kumwe / access-control

v0.1.2 2026-09-08 15:58 UTC

Requires

• php: ^8.5
• kumwe/access-context: 0.1.2
• psr/container: ^2.0

Requires (Dev)

• laminas/laminas-servicemanager: ^4.0
• phpstan/phpstan: ^2.1
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-strict-rules: ^2.0
• squizlabs/php_codesniffer: ^4.0

Apache-2.0

Published on Packagist.org on 2026-09-10 18:38 UTC

README

Portable authorization decisions, owner-bound capability/resource-policy registries, scope models and explicit host authority ports. Canonical PHP namespace: Kumwe\Access\. Requires PHP 8.5, exact Access Context 0.1.2 and PSR Container 2. No native extension is required.

Installation and use

Install the published package with an exact pre-1.0 pin:

composer require kumwe/access-control:0.1.2

<?php

require 'vendor/autoload.php';

use Kumwe\Access\AuthorizationDecision;
use Kumwe\Access\DecisionCombiner;
use Kumwe\Access\DecisionState;

$result = (new DecisionCombiner())->combine([
    new AuthorizationDecision(DecisionState::Allow, 'example.grants.v1', 'matching_grant'),
    new AuthorizationDecision(DecisionState::StepUp, 'example.assurance.v1', 'fresh_proof_required'),
]);
assert(!$result->allowed);

Deny overrides step-up, step-up overrides allow, and abstention grants nothing. Equal-state decisions select policy then reason in byte order. Empty input explicitly abstains. The host evaluates rules and enforces the resulting authority; this package has no authentication or audit implementation.

Registries require explicit MembershipRequirement and ownership rules require an explicit reserved host table. Unknown ownership categories default to site-only. Extension capabilities obey their owner namespace, cannot bind another owner's capability or declare system identities, and collide regardless of lifecycle. Removing capability ownership makes orphan policy lookups inert.

Core integration

Register ConfigProvider in Core's composition root with explicit membership targets, reserved ownership rules and reference inspectors. Core supplies authority, membership resolution, persistence, transactions and audit adapters. See the Core contract and integration guide for service lifetimes, configuration and retained integration tests.

Public API, architecture, charter, release record and security policy describe supported boundaries. Published versions and CI status are linked above; Core integration is validated in the consuming repository.

Development and releases

composer install
composer check
composer examples

CI installs the built ZIP as a no-development, authoritative-classmap dependency and exercises every export, example and configured service. Testing explains package and Core ownership. Release guidance and dependency verification distinguish publication identity checks from independent consumer evidence. Licensed under Apache-2.0.