Sylius Rbac Plugin

This plugin adds role-based access control to the Sylius admin: you define your own roles, one permission per operation on one resource, and it enforces them everywhere.

What you get

• One permission per operation: sylius.product.update and sylius.product.delete are separate permissions. Wildcards keep it manageable: sylius.product.*, *.*.index, *.*.*.
• Every admin route covered: Permissions are discovered from Sylius' own resource metadata, so routes added by Sylius or by other plugins are covered automatically.
• Admin API coverage: This plugin covers all the APIs operations.
• Deny by default: An unprotected route is denied, not allowed. Exceptions are explicit, in config.
• UI filtered, not just routes: Menu entries, grid buttons and dashboard widgets check the same permission, so what a role can't use isn't rendered.
• Workflow transitions have their own permission: Cancelling an order asks for sylius.order.cancel, not sylius.order.update.
• Multiple roles per administrator: Roles are additive, with a lockout guard on the roles screen.
• Console tooling: Grant access from the CLI, list permissions, find orphaned ones, migrate v2 data.
• 18 locales: Including English, Spanish, French, German, Polish, Portuguese, Simplified Chinese and Arabic.

Compatible with Sylius 2.0+ · PHP 8.2+.

Documentation

Built by Odiseo, working with Symfony and Sylius since 2014. 660,000+ downloads across our open-source packages.