PHPackages mvonline/openfga-laravel-rbac - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. mvonline/openfga-laravel-rbac ActiveLibrary[Authentication & Authorization](/categories/authentication) mvonline/openfga-laravel-rbac ============================= PHP and Laravel SDK for using OpenFGA as an RBAC authorization operator. v0.1.1(1mo ago)01MITPHPPHP ^8.1 Since Jul 14Pushed 1mo agoCompare [ Source](https://github.com/mvonline/openfga-laravel-rbac)[ Packagist](https://packagist.org/packages/mvonline/openfga-laravel-rbac)[ Docs](https://github.com/mvonline/openfga-laravel-rbac)[ RSS](/packages/mvonline-openfga-laravel-rbac/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (8)Versions (3)Used By (0) OpenFGA Laravel RBAC ==================== [](#openfga-laravel-rbac) [![PHP](https://camo.githubusercontent.com/cfe7d269be25fc7f4bb5ad7d9dcc0d09cc9273b4fbaff1a2076c4ec5dbd40d07/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f7068702d253545382e312d3737376262342e737667)](https://www.php.net/)[![Laravel](https://camo.githubusercontent.com/2b4bdae4302d2c6ac4a07105753a0415e568c8afcaf7392c96434e89797d2ad2/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c61726176656c2d3130253230253743253230313125323025374325323031322d6666326432302e737667)](https://laravel.com/)[![License](https://camo.githubusercontent.com/8bb50fd2278f18fc326bf71f6e88ca8f884f72f179d3e555e20ed30157190d0d/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d677265656e2e737667)](LICENSE) PHP and Laravel SDK for using [OpenFGA](https://openfga.dev/) as an RBAC and authorization service. This package provides: - A framework-agnostic PHP OpenFGA HTTP client - Laravel auto-discovery, facades, config publishing, Gate integration, and middleware - RBAC helper methods for roles, permissions, assignments, and common checks - Advanced OpenFGA API support for contextual tuples, batch checks, list users, changes, assertions, stores, and authorization models - Docker-friendly test workflow, so PHP does not need to be installed on the host machine Requirements ------------ [](#requirements) - PHP `^8.1` - Composer - OpenFGA server or OpenFGA-compatible endpoint - Laravel `10`, `11`, or `12` for Laravel-specific features Installation ------------ [](#installation) ``` composer require mvonline/openfga-laravel-rbac ``` Laravel Setup ------------- [](#laravel-setup) Publish the configuration file: ``` php artisan vendor:publish --tag=openfga-rbac-config ``` Configure your OpenFGA connection: ``` OPENFGA_API_URL=http://localhost:8080 OPENFGA_STORE_ID=01H... OPENFGA_AUTHORIZATION_MODEL_ID=01H... OPENFGA_TOKEN= ``` The package auto-registers these aliases in Laravel: - `OpenFga` for the low-level OpenFGA client - `OpenFgaRbac` for RBAC helper methods OpenFGA Model Example --------------------- [](#openfga-model-example) This model supports users, roles, a registry for listing roles and permissions, and a tenant resource. ``` model schema 1.1 type user type permission type rbac relations define role: [role] define permission: [permission] type role relations define assignee: [user] type tenant relations define admin: [user, role#assignee] define member: [user, role#assignee] or admin ``` For resource-specific permissions, add relations to your resource types. Example: ``` type invoice relations define viewer: [user, role#assignee] define editor: [user, role#assignee] define owner: [user] ``` Laravel Usage ------------- [](#laravel-usage) ### Low-Level Checks [](#low-level-checks) ``` use OpenFga; $allowed = OpenFga::check( 'user:' . $user->id, 'viewer', 'invoice:' . $invoice->id, ); ``` ### RBAC Helpers [](#rbac-helpers) ``` use OpenFgaRbac; OpenFgaRbac::createRole('billing-admin'); OpenFgaRbac::createPermission('invoice.view'); OpenFgaRbac::assignRole($user->id, 'billing-admin'); OpenFgaRbac::grantRolePermission('billing-admin', 'viewer', 'invoice', $invoice->id); if (OpenFgaRbac::can($user->id, 'viewer', 'invoice', $invoice->id)) { // authorized } ``` ### Role And Permission Queries [](#role-and-permission-queries) ``` $roles = OpenFgaRbac::listRoles(); $permissions = OpenFgaRbac::listPermissions(); $userRoles = OpenFgaRbac::userRoles($user->id); $roleUsers = OpenFgaRbac::usersAssignedToRole('billing-admin'); $rolePermissions = OpenFgaRbac::rolePermissions('billing-admin'); ``` ### Any Or All Permission Checks [](#any-or-all-permission-checks) ``` $canReadOrEdit = OpenFgaRbac::canAny($user->id, ['viewer', 'editor'], 'invoice', $invoice->id); $canReadAndEdit = OpenFgaRbac::canAll($user->id, ['viewer', 'editor'], 'invoice', $invoice->id); ``` Laravel Middleware ------------------ [](#laravel-middleware) Single check: ``` Route::get('/invoices/{invoice}', InvoiceController::class) ->middleware('openfga:viewer,invoice:{invoice}'); ``` Any check can pass: ``` Route::get('/invoices/{invoice}', InvoiceController::class) ->middleware('openfga.any:owner:invoice:{invoice},admin:tenant:acme'); ``` Every check must pass: ``` Route::patch('/invoices/{invoice}', InvoiceController::class) ->middleware('openfga.all:viewer:invoice:{invoice},member:tenant:acme'); ``` Route placeholders such as `{invoice}` are resolved from Laravel route parameters. If the parameter is an Eloquent model, the middleware uses `getKey()`. Plain PHP Usage --------------- [](#plain-php-usage) ``` use GuzzleHttp\Client as GuzzleClient; use GuzzleHttp\Psr7\HttpFactory; use OpenFgaRbac\Client; use OpenFgaRbac\Config; $http = new GuzzleClient(); $factory = new HttpFactory(); $openfga = new Client( new Config( apiUrl: 'http://localhost:8080', storeId: '01H...', authorizationModelId: '01H...', token: null, ), $http, $factory, $factory, ); $allowed = $openfga->check('user:123', 'viewer', 'invoice:2026-001'); ``` Advanced OpenFGA Client ----------------------- [](#advanced-openfga-client) ### Contextual Tuples And Conditions [](#contextual-tuples-and-conditions) ``` use OpenFgaRbac\TupleKey; $result = $openfga->checkRaw( user: 'user:123', relation: 'viewer', object: 'document:roadmap', contextualTuples: [ TupleKey::make('user:123', 'member', 'team:finance'), ], context: [ 'ip' => '127.0.0.1', ], consistency: 'HIGHER_CONSISTENCY', ); ``` ### Batch Checks [](#batch-checks) ``` $batch = $openfga->batchCheck([ [ 'correlation_id' => 'invoice-view', 'tuple_key' => [ 'user' => 'user:123', 'relation' => 'viewer', 'object' => 'invoice:2026-001', ], ], ]); ``` ### List Objects And Users [](#list-objects-and-users) ``` $objects = $openfga->listObjects('user:123', 'viewer', 'invoice'); $users = $openfga->listUsers( object: 'invoice:2026-001', relation: 'viewer', userFilters: [ ['type' => 'user'], ], ); ``` ### Tuple Writes [](#tuple-writes) ``` use OpenFgaRbac\TupleKey; $openfga->writeTuple('user:123', 'viewer', 'invoice:2026-001'); $openfga->deleteTuple('user:123', 'viewer', 'invoice:2026-001'); $openfga->writeAdvanced( writes: [ TupleKey::make('user:123', 'viewer', 'invoice:2026-001'), ], deletes: [ TupleKey::make('user:456', 'viewer', 'invoice:2026-001'), ], onDuplicate: 'ignore', onMissing: 