oat-sa / tao-core

v56.13.2 2026-09-10 15:44 UTC

Requires

• ext-json: *
• ext-mbstring: *
• composer/package-versions-deprecated: ^1.11
• doctrine/collections: ^1.6.7
• doctrine/dbal: ^3.10
• doctrine/migrations: ^3.7
• ezyang/htmlpurifier: ^4.9
• flow/jsonpath: ~0.5
• guzzlehttp/guzzle: ^7.0
• guzzlehttp/psr7: ^2.0
• jtl-software/opsgenie-client: ^2.0.2
• justinrainbow/json-schema: ^5.2.1
• league/csv: ^9.6
• league/openapi-psr7-validator: ~0.18
• oat-sa/composer-npm-bridge: ~0.4.2||dev-master
• oat-sa/generis: >=17.3.0
• oat-sa/imsglobal-lti: ^4.0.1
• oat-sa/jig: ~0.2
• oat-sa/oatbox-extension-installer: ~1.1||dev-master
• open-telemetry/api: ^1.0
• open-telemetry/sdk: ^1.0
• paragonie/random_compat: ^2.0
• phpdocumentor/reflection-docblock: ^5.2
• pimple/pimple: ^3.0
• psr/http-message: ~1.0
• slim/slim: ^4.0
• symfony/dotenv: ^6.4

Requires (Dev)

• lcobucci/jwt: ~5

Suggests

• ext-opentelemetry: Required at runtime to export task-queue traces (TaskQueueTelemetry is a no-op without it)

GPL-2.0-only

• Open Assessment Technologies S.A.
• Jérôme Bogaerts
• Joel Bout
• Bertrand Chevrier
• Lionel Lecaque
• Patrick Plichart
• Dieter Raber
• Somsack Sipasseuth

• OAT
• TAO
• computer-based-assessment

Published on Packagist.org on 2026-09-10 15:44 UTC

README

• Task Queue Doc
• Middlewares Doc
• Feature Flag
• CSRF Tokens
• Client Config

Webhooks

Description

Webhooks allow you to send a request to remote server based on triggered event

How to use it

Register event webhook.

use command \oat\tao\scripts\tools\RegisterEventWebhook to register events that are implementing \oat\tao\model\webhooks\configEntity\WebhookInterface interface.

i.e:

$ php index.php 'oat\tao\scripts\tools\RegisterEventWebhook'
    \ -u "https://example.com"
    \ -m "POST"
    \ -e "<<Class FQN>>"

Check ACL Permissions

In order to check ACL permissions, you can use the PermissionChecker:

$permissionChecker = $this->getServiceLocator()->get(oat\tao\model\accessControl\PermissionChecker::class);

$permissionChecker->hasWriteAccess('resourceId');
$permissionChecker->hasReadAccess('resourceId');
$permissionChecker->hasGrantAccess('resourceId');

Important: It takes into consideration the current user in the session, if no user is provided.

Roles Access (rules and action permissions)

Description

Script allow you to apply (add)/revoke (remove) list of rules and/or permissions to a specific roles and actions.

How to use it

Execute the following command to apply (add) new rules/permissions:

$ php index.php 'oat\tao\scripts\tools\accessControl\SetRolesAccess' \
--config [config.json|json_string]

If you want to revoke (remove) them, add --revoke flag:

$ php index.php 'oat\tao\scripts\tools\accessControl\SetRolesAccess' \
--revoke \
--config [config.json|json_string]

Config example

{
  "rules": {
    "role": [
      {
        "ext": "extensionIdentifier",
        "mod": "actionControllerName",
        "act": "actionMethodName"
      }
    ]
  },
  "permissions": {
    "controller": {
      "action": {
        "rule1": "READ",
        "rule2": "WRITE"
      }
    }
  }
}

Environment variables

Here you can find the environment variables including feature flags

Variable	Description	Default value
FEATURE_FLAG_LISTS_DEPENDENCY_ENABLED	Enable Remote Lists Dependency feature	-
FEATURE_FLAG_ADVANCED_SEARCH_DISABLED	Disable advanced search feature, if set to 1	-
FEATURE_FLAG_STATISTIC_METADATA_IMPORT	Enable statistics metadata import	-
FEATURE_FLAG_CKEDITOR_SOURCEDIALOG	Enable source editing for ckeditor	false
FEATURE_FLAG_SOLAR_DESIGN_ENABLED	Activate the Solar Design mode	-
GOOGLE_APPLICATION_CREDENTIALS	Path to GCP credentials path	-
DATA_STORE_STATISTIC_PUB_SUB_TOPIC	Topic name for statistic metadata Pub/Sub	-
REDIRECT_AFTER_LOGOUT_URL	Allows to configure the redirect after logout via environment variable. The fallback is the configured redirect on urlroute.conf.php	-
PORTAL_URL	The Portal url used on the back button of Portal theme	-
FEATURE_FLAG_TRANSLATION_ENABLED	Enable access to items/tests translations feature	-
TAO_ALLOWED_TRANSLATION_LOCALES	Comma separated List of locales available for translations / authoring in the UI. If none provided, all are allowed	-
COOKIE_POLICY_CONFIG	JSON with CookiePolicy config. Example: {"privacyPolicyUrl":"https://...","cookiePolicyUrl":"https://..."}	-
TAO_ID_GENERATOR_MAX_RETRIES	Maximum number of retry attempts for unique ID generation on collision	10
TAO_ID_GENERATOR_SHOULD_CHECK_STATEMENTS	Enable statement checks during ID generation (set to 1 to enable)	0
TAO_ID_GENERATOR_ID_START	Starting value for unique ID generation	1
FEATURE_FLAG_TAO_DUAL_PREVIEW_ENABLED	Enables buttons to run secondary registered previewer	1

Routing

Check more information about actions/controllers and routing here

Observer implementations

Check the current observer implementations here

Data Policy Orchestrator handlers

Check the current Data Policy Orchestrator handlers doc here