Yii-Permission 3.0 Released: Official Apache Casbin Extension for Yii 3

Apache Casbin Overview

Apache Casbin is an open‑source authorization standard under the Apache Foundation, adopted by companies such as Intel, Alibaba, Tencent and Microsoft. It is built on the PERM meta‑model and natively supports ACL, RBAC, ABAC, multi‑tenant domains and virtually all permission scenarios with a single policy file.

Yii‑Permission 3.0 Release

The php-casbin/yii-permission repository provides the official Yii adaptation of the Casbin engine. Version 3.0.0, launched at the end of July 2026, refactors the underlying code, fully supports the modern Yii 3 component system and complies with the PSR series development standards.

Core Upgrade Highlights

1. Yii 3 Compatibility and PHP 8.2 Baseline

The minimum runtime is upgraded to PHP 8.2, leveraging strong typing and property types to reduce implicit‑conversion bugs. The extension also fully integrates Yii 3’s new dependency‑injection system using yiisoft/config for container configuration, abandoning the legacy Yii 2 component declaration style.

2. Architecture Revamp: PSR‑15 Middleware

Previous Yii 2 versions relied on controller Behaviors for permission interception, which caused tight coupling and limited reuse. Version 3.0 replaces this with industry‑standard PSR‑15 HTTP middleware, providing two core middlewares: EnforcerMiddleware: automatically enforces Casbin checks globally or per route group. RequestMiddleware: parses request context and extracts the logged‑in user, fully decoupling permission logic and greatly improving reusability.

3. Native AccessChecker Support

A new AccessChecker class implements Yii 3’s AccessCheckerInterface. Business code can continue to use the familiar $user->can() syntax, while the underlying Casbin engine evaluates complex rules:

if ($user->can('article.update', ['article' => $article])) {
    // Execute article update business logic
}

Key Features and Breaking Changes

Yii 3 Framework Support : full compatibility with Yii 3’s component ecosystem and DI conventions.

Environment Requirements : requires PHP 8.2+ and Yii 3.0; older versions are no longer supported.

PSR‑15 Middleware Architecture : introduces EnforcerMiddleware and RequestMiddleware, deprecating the old controller Behavior component.

Native AccessChecker : adds AccessChecker with $user->can() syntax for seamless permission checks.

Unified Configuration & CI Optimisation : uses yiisoft/config for DI configuration and updates GitHub Actions CI pipelines with multi‑PHP version testing and improved coverage settings.

Recommended Users

Developers building new Yii 3 projects that need fine‑grained RBAC, multi‑tenant or attribute‑based permissions.

Teams upgrading existing Yii applications to Yii 3 and requiring a smooth migration of their Casbin permission system.

Core Benefits

Authoritative Standard : backed by Apache Casbin and validated in large‑scale enterprise deployments, meeting compliance audit requirements.

Multi‑Model Compatibility : a single engine serves simple admin back‑ends and complex SaaS multi‑tenant systems.

Dynamic Policy Enforcement : policies can be modified online without code changes or service restarts.

Cross‑Stack Unification : the same Casbin model can be shared across Java, Go, PHP services, reducing maintenance overhead.

Related PHP Framework Extensions

Beyond the Yii extension, the Apache Casbin PHP ecosystem also offers webman-permission , a permission extension optimised for the high‑concurrency, coroutine‑based Webman framework. It shares the same Casbin rule definitions with yii‑permission, allowing developers to switch frameworks freely.

Repository:

https://github.com/php-casbin/webman-permission