library acl {🖫 2,707, ⚐ 19, ★ 101}

myclabs/acl

ACL library for Doctrine

Sunday, October 4, 2015
by mnapoli
Repository
9 Watchers
101 Stars
2,707 Installations

PHP
0 Dependents
0 Suggesters
10 Forks
3 Open issues
19 Versions
27 % Grown

The README.md

currentMenu: introduction

MyCLabs ACL is a library that helps managing permissions on your model., _(*1)

, _(*2)

It is different from other ACL libraries in that it focuses on controlling access to your model classes (Doctrine entities). As such, you access control model follows your real model, which makes it possible to have access in cascade easily (e.g. if you can access a category, you can also access all the sub-categories it contains)., _(*3)

It is also optimized as much as possible: authorizations are stored in database in a way to allow very efficient filtering at the SQL level through Doctrine queries (you can load only the objects a user can access). No other ACL system that we know of allows this., _(*4)

Requirements:, _(*5)

PHP 5.4
Use Doctrine as the ORM for your model
Doctrine 2.5 (currently in beta)

Vocabulary:, _(*6)

Security identity: the entity which will be granted some access (this is generally the user)
Resource: a thing to which we want to control the access
Authorization: allows a security identity (user) to do something on a resource
Role: a role gives authorizations to a user (e.g. an administrator, an article editor, a project owner, …)

There are 2 kinds of resources:, _(*7)

an entity (example: article #123)
all entities of a given type (example: all articles), which is represented by the classname of the entity

Overview

We hate being lost and confused, so everything you have to do with ACL is done on the ACL service. You can start by creating it:, _(*8)

// full configuration shown in the documentation
$acl = new ACL($entityManager);

You give permissions to a user by adding it a role:, _(*9)

$acl->grant($user, new ArticleEditorRole($user, $article));

Roles are classes that you write and which define the permissions a user has on a resource., _(*10)

You remove permissions to a user by removing the role:, _(*11)

$acl->revoke($user, $role);

Test permissions:, _(*12)

$acl->isAllowed($user, Actions::EDIT, $article);

You can also filter your queries to get only the entities the user has access to:, _(*13)

$qb = $entityManager->createQueryBuilder();
$qb->select('article')->from('Model\Article', 'article');

ACLQueryHelper::joinACL($qb, $user, Actions::EDIT);

// This query will return only the articles the user can edit
$articles = $qb->getQuery()->getResult();

Features

stored in database (you don't need to handle persistence yourself)
extremely optimized:
- filters queries at database level (you don't load entities the user can't access)
- joins with only 1 extra table
- bypasses Doctrine's ORM to insert authorizations in database (fast and efficient)
- cascade delete at database level
authorization cascading/inheritance
authorizations are rebuildable: you can change what an "ArticleEditor" can do afterwards and just rebuild the ACL
supports your custom actions on top of standard actions like "view", "edit", "delete", …

Limitations

because of Doctrine limitations you need to flush your resources before giving or testing authorizations
backed up by the database: testing isAllowed means one call to the database

The Versions

04/10 2015

dev-master

9999999-dev https://github.com/myclabs/ACL

ACL library for Doctrine

library acl

ACL library for Doctrine

myclabs/acl

The README.md

currentMenu: introduction

Overview

Features

Limitations

The Versions

dev-master

The Requires

1.2

The Requires

dev-RebuildResouceAuthorizations

The Requires

dev-SimplifiedRoles

The Requires

The Development Requires

dev-feature/backend-agnostic

The Requires

The Development Requires

1.1.5

The Requires

1.1.4

The Requires

1.1.3

The Requires

1.1.2

The Requires

1.1.1

The Requires

1.1.0

The Requires

1.0.0

The Requires

0.4.2

The Requires

0.4.1

The Requires

0.4.0

The Requires

0.3.1

The Requires

0.3.0

The Requires

0.2.0

The Requires

0.1.0

The Requires