEChangelogDependencies (5)Versions (2)Used By (0)

 [![Kinetis](logo.svg)](logo.svg)

 **kinetis/authorization**
 **Ability-based authorization for Kinetis**

 [![Packagist Version](https://camo.githubusercontent.com/64bc5313899d82ec22d408c1aa8dd5791b566fe561d354bd6ce82cb622713863/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b696e657469732f617574686f72697a6174696f6e3f6c6162656c3d76657273696f6e)](https://packagist.org/packages/kinetis/authorization) [![Packagist Downloads](https://camo.githubusercontent.com/4122cf8a95910aca510e9f89ee13bb7c81226c7fb51682383c00c8d68ccb3b77/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6b696e657469732f617574686f72697a6174696f6e)](https://packagist.org/packages/kinetis/authorization) [![PHP Version](https://camo.githubusercontent.com/94dc900b7ab3b8d54f9f8aaacddebe05f604e386eeb71dccedd58d6a13c2022a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f6b696e657469732f617574686f72697a6174696f6e)](https://packagist.org/packages/kinetis/authorization) [![License](https://camo.githubusercontent.com/00f73fe37822c7bbd26a14bd13e56bd1b120ce5e820b4085ab4424022304c17d/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6b696e657469732f617574686f72697a6174696f6e)](https://packagist.org/packages/kinetis/authorization) [![CI](https://github.com/kinetis-dev/kinetis/actions/workflows/ci.yml/badge.svg)](https://github.com/kinetis-dev/kinetis/actions/workflows/ci.yml)

---

Kinetis is deliberately unopinionated about how your application organizes authorization checks — there's no required Policy convention, no ability-name registry, and nothing here inspects an object's class to decide which code answers a check. `Gate` is a small, generic wrapper: hand it any callable and it normalizes the result into an allow/deny decision.

```
use Kinetis\Authorization\Gate;

final readonly class PostController
{
    public function __construct(
        private Gate $gate,
        private PostPolicy $postPolicy,
    ) {}

    public function update(int $id, CurrentUserInterface $user): array
    {
        $post = $this->posts->find($id);

        $this->gate->authorize($user, $this->postPolicy->update(...), $post);

        // ...
    }
}
```

`$this->postPolicy->update(...)` is PHP's own first-class callable syntax — `PostPolicy` is a plain, constructor-injected class with plain methods, resolved and called exactly like any other service. `Gate` never sees `PostPolicy` exist as a concept.

Provides
--------

[](#provides)

Installing this package auto-registers, via `extra.kinetis`:

- **A global middleware** translating a thrown `AuthorizationException`into a `403` response, so a denied `Gate::authorize()` call works from any route with nothing else to wire.

`Gate` itself needs no explicit binding — it has no constructor dependencies, so plain autowiring resolves it wherever a controller constructor-injects it.

Nothing else. There's no attribute to discover, no registry, and no "Policy" concept this package enforces — `PostPolicy` above is only a name a developer chose.

The three methods
-----------------

[](#the-three-methods)

- `authorize($user, $check, ...$arguments): void` — throws `AuthorizationException` on denial, letting the registered middleware turn it into a `403`. Use it when a denial should hard-stop the request.
- `allows($user, $check, ...$arguments): bool` — never throws. Use it to branch, or to shape a response value (`'canEdit' => $gate->allows(...)`).
- `denies($user, $check, ...$arguments): bool` — the exact inverse of `allows()`, for guard-clause style (`if ($gate->denies(...)) { ... }`).

`$check` is any `callable(CurrentUserInterface, mixed...): bool|AuthorizationResponse`— a first-class callable reference to a method, a plain closure, or a `Gate::allows()`-independent function. Returning a plain `bool` covers the ordinary case; returning `AuthorizationResponse::deny('a specific reason')`lets a denial carry a message more useful than the generic default.

`$check` may also be typed against a concrete `CurrentUserInterface`implementation richer than the interface itself — `kinetis/auth-jwt`'s `JwtUser`, say, whose `claim()`/`claims()` already carry everything the token decoded, with no query needed. `Gate`'s methods are generic over the user type (`@template TUser of CurrentUserInterface`) precisely so this type-checks correctly. See [kinetis.dev/docs/authorization.html](https://kinetis.dev/docs/authorization.html#reading-claims-or-roles-without-a-query).

Installation
------------

[](#installation)

```
composer require kinetis/authorization
```

Requires PHP 8.4 or later. Documentation: [kinetis.dev/docs/authorization.html](https://kinetis.dev/docs/authorization.html)

License
-------

[](#license)

MIT — see [LICENSE](LICENSE).

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance100

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity50

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

0d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/17613001?v=4)[aln-1](/maintainers/aln-1)[@aln-1](https://github.com/aln-1)

---

Top Contributors

[![aln-1](https://avatars.githubusercontent.com/u/17613001?v=4)](https://github.com/aln-1 "aln-1 (1 commits)")

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan, Psalm

Type Coverage Yes

### Embed Badge

![Health badge](/badges/kinetis-authorization/health.svg)

```
[![Health](https://phpackages.com/badges/kinetis-authorization/health.svg)](https://phpackages.com/packages/kinetis-authorization)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)