odiseoteam / sylius-rbac-plugin

v3.0.2 2026-09-12 05:33 UTC

Requires

• php: ^8.2
• sylius/sylius: ^2.0
• symfony/yaml: ^6.4 || ^7.0

Requires (Dev)

• behat/behat: ^3.16
• dbrekelmans/bdi: ^1.4
• deptrac/deptrac: ^3.0
• dmore/behat-chrome-extension: ^1.4
• dmore/chrome-mink-driver: ^2.9
• friends-of-behat/mink: ^1.11
• friends-of-behat/mink-browserkit-driver: ^1.6
• friends-of-behat/mink-debug-extension: ^2.1
• friends-of-behat/mink-extension: ^2.7
• friends-of-behat/page-object-extension: ^0.3
• friends-of-behat/suite-settings-extension: ^1.1
• friends-of-behat/symfony-extension: ^2.6
• friends-of-behat/variadic-extension: ^1.6
• nyholm/psr7: ^1.8
• phpstan/phpstan: ^1.12
• phpstan/phpstan-doctrine: ^1.3
• phpstan/phpstan-webmozart-assert: ^1.2
• phpunit/phpunit: ^10.5
• robertfausk/behat-panther-extension: ^2.0
• shipmonk/composer-dependency-analyser: ^1.8
• sylius-labs/coding-standard: ^4.4
• sylius-labs/suite-tags-extension: ~0.2
• sylius/sylius-rector: ^2.0
• sylius/test-application: ^2.0.0@alpha
• symfony/browser-kit: ^6.4 || ^7.4
• symfony/debug-bundle: ^6.4 || ^7.4
• symfony/dotenv: ^6.4 || ^7.4
• symfony/http-client: ^6.4 || ^7.4
• symfony/intl: ^6.4 || ^7.4
• symfony/runtime: ^6.4 || ^7.4
• symfony/web-profiler-bundle: ^6.4 || ^7.4
• symfony/webpack-encore-bundle: ^2.2

MIT

• sylius
• sylius-plugin
• sylius-rbac

Published on Packagist.org on 2026-09-12 05:34 UTC

README

Introduction

This plugin adds role-based access control to the Sylius admin: you define your own roles, one permission per operation on one resource, and it enforces them everywhere.

What makes this plugin different?

• ✅ One permission per operation - sylius.product.update and sylius.product.delete are separate permissions
• ✅ Every admin route and API operation covered - Permissions come from Sylius' own resource metadata, so routes added by other plugins are covered automatically
• ✅ Deny by default - An unprotected route is denied, not allowed. Exceptions are explicit, in config
• ✅ UI filtered, not just routes - Menu entries, grid buttons and dashboard widgets check the same permission
• ✅ Workflow transitions included - Cancelling an order asks for sylius.order.cancel, not sylius.order.update
• ✅ Multiple roles per administrator - Roles are additive, with a lockout guard on the roles screen
• ✅ Console tooling - Grant access, list permissions, find orphaned ones and migrate v2 data from the CLI
• ✅ 18 locales - Including English, Spanish, French, German, Polish, Portuguese, Simplified Chinese and Arabic

Screenshots

Roles: The ones you define, not a fixed list	Assignment: An administrator may hold several roles
Menu: Trimmed to what the role can reach	Grids: No Create, no Delete, for a role without them

Getting Started

Install it in 5 steps ⚡

1. ✅ Require the plugin
2. ✅ Wire the assets
3. ✅ Make your AdminUser administration-role aware
4. ✅ Update the database schema
5. ✅ Give someone access

👉 Follow the installation guide

Quick Example

Require the plugin. Symfony Flex's recipe registers the bundle and imports its config and routes for you:

composer require odiseoteam/sylius-rbac-plugin --no-scripts

Once the remaining steps are done, grant the first role from the console:

bin/console odiseo:rbac:grant <username-or-email> super_admin --create

Important

An administrator with no role is denied everything, including the screen that assigns roles. Right after installing, nobody can reach the admin panel until you grant that first role.

What a permission looks like

Every permission is {package}.{subject}.{operation}, the same code Sylius' own resource metadata produces:

Pattern	Meaning
sylius.product.update	One operation on one resource
sylius.product.*	Everything on products
sylius.order.ship	An operation that is not CRUD
*.*.index	A read-only role, across the whole application
*.*.*	A super administrator

A role stores the pattern as written, not the list of operations it matches today, so sylius.product.* keeps working when Sylius adds a new operation to products later.

Learn more about the permission model →

Documentation

• 📦 Installation - Three steps with Flex, plus the two the recipe cannot do
• 🔑 The permission model - Identifiers, patterns, wildcards, how the tree is built
• 🛡️ What gets enforced - The six surfaces, and what happens to a route nobody covered
• 👥 Managing roles - Day-to-day use of the admin screens
• ⚙️ Configuration reference - Every key under odiseo_sylius_rbac
• 🧩 Extending - Declaring permissions for your own routes and plugins
• 💻 Console commands - grant, debug, migrate-permissions
• 🚑 Troubleshooting - Locked out, unexpected 403, orphaned declarations
• ⬆️ Upgrading to 3.0 - What breaks, and how stored roles are migrated
• 🤝 Contributing - Running the test application and the suites

Compatibility

Plugin	Sylius	PHP	Symfony	Database
^3.0	2.0 · 2.1 · 2.2	8.2 · 8.3 · 8.4	6.4 · 7.x	MySQL · MariaDB · PostgreSQL
^2.0	1.12 · 2.0	8.0+	5.4 · 6.x	MySQL · MariaDB

Note

The schema migrations ship for MySQL/MariaDB and PostgreSQL. On any other engine they skip, and Doctrine records them as executed even so, so write your own before upgrading a 2.x database, see Upgrading to 3.0.

Only the latest minor is supported. Security fixes land on master.

Professional Support

This plugin is maintained by Odiseo. Need help with it, or with any Sylius project?

• 🎬 Live demo - A live walkthrough of this plugin
• 🛠️ Sylius development - Help with this plugin or any Sylius project
• 🏪 Multi-vendor marketplace - Vendor role separation is one of the things a marketplace has to get right, and this plugin is how we do it
• 🔌 More Sylius plugins - Browse all our Sylius plugins

License

MIT.