PHP code example of mvonline / openfga-laravel-rbac

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

mvonline / openfga-laravel-rbac example snippets

use OpenFga;

$allowed = OpenFga::check(
    'user:' . $user->id,
    'viewer',
    'invoice:' . $invoice->id,
);

use OpenFgaRbac;

OpenFgaRbac::createRole('billing-admin');
OpenFgaRbac::createPermission('invoice.view');
OpenFgaRbac::assignRole($user->id, 'billing-admin');
OpenFgaRbac::grantRolePermission('billing-admin', 'viewer', 'invoice', $invoice->id);

if (OpenFgaRbac::can($user->id, 'viewer', 'invoice', $invoice->id)) {
    // authorized
}

$roles = OpenFgaRbac::listRoles();
$permissions = OpenFgaRbac::listPermissions();
$userRoles = OpenFgaRbac::userRoles($user->id);
$roleUsers = OpenFgaRbac::usersAssignedToRole('billing-admin');
$rolePermissions = OpenFgaRbac::rolePermissions('billing-admin');

$canReadOrEdit = OpenFgaRbac::canAny($user->id, ['viewer', 'editor'], 'invoice', $invoice->id);
$canReadAndEdit = OpenFgaRbac::canAll($user->id, ['viewer', 'editor'], 'invoice', $invoice->id);

Route::get('/invoices/{invoice}', InvoiceController::class)
    ->middleware('openfga:viewer,invoice:{invoice}');

Route::get('/invoices/{invoice}', InvoiceController::class)
    ->middleware('openfga.any:owner:invoice:{invoice},admin:tenant:acme');

Route::patch('/invoices/{invoice}', InvoiceController::class)
    ->middleware('openfga.all:viewer:invoice:{invoice},member:tenant:acme');

use GuzzleHttp\Client as GuzzleClient;
use GuzzleHttp\Psr7\HttpFactory;
use OpenFgaRbac\Client;
use OpenFgaRbac\Config;

$http = new GuzzleClient();
$factory = new HttpFactory();

$openfga = new Client(
    new Config(
        apiUrl: 'http://localhost:8080',
        storeId: '01H...',
        authorizationModelId: '01H...',
        token: null,
    ),
    $http,
    $factory,
    $factory,
);

$allowed = $openfga->check('user:123', 'viewer', 'invoice:2026-001');

use OpenFgaRbac\TupleKey;

$result = $openfga->checkRaw(
    user: 'user:123',
    relation: 'viewer',
    object: 'document:roadmap',
    contextualTuples: [
        TupleKey::make('user:123', 'member', 'team:finance'),
    ],
    context: [
        'ip' => '127.0.0.1',
    ],
    consistency: 'HIGHER_CONSISTENCY',
);

$batch = $openfga->batchCheck([
    [
        'correlation_id' => 'invoice-view',
        'tuple_key' => [
            'user' => 'user:123',
            'relation' => 'viewer',
            'object' => 'invoice:2026-001',
        ],
    ],
]);

$objects = $openfga->listObjects('user:123', 'viewer', 'invoice');

$users = $openfga->listUsers(
    object: 'invoice:2026-001',
    relation: 'viewer',
    userFilters: [
        ['type' => 'user'],
    ],
);

use OpenFgaRbac\TupleKey;

$openfga->writeTuple('user:123', 'viewer', 'invoice:2026-001');
$openfga->deleteTuple('user:123', 'viewer', 'invoice:2026-001');

$openfga->writeAdvanced(
    writes: [
        TupleKey::make('user:123', 'viewer', 'invoice:2026-001'),
    ],
    deletes: [
        TupleKey::make('user:456', 'viewer', 'invoice:2026-001'),
    ],
    onDuplicate: 'ignore',
    onMissing: 'ignore',
);

$models = $openfga->readAuthorizationModels();
$model = $openfga->readAuthorizationModel('01H...');

$authorizationModelId = $openfga->writeAuthorizationModel([
    'schema_version' => '1.1',
    'type_definitions' => [
        ['type' => 'user'],
    ],
]);

$openfga->writeAssertions('01H...', [
    [
        'tuple_key' => [
            'user' => 'user:123',
            'relation' => 'viewer',
            'object' => 'invoice:2026-001',
        ],
        'expectation' => true,
    ],
]);

$assertions = $openfga->readAssertions('01H...');
$changes = $openfga->readChanges(type: 'invoice');
$stores = $openfga->listStores();
$store = $openfga->getStore();

bash
php artisan vendor:publish --tag=openfga-rbac-config