Hi all,
I want to listen your opinion about my Role Based Access Control for Yii.
Actually, I love the idea of RBAC in Yii described here http://www.yiiframew…-access-control but I have a question: Why do I have to remember all those role names I’ve created and why I should verify permissions manually for each piece of code? I’m quite sure that Model should only be modified with correponding Controller Actions. So why not to have permissions and roles closely tied to my controllers and their actions. And let Yii automatically verify user permissions to access that or other action.
So I've started with a database schema (MySQL):
As you can see each user can have multiple roles. Each role can have multiple permissions. Each permission allows access to corresponding controller/action pair. Also permissions can have business rule associated with it. Business rule is a simple piece of PHP code. For example here is a permission that will allow user to update his own profile (crud generated UsersController class will have a method called loadUser() to load current instance of 'User' model):
return Yii::app()->user->id==Yii::app()->getController()->loadUser()->id;
Here is corresponding SQL: http://paste2.org/p/153292
(i will also attach it to the post)
- Now we need a filter class that will allow/deny access to the controller/action pair.
Here it is: http://paste2.org/p/153293
(also attached, put it into /protected/filters folder)
- Now we need to add this filter to controller, this is easy:
// ..... in controller class....
/**
* @return array action filters
*/
public function filters()
{
return array(
array(
'application.filters.AccessControlFilter',
),
);
}
And that’s all! Mostly… I thought it would be good to have an yiic shell command that will be able to create/update/delete/grant/revoke/search permissions, users and roles. I’ve called it ‘rbac’, here is its code on PasteBin: http://paste2.org/p/153298
(code also in attachment, put it into /protected/command/shell folder)
and here is a sample console session
>> rbac grant roles=id:1 permissions=id:% add permission [1:list users:auth.users/list] to role [1:admins]? [Yes|No|All|Cancel] a added add permission [2:delete users:auth.users/delete] to role [1:admins]? [Yes|No|All|Cancel] Yes added add permission [3:show my profile:auth.users/show] to role [1:admins]? [Yes|No|All|Cancel] Yes added add permission [4:edit my profile:auth.users/update] to role [1:admins]? [Yes|No|All|Cancel] Yes added >> rbac applist USAGE rbac applist controllers rbac applist actions <controller.id> DESCRIPTION This command will list application controllers and their actions. >> rbac search permissions users=id:1 permissions=action:%show% +----+-----------------+---------------------+---------------+-----------+---------------------------------------------------------------------------+ | ID | Title | Description | Controller.ID | Action.ID | Business rule | +----+-----------------+---------------------+---------------+-----------+---------------------------------------------------------------------------+ | 3 | show my profile | show my own profile | auth.users | show | return Yii::app()->user->id==Yii::app()->getController()->loadUser()->id; | +----+-----------------+---------------------+---------------+-----------+---------------------------------------------------------------------------+ RBAC search criteria: permissions=id:3 Search returned 1 rows >> rbac missing permissions There are no permissions defined for these actions: +---------------+-----------+ | Controller.ID | Action.ID | +---------------+-----------+ | auth.users | create | | auth.users | admin | +---------------+-----------+ Note: we list only those controllers that are using our RBAC filter: application.filters.AccessControlFilter To find which controllers are not using RBAC filter run >> rbac missing controllers >> rbac delete permissions=id:% delete permission 'list users', id=1 [Yes|No|All|Cancel] n skipping delete permission 'delete users', id=2 [Yes|No|All|Cancel] n skipping delete permission 'show my profile', id=3 [Yes|No|All|Cancel] c >> rbac missing controllers These controllers are not using RBAC: +-----------------------------+-------------------------------+ | Controller.ID | Number of permissions defined | +-----------------------------+-------------------------------+ | site | 0 | | auth.roles | 0 | | auth.globalgroups | 0 | | accounting.employees | 0 | | projectmanagement.customers | 0 | +-----------------------------+-------------------------------+ >> rbac create permission auth.roles Create permission for the auth.roles/update action? [Yes|No|All|Cancel]y Enter name: Update role Enter description: update any role Enter bizrule (leave empty if not needed): Created permission 'Update role' with id=7 Create permission for the auth.roles/delete action? [Yes|No|All|Cancel]c