'ignore', ); ``` ### Models, Assertions, Changes, And Stores [](#models-assertions-changes-and-stores) ``` $models = $openfga->readAuthorizationModels(); $model = $openfga->readAuthorizationModel('01H...'); $authorizationModelId = $openfga->writeAuthorizationModel([ 'schema_version' => '1.1', 'type_definitions' => [ ['type' => 'user'], ], ]); $openfga->writeAssertions('01H...', [ [ 'tuple_key' => [ 'user' => 'user:123', 'relation' => 'viewer', 'object' => 'invoice:2026-001', ], 'expectation' => true, ], ]); $assertions = $openfga->readAssertions('01H...'); $changes = $openfga->readChanges(type: 'invoice'); $stores = $openfga->listStores(); $store = $openfga->getStore(); ``` Available Client Methods ------------------------ [](#available-client-methods) Low-level OpenFGA client: - `check` - `checkRaw` - `batchCheck` - `listObjects` - `listObjectsRaw` - `listUsers` - `expand` - `readTuples` - `writeTuple` - `deleteTuple` - `write` - `delete` - `writeAdvanced` - `writeAuthorizationModel` - `readAuthorizationModel` - `readAuthorizationModels` - `writeAssertions` - `readAssertions` - `readChanges` - `createStore` - `listStores` - `getStore` - `deleteStore` RBAC helper methods: - `createRole` - `deleteRole` - `createPermission` - `deletePermission` - `listRoles` - `getAllRoles` - `listPermissions` - `getAllPermissions` - `assignRole` - `revokeRole` - `hasRole` - `userRoles` - `rolesAssignedToUser` - `usersAssignedToRole` - `grantRolePermission` - `revokeRolePermission` - `rolePermissions` - `can` - `canAny` - `canAll` Testing ------- [](#testing) Run tests in Docker: ``` docker run --rm -v "$PWD:/app" -w /app composer:2 bash -lc "composer install && vendor/bin/phpunit" ``` Or use Composer: ``` composer test ``` Versioning ---------- [](#versioning) This package follows semantic versioning. Tag releases with Git tags: ``` git tag v0.1.0 git push origin v0.1.0 ``` Packagist will expose tagged versions as Composer releases. License ------- [](#license) MIT ### Health Score 34 — LowBetter than 74% of packages Maintenance90 Actively maintained with recent releases Popularity2 Limited adoption so far Community6 Small or concentrated contributor base Maturity33 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 47d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/1967927?v=4)[Masoud Vafaei](/maintainers/mvonline)[@mvonline](https://github.com/mvonline) --- Top Contributors [![msdvafaei](https://avatars.githubusercontent.com/u/289668050?v=4)](https://github.com/msdvafaei "msdvafaei (3 commits)") --- Tags phplaravelauthorizationrolespermissionsrbacauthzopenfgafga ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/mvonline-openfga-laravel-rbac/health.svg) ``` [![Health](https://phpackages.com/badges/mvonline-openfga-laravel-rbac/health.svg)](https://phpackages.com/packages/mvonline-openfga-laravel-rbac) ``` ### Alternatives [tempest/framework The PHP framework that gets out of your way. 2.3k42.4k21](/packages/tempest-framework)[aws/aws-sdk-php AWS SDK for PHP - Use Amazon Web Services in your PHP project 6.4k567.5M2.9k](/packages/aws-aws-sdk-php)[typo3/cms TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL. 1.2k1.9M122](/packages/typo3-cms)[flow-php/flow PHP ETL - Extract Transform Load - Data processing framework 86538.6k](/packages/flow-php-flow)[typo3/cms-core TYPO3 CMS Core 3714.0M5.8k](/packages/typo3-cms-core)[neuron-core/neuron-ai The PHP Agentic Framework. 2.1k1.0M59](/packages/neuron-core-neuron-ai) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)