Permission

A single authorization capability, addressed by the canonical key `{namespace}.{resource}:{action}` (namespace optional). It is the atom of the permissions matrix: roles group these, the resolver grants them, and `can()` checks them. Value identity is the key alone — {@see self::$metadata} is non-authoritative. Immutable by construction.

public function __construct(string $resource, string $action, ?string $namespace = null, array $metadata = []):

Parameters

public function key(): string

The canonical string: `{namespace}.{resource}:{action}`, or `{resource}:{action}` when namespace is null.

public static function of(string $resource, string $action, ?string $namespace = null): self

Builds a Permission straight from its segments, without parsing a key string.

Parameters

public static function parse(string $key): self

Parses a canonical key. `action` is everything after the single `:`; of the pre-colon part, the segment after the last `.` is the resource and the rest is the namespace (null if no `.`). A key with no `:`, an empty segment, or more than one `:` is malformed — fail-closed.

Parameters

Throws

\InvalidArgumentException on a malformed key

public function equals(self $other): bool

Value equality by canonical key (metadata is not part of identity).

Parameters