cakephp-aclcomponent

ACL without complications, based on a permissions array.

Handle requests to your Cake3 controller methods based on a permissions array.

CakePHP version 3 does not come with ACL anymore. For those of us fond of this, some might remember the complications with the extra 3 database tables, difficulties testing the system, etc.

About

Pass in the array of permissions to the component after the user has been detected by the AuthComponent.

• This component restricts access to controller methods.
• Keep the permissions in an easy to see & test PHP array.
• Load the component in the AppController, and pass it the permissions the user requires.
• Wildcard the whole app or controller for specific user groups!

Using

 // keep a $permissions array, somewhere, use a db or flat-file:
 $permissions = [
     'admin' => '*', // admins can access all controllers & all methods
     'customer' => [
         'Products' => '*', // customers can access all the methods of the ProductsController
         'Users' => ['my_account', 'contact'], // customers can only access these two methods in UsersController
     ],
     'banned' => [], // banned users cannot access anything
 ];
 
 // In your AppController:::initialize()
 $user = $this->Auth->user();
 if ($user) {
 // user is logged in, so we can load the Acl
 // no need to load Acl if we are not logged in, right?
 
 // users.role in your db corresponds to the $permissions key, admin, customer or banned in this example
 $this->loadComponent('Acl', $permissions[$user->role]); 

For small apps you might keep the role as a string in your db, but larger applications will require a users.group_id and a groups table. The same strategy applies, just use the groups.name value.

Contribute

fork and pr