PHPackages                             ksfraser/ksf-fa-rbac - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. ksfraser/ksf-fa-rbac

ActiveFa-module[Authentication & Authorization](/categories/authentication)

ksfraser/ksf-fa-rbac
====================

FrontAccounting adapter for ksfraser/rbac — DB repositories, user provisioning, and FA hook integration.

v8.x-dev(2mo ago)00GPL-3.0PHPPHP >=7.4

Since May 25Pushed 1mo agoCompare

[ Source](https://github.com/ksfraser/ksf_FA_RBAC)[ Packagist](https://packagist.org/packages/ksfraser/ksf-fa-rbac)[ RSS](/packages/ksfraser-ksf-fa-rbac/feed)WikiDiscussions master Synced 1w ago

READMEChangelogDependencies (5)Versions (5)Used By (0)

ksf\_FA\_RBAC
=============

[](#ksf_fa_rbac)

FrontAccounting adapter for the **ksfraser/rbac** framework-agnostic RBAC library.

Provides:

- **User provisioning** — lazy creation of FA users in the CRM person registry on authenticate hook
- **Database repositories** — concrete implementations of RBAC interfaces against FA tables
- **SQL JOIN fragments** — enforces default-deny visibility at the query layer
- **Soft-delete + audit logging** — all record mutations are logged immutably

Installation
------------

[](#installation)

1. Copy this directory to `/path/to/fa/modules/ksf_FA_RBAC`
2. In FA Setup → Extensions, activate **KSF RBAC**
3. Composer dependencies are installed on first activation

Quick Start
-----------

[](#quick-start)

### Provisioning a User

[](#provisioning-a-user)

When a user authenticates, the `authenticate` hook automatically:

1. Creates a `crm_persons` row (if needed)
2. Creates a `crm_contacts` row linking the person to their FA user account (`type='user'`, `entity_id=user_id`)
3. Creates a `{userId}_individual` team
4. Adds the user as a member of their individual team

No manual action required.

### Enforcing Visibility

[](#enforcing-visibility)

Use `buildAccessJoinSql()` in any record-fetching query to enforce RBAC:

```
$db = new FaDbAdapter(TB_PREF);
$repo = new FaRecordAccessRepository($db);

$joinFragment = $repo->buildAccessJoinSql('calendar', 'entry', 'e');

$sql = "SELECT e.* FROM fa_cal_entries e"
     . " $joinFragment"
     . " WHERE e.start_date BETWEEN ? AND ?"
     . " ORDER BY e.start_date ASC";

$entries = $db->fetchAll($sql, [$userId, $start, $end]);
```

The JOIN fragment:

- Restricts to teams the user is a member of
- Enforces `inactive=0` and expiry checks
- Returns empty result set if user has no access (default deny)

Architecture
------------

[](#architecture)

```
ksfraser/rbac (library)
    ↓
ksf_FA_RBAC (FA adapter) ← you are here
    ├─ FaDbAdapter
    ├─ FaTeamRepository
    ├─ FaRecordAccessRepository
    └─ UserProvisioner

```

All repositories implement interfaces from `ksfraser/rbac`, ensuring zero coupling to FA in the library.

Testing
-------

[](#testing)

```
cd /path/to/ksf_FA_RBAC
composer install --dev
vendor/bin/phpunit
```

Documentation
-------------

[](#documentation)

See `AGENTS.md` for detailed architecture, database schema, and implementation notes.

###  Health Score

31

—

LowBetter than 65% of packages

Maintenance91

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity23

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~3 days

Total

2

Last Release

57d ago

PHP version history (2 changes)v8.x-devPHP >=7.4

v7.3.x-devPHP >=7.3

### Community

Maintainers

![](https://www.gravatar.com/avatar/c8870cc04b29a973eed9ad367a936ab274d744de37ff0c35fa0540a932905271?d=identicon)[ksfraser](/maintainers/ksfraser)

---

Top Contributors

[![ksfraser](https://avatars.githubusercontent.com/u/54461925?v=4)](https://github.com/ksfraser "ksfraser (13 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/ksfraser-ksf-fa-rbac/health.svg)

```
[![Health](https://phpackages.com/badges/ksfraser-ksf-fa-rbac/health.svg)](https://phpackages.com/packages/ksfraser-ksf-fa-rbac)
```

###  Alternatives

[matomo/matomo

Matomo is the leading Free/Libre open analytics platform

21.7k38.9k](/packages/matomo-matomo)[simplesamlphp/simplesamlphp

A PHP implementation of a SAML 2.0 service provider and identity provider.

1.1k13.0M221](/packages/simplesamlphp-simplesamlphp)[simplesamlphp/saml2

SAML2 PHP library from SimpleSAMLphp

30418.0M43](/packages/simplesamlphp-saml2)[web-auth/webauthn-lib

FIDO2/Webauthn Support For PHP

12510.5M141](/packages/web-auth-webauthn-lib)[web-auth/webauthn-framework

FIDO2/Webauthn library for PHP and Symfony Bundle.

515100.5k3](/packages/web-auth-webauthn-framework)[tempest/framework

The PHP framework that gets out of your way.

2.2k34.4k16](/packages/tempest-framework)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)