Frontend access uses the same central permission model as admin access. Do not create a second frontend RBAC system.
Use Core access helpers such as `amv_core_access_evaluate()` and `amv_core_access_allows()` to evaluate frontend resources.
Supported visibility values include:
Resources can declare required permissions, roles, or groups. The evaluator should decide; the addon should describe the resource.
Frontend permission keys belong in `src/permissions_contract.php`.
Frontend route access belongs in `routes/routes.php` route metadata.
Public target access belongs near the public target provider, usually `src/public_targets.php`.
Manifest and install contract may point to these providers, but they must not carry a copied frontend permission catalog or copied route table.
An addon with a frontend surface should declare access metadata near its public target and route registration. Ticket Support is the current pattern: it declares submit and view-own access for `/support` and lets Core enforce the permission gate.
The important part is not that `/support` is private or public. The important part is that the addon declares the access rule once and Core enforces it consistently.
Routes can include `access` metadata with an action and resource. The route dispatcher reads that metadata and runs the central evaluator before the handler.
Example shape:
'access' => [
'action' => 'submit',
'resource' => [
'resource_type' => 'ticket_support.ticket',
'visibility' => 'permission',
'required_permission' => 'ticket_support.ticket.submit',
'required_permissions' => ['ticket_support.ticket.submit'],
],
],The permission key must be declared in the addon permission contract.
Public targets should expose visibility and required access metadata so Menu Manager can understand what a target requires.
A frontend page can be public, members-only, role-limited, group-limited, or permission-limited. The decision belongs to the addon contract and central evaluator, not a hardcoded route shortcut.
Do not hardcode a private access system into an addon. Do not duplicate frontend access truth into manifest, install contract, routes, and docs as separate copies. The code may be clever, but clever drift is still drift wearing a nicer coat.
Updated: 2026-05-07 20:06:59