# Enforce Private-file Authorization for Symfony

## Overview

Private file access for a Symfony app on Ample. Verified on Symfony: a role-to-document access model with negative tests (401, 403) and an authorized private-bucket round-trip (private=ok). Build and start: composer install --no-dev from composer.lock with Symfony Runtime's dotenv disabled (extra.runtime.disable_dotenv; .env never ships, its values arrive as encrypted env, and compile-time parameters such as DEFAULT_URI need a default), then FrankenPHP serving public/ (php-server with the index.php fallback) reading PORT on the php-8.5 template with APP_ENV=prod.

## Representative Queries
- Enforce private-file authorization for Symfony
- Where can I host Enforce private-file authorization built with Symfony?
- I need application identity integration, per-file access rules and negative authorization tests.

## Resource Requirements
- primitive:compute
- primitive:postgres
- primitive:s3-compatible-object-storage

## Infrastructure Requirements
### Compute
- **Status**: Verified
- **Summary**: Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes.

### Postgres
- **Status**: Verified
- **Summary**: Managed PostgreSQL 16 runs in its own microVM and is auto-provisioned when an app needs a database and no DATABASE_URL is supplied.

### S3-Compatible Object Storage
- **Status**: Verified
- **Summary**: Buckets are S3-compatible with issued credentials; PutObject and GetObject are verified by canary. Other S3 operations are not verified.

## Framework
Symfony

## Workload
Enforce private-file authorization

## Release Status
Published

## Support Status
Verified

## Execution Status
Ready

## Docs Only
False

## Prerequisites
1. A Symfony project (composer install --no-dev from composer.lock with Symfony Runtime's dotenv disabled (extra.runtime.disable_dotenv; .env never ships, its values arrive as encrypted env, and compile-time parameters such as DEFAULT_URI need a default), then FrankenPHP serving public/ (php-server with the index.php fallback) reading PORT on the php-8.5 template with APP_ENV=prod)
2. A PostgreSQL driver reading DATABASE_URL at runtime
3. A bucket from `ample bucket create` with credentials passed as encrypted S3_* environment variables
4. An Ample account token with servers:write, databases:read, buckets:read

## Tested Configuration
- Template: php-8.5
- Runtime: php
- Size: s-1vcpu-1gb
- Install: composer install --no-dev --prefer-dist --no-interaction --no-progress --optimize-autoloader
- Start: frankenphp php-server --listen :$PORT --root public

## Workflow Steps
### Build and Start
Build and start the application.

### Create the Bucket and Pass Its Credentials
Create it once with `ample bucket create`, then pass endpoint, region, bucket and keys with --env; use path-style addressing.
- **Command**: ample deploy . --name  --public --env S3_ENDPOINT=... --env S3_REGION=... --env S3_BUCKET=... --env S3_ACCESS_KEY_ID=... --env S3_SECRET_ACCESS_KEY=...

### Authorize Before Touching Storage
Return 401 for unauthenticated requests and 403 for the wrong role; keep the bucket unpublished and stream objects through the app.

### Verify
Fetch the live URL and /p/private-document-library on the example; on failure read the build and runtime logs.
- **Command**: ample logs  --kind build

## Examples
### Symfony Pattern Fixture
- **Description**: Verified private file access on Symfony.
- **Source Reference**: tests/deploy-canaries/symfony-patterns

## Success Checks
1. App responds on its public URL.
   - **Kind**: http_get
   - **Path**: / 
   - **Expect**: ample canary symfony patterns
2. Private-document-library check from the example.
   - **Kind**: http_get
   - **Path**: /p/private-document-library
   - **Expect**: see the pattern fixture checks

## Limitations
- Verified on the php-8.5 template at s-1vcpu-1gb; other sizes and Symfony major versions are not verified.
- Region, compliance attestations and request-duration limits are unknown and not claimed.
- Managed PostgreSQL 16 only; extensions, connection limits and backup or restore procedures are not verified.
- PutObject and GetObject with path-style addressing are verified; other S3 operations are not.

## Cost Estimate
- **Currency**: USD
- **Monthly Amount**: 10.0
- **Basis**: size prices from pricing.toml (loaded by the API) at build revision 1ac5595375130d45290090e82ed0f554ccd45405-dirty 
### Components
- App Server: s-1vcpu-1gb - 1.0x - $5.0
- Managed PostgreSQL Database: s-1vcpu-1gb - 1.0x - $5.0
- **Note**: Always-on monthly price of the tested sizes; apps auto-pause when idle. Buckets are allocation-priced per quota and not included.

## Evidence Summary
### Canary Run
- **Summary**: Symfony pattern fixture deployed on Ample.
- **Observed At**: 2026-09-20T22:23:52Z
- **Implementation Revision**: 64a7bb8e37dd-dirty (CLI 64a7bb8e)
- **Expires At**: 2027-03-19T22:23:52Z
- **Scope**: checks ["/p/private-document-library"]

## Last Verified At
2026-09-20T22:23:52Z

## Unknowns
- Region availability is unknown until a verified region fact is recorded.
- Compliance attestations are unknown; none are claimed.

## Formats
- **HTML**: [Link](/content/guides/symfony/private-file-access/index.html)
- **Markdown**: [Link](/content/guides/symfony/private-file-access.md)
- **JSON**: [Link](https://api.ample.computer/v1/catalog/recipes/page%3Aguides%3Asymfony%3Aprivate-file-access)

## Next Actions
1. **Browse Catalog**: Browse the catalog index.
2. **Search Recipes**: Search published recipes by intent, stack and constraints.
3. **Prepare Deployment Plan**: Prepare a side-effect-free deployment plan for an authorized project.
4. **Read Existing Authentication Setup**: Read the existing agent authentication setup.
5. **Browse Symfony**: Browse Symfony.
6. **Browse Connect App to Storage**: Browse Connect app to storage.
7. **Browse Private Document Library**: Browse Private document library.