How do Yii 3 controllers deal with permission access?

Yii 3.0 Ask a question
1

We have a custom permission system that needs to be hooked into controller methods. Does Yii 3 supply anything for that? PHP attributes perhaps?

2

Have you looked into Yii’s RBAC?

3

Thanks. Looks like they just inject the permission manager

public function actionCreate(\Yiisoft\Access\AccessCheckerInterface $accessChecker): ResponseInterface
{
    $userId = getUserId();

    if ($accessChecker->userHasPermission($userId, 'createPost')) {
        // author has permission to create post
    }
}

Which might get awkward when done en masse.

4

You have probably notices in Yii3 you inject almost everything to controller actions
But this is cleaner than putting full class


public function actionCreate(AccessCheckerInterface $accessChecker): ResponseInterface
{
    $userId = getUserId();

    if ($accessChecker->userHasPermission($userId, 'createPost')) {
        // author has permission to create post
    }
}
5

Yeah, but to inject the same thing in every controller in the entire code-base sounds like repetition…

6

You can use DI container to get the thing. I have not jumped the Yii3 ship yet but this or something similar should work:

public function actionCreate(Yiisoft\Di\Container $container): ResponseInterface
{
    $accessChecker = $container->get(AccessCheckerInterface::class);
    $userId = getUserId();

    if ($accessChecker->userHasPermission($userId, 'createPost')) {
        // author has permission to create post
    }
}
1 Like
7

True! Still, would be nice to see a concept using the new PHP attributes ^^ Maybe not too hard to make.

8

I saw them being heavily used. I’m just not yet conversant with Yii3 and am exploring it.
May someone knowledgeable like @samdark or @Bizley or @sammousa can explain it better than I can!

9

What about using the filters? I’m not sure about Yii 3 because I’m not working on it but with Yii 2 it’s doable with auth filter.

10

Just came to my mind. What about injecting it in the ctor of the class and then access it like a property?

<?php

class YourController
{
    private AccessCheckerInterface $accessChecker;

    public function __construct(AccessCheckerInterface $accessChecker)
    {
        $this->accessChecker = $accessChecker;
    }

    public function actionCreate(): ResponseInterface
    {
        $userId = getUserId();

        if ($this->accessChecker->userHasPermission($userId, 'createPost')) {
            // author has permission to create post
        }
    }
}
11

Or even better make a trait with that ctor and just use it in multiple classes?

12

Yeah, trait would look a bit like our current code, I guess, where we access static function on a permission class.

13

No filters in Yii 3, afaik.

14

In Yii3 these are represented by middleware.

1 Like
15

Since many of us might get back to this when we jump into Yii3, can you explain a little bit may be with pseudo example on how this should be done?

16

Something like this:

final class CheckAcess
{
    public function __construct(
        private CurrentUser $currentUser,
        private ResponseFactoryInterface $responseFactory
    )
    {
    }

    public function process(ServerRequestInterface $request, RequestHandlerInterface $next): ResponseInterface
    {
        if (!$this->currentUser->can('my_permission')) {
             return $this->responseFactory->createResponse(403);
        }

       return $next->handle($request);
    }   
}

Route::get('/account')->([AccountController::class, 'account'])
        ->name('account/view')
        ->addMiddleware(CheckAccess::class)
3 Likes
17

Or it could be done in the action itself:

final class AccountController
{
    public function __construct(
        private CurrentUser $currentUser,
        private ResponseFactoryInterface $responseFactory
    )
    {
    }

    public function account()
    {
        if (!$this->currentUser->can('my_permission')) {
             return $this->responseFactory->createResponse(403);
        }

        // ...
    }
}
1 Like
18

I assume $this->currentUser->can('my_permission') is the same as Yii2 Yii::$app->user->can('my_permission')
I also assume you need RBAC for it to work correctly

Are my assumptions correct?

19

Yes, you are correct.

1 Like
20

Yes, here’s where attributes could be useful, perhaps?

    #[UserHasPermission("edit")]
    public function account(int $domainId)
    {
    }

Or maybe not, since we often want to check permission vis-à-vis a domain entity ID. Hm.