pentiminax / ux-datatables

v1.0.0 2026-09-17 21:23 UTC

Requires

• php: >=8.3
• symfony/config: ^7.0 || ^8.0
• symfony/dependency-injection: ^7.0 || ^8.0
• symfony/http-kernel: ^7.0 || ^8.0
• symfony/property-access: ^7.0 || ^8.0
• symfony/security-bundle: ^7.0 || ^8.0
• symfony/security-csrf: ^7.0 || ^8.0
• symfony/stimulus-bundle: ^2.0 || ^3.0

Requires (Dev)

• api-platform/core: ^3.0 || ^4.0
• doctrine/orm: ^3.0
• friendsofphp/php-cs-fixer: ^3.95
• openspout/openspout: ^4.0
• phpunit/phpunit: ^11.5
• symfony/expression-language: ^7.0 || ^8.0
• symfony/form: ^7.0 || ^8.0
• symfony/framework-bundle: ^7.0 || ^8.0
• symfony/maker-bundle: ^1.66
• symfony/mercure-bundle: ^0.5.0
• symfony/phpunit-bridge: ^7.0 || ^8.0
• symfony/property-info: ^7.0 || ^8.0
• symfony/translation: ^7.0 || ^8.0
• symfony/twig-bundle: ^7.0 || ^8.0
• symfony/var-dumper: ^7.0 || ^8.0
• symfony/web-profiler-bundle: ^7.0 || ^8.0

Suggests

• api-platform/core: To auto-detect columns from API Platform metadata.
• openspout/openspout: To enable server-side CSV and XLSX export via Button::csv(serverSide: true) and Button::excel(serverSide: true).
• symfony/expression-language: To use Symfony Expression objects with setPermission().
• symfony/form: To enable inline edit modal with auto-generated forms.
• symfony/maker-bundle: To use the make:datatable command.
• symfony/mercure-bundle: To enable real-time DataTable updates via Mercure SSE.
• symfony/translation: To translate DataTable column titles and the filter bar labels (Filters/Reset/Apply/All).
• symfony/twig-bundle: To render edit form and TwigColumn

Conflicts

• symfony/flex: <1.13

MIT

• Tanguy Lemarié

• datatables
• symfony-ux

Published on Packagist.org on 2026-09-17 21:26 UTC

README

UX DataTables is a Symfony bundle integrating the DataTables library in Symfony applications.

Video tutorial

Requirements

• PHP 8.3 or higher
• Symfony StimulusBundle (installed through Symfony UX)
• Composer

Installation

Install the library via Composer:

composer require pentiminax/ux-datatables

Usage

1. Declare a DataTable

use App\Entity\User;
use Pentiminax\UX\DataTables\Attribute\AsDataTable;
use Pentiminax\UX\DataTables\Column\BooleanColumn;
use Pentiminax\UX\DataTables\Column\DateColumn;
use Pentiminax\UX\DataTables\Column\MoneyColumn;
use Pentiminax\UX\DataTables\Column\NumberColumn;
use Pentiminax\UX\DataTables\Column\TextColumn;
use Pentiminax\UX\DataTables\Model\AbstractDataTable;

#[AsDataTable(User::class)]
final class UserDataTable extends AbstractDataTable
{
    public function configureColumns(): iterable
    {
        return [
            NumberColumn::new('id', 'ID'),
            TextColumn::new('firstName', 'First name'),
            TextColumn::new('email', 'Email'),
            DateColumn::new('createdAt', 'Created at'),
        ];
    }
}

Column variants are configured fluently after new():

TextColumn::new('name')->utf8();
TextColumn::new('content')->html()->utf8();
NumberColumn::new('price')->formatted();
MoneyColumn::new('price')->currency('EUR')->storedAsCents();
BooleanColumn::new('active')->renderAsSwitch();
TextColumn::new('internalCode')->disableColumnControl();

disableColumnControl() removes all ColumnControl controls for the column without disabling DataTables search processing.

2. Wire it in a controller

#[Route('/users', name: 'app_users')]
public function index(UserDataTable $table, Request $request): Response
{
    $table->handleRequest($request);

    if ($table->isRequestHandled()) {
        return $table->getResponse();
    }

    return $this->render('user/index.html.twig', [
        'table' => $table,
    ]);
}

3. Render in Twig

{{ render_datatable(table) }}

Tip: run php bin/console make:datatable to scaffold a DataTable class from any Doctrine entity.

Security

The bundle auto-registers a set of Ajax routes under /datatables/ajax/* (ux_datatables_ajax_data, ux_datatables_ajax_delete, ux_datatables_ajax_edit, ux_datatables_ajax_edit_form, ux_datatables_ajax_edit_form_submit, ux_datatables_ajax_detail, ux_datatables_ajax_export).

The table token embedded in the rendered HTML identifies which table is requested, not who is requesting it — it is not a user-authentication or per-user authorization mechanism. If a table is displayed behind a firewall but these routes are left unprotected, the underlying data (and the edit/delete actions) can be reached by anyone holding the token.

Protect the routes with an access_control rule that matches the pages rendering your tables:

# config/packages/security.yaml
security:
    access_control:
        # access_control is first-match-wins; place this before any broader rule.
        - { path: ^/datatables/ajax, roles: ROLE_ADMIN }

Delete actions and inline boolean toggles additionally require an active session for CSRF protection. Without one, their controls are rendered disabled (mutationsEnabled: false in the table payload).

See Securing Ajax Routes for details.

Documentation

• Online documentation