Rbac And Using Default Roles

Yii 2.0 General Discussions
1

I’ve been trying to get default Roles setup following the example laid out in github.com/yiisoft/yii2/blob/master/docs/guide/authorization.md#using-default-roles and I am running into a bit of trouble.

The code itself is clear enough, I’ve created my UserGroupRule, but the docs don’t specify the file layout for this. If I put my roles in @app/data/rbac.php, the PhpManager tries to overwite that file when it adds its rules and throws a permission denied error when trying to write it. It trying to overwrite itself is a Bad Thing.

Where should this code go? If I put the rules in a console controller, where would I declare my UserGroupRule so Yii finds it?

Everything else seems to be going quite well with Yii2, I’m just hitting this one stumbling block.

2

You shouldn’t be touching @app/data/rbac.php at all unless you know what you’re doing.

Definitely use a console controller to put the code, but the actual UserGroupRule looks like it should go into @app/rbac/UserGroupRule.php (following the namespace).

After you run it, your rbac.php file should look something like this:




// @app/data/rbac.php

<?php

return array (

  'items' => 

  array (

    'author' => 

    array (

      'type' => 1,

      'ruleName' => 'userGroup',

    ),

    'admin' => 

    array (

      'type' => 1,

      'ruleName' => 'userGroup',

      'children' => 

      array (

        0 => 'author',

      ),

    ),

  ),

  'rules' => 

  array (

    'userGroup' => 'O:22:"app\\rbac\\UserGroupRule":3:{s:4:"name";s:9:"userGroup";s:9:"createdAt";N;s:9:"updatedAt";N;}',

  ),

);
3

Thanks!

With a bit of trial and error, that got me there. There are a few issues with the advanced application structure, though.

In order to get this to work, I had to create an rbac directory in both the console and frontend directories, and put my UserGroupRole.php class file in both locations. After running the console application to create my rules, I had to then copy the console/data/rbac.php file to frontend/data/rbac.php before it would recognize it.

I would have hoped that I could have used common/rbac/UserGroupRole.php for the UserGroupRule class and common/data/rbac.php for the actual generated rules. I don’t know if this is by design or not.

It is working exactly the way I want it to, though, so I’m happy.

Thanks again.