CakePHP 3.x Acl Manager

Installation

Composer

You can install this plugin into your CakePHP application using composer.

The recommended way to install composer packages is:

composer require ivanamat/cakephp3-aclmanager

Git submodule

git submodule add git@github.com:ivanamat/cakephp3-aclmanager.git plugins/AclManager
git submodule init
git submodule update

Manual installation

Download the .zip or .tar.gz file, unzip and rename the plugin folder "cakephp3-aclmanager" to "AclManager" then copy the folder to your plugins folder.

Download release

Getting started

Install the CakePHP ACL plugin by running composer require cakephp/acl. Read Acl plugin documentation.
Set AclManager configuration. AclManager.aros. Must be specified before load plugin.
Load the Acl and AclManager plugins in app/config/bootstrap.php.

# Example configuration for an schema based on Groups, Roles and Users
Configure::write('AclManager.aros', array('Groups', 'Roles', 'Users'));

Plugin::load('Acl', ['bootstrap' => true]);
Plugin::load('AclManager', ['bootstrap' => true, 'routes' => true]);

Warning: It is not recommended to use Plugin::loadAll();. if you use Plugin::loadAll(); make sure it will not load any plugin several times with Plugin::load('PluginName').

Configuration parameters

Must be specified before load plugin.

AclManager.aros Required. Sets the AROs to be used. The value of this parameter must be an array with the names of the AROs to be used.

# Example configuration for an schema based on Groups, Roles and Users
Configure::write('AclManager.aros', array('Groups', 'Roles', 'Users'));

AclManager.admin Optional. Set 'admin' prefix. The value of this parameter must be boolean.

# Set prefix admin ( http://www.domain.com/admin/AclManager )
Configure::write('AclManager.admin', true);

AclManager.hideDenied Hide plugins, controllers and actions denied in ACLs lists.
```
Configure::write('AclManager.hideDenied', true);
```

AclManager.ignoreActions Ignore all plugins, controllers and actions you don't want to add to your ACLs. The value of this parameter must be an array.

# Ecample:
Configure::write('AclManager.ignoreActions', array(
    'actionName', // ignore action
    'Plugin.*', // Ignore the plugin
    'Plugin.Controller/*', // Ignore the plugin controller
    'Plugin.Controller/Action', // Ignore specific action from the plugin.
    'Error/*' // Ignore the controller
    'Error/Action' // Ignore specifc action from controller
));

Creating ACL tables

To create ACL related tables, run the following Migrations command.

bin/cake migrations migrate -p Acl

Example schema

An example schema based on Groups, Roles and Users.

    CREATE TABLE `groups` (
        `id` int(11) NOT NULL AUTO_INCREMENT,
        `name` varchar(100) COLLATE utf8_unicode_ci NOT NULL,
        `created` datetime DEFAULT NULL,
        `modified` datetime DEFAULT NULL,
        PRIMARY KEY (`id`)
    ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

    CREATE TABLE `roles` (
        `id` int(11) NOT NULL AUTO_INCREMENT,
        `group_id` int(11) DEFAULT NULL,
        `name` varchar(100) COLLATE utf8_unicode_ci NOT NULL,
        `created` datetime DEFAULT NULL,
        `modified` datetime DEFAULT NULL,
        PRIMARY KEY (`id`)
    ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

    CREATE TABLE `users` (
        `id` int(11) NOT NULL AUTO_INCREMENT,
        `group_id` int(11) NOT NULL,
        `role_id` int(11) NOT NULL,
        `username` varchar(50) COLLATE utf8_unicode_ci NOT NULL,
        `password` char(255) COLLATE utf8_unicode_ci NOT NULL,
        `email` varchar(255) COLLATE utf8_unicode_ci NOT NULL,
        `created` datetime DEFAULT NULL,
        `modified` datetime DEFAULT NULL,
        PRIMARY KEY (`id`),
        UNIQUE KEY `username` (`username`),
        UNIQUE KEY `email` (`email`)
    ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

Auth

Include and configure the AuthComponent and the AclComponent in the AppController.

    public $components = [
        'Acl' => [
            'className' => 'Acl.Acl'
        ]
    ];

    $this->loadComponent('Auth', [
        'authorize' => [
            'Acl.Actions' => ['actionPath' => 'controllers/']
        ],
        'loginAction' => [
            'plugin' => false,
            'controller' => 'Users',
            'action' => 'login'
        ],
        'loginRedirect' => [
            'plugin' => false,
            'controller' => 'Posts',
            'action' => 'index'
        ],
        'logoutRedirect' => [
            'plugin' => false,
            'controller' => 'Pages',
            'action' => 'display'
        ],
        'unauthorizedRedirect' => [
            'plugin' => false,
            'controller' => 'Users',
            'action' => 'login',
            'prefix' => false
        ],
        'authError' => 'You are not authorized to access that location.',
        'flash' => [
            'element' => 'error'
        ]
    ]);

Model Setup

Acting as a requester

Add $this->addBehavior('Acl.Acl', ['type' => 'requester']); to the initialize function in the files src/Model/Table/GroupsTable.php, src/Model/Table/RolesTable.php and src/Model/Table/UsersTable.php.

    public function initialize(array $config) {
        parent::initialize($config);

        $this->addBehavior('Acl.Acl', ['type' => 'requester']);
    }

Implement parentNode function in Group entity

Add the following implementation of parentNode to the file src/Model/Entity/Group.php.

    public function parentNode()
    {
        return null;
    }

Implement parentNode function in Role entity

Add the following implementation of parentNode to the file src/Model/Entity/Role.php.

    public function parentNode() {
        if (!$this->id) {
            return null;
        }
        if (isset($this->group_id)) {
            $groupId = $this->group_id;
        } else {
            $Users = TableRegistry::get('Users');
            $user = $Users->find('all', ['fields' => ['group_id']])->where(['id' => $this->id])->first();
            $groupId = $user->group_id;
        }
        if (!$groupId) {
            return null;
        }
        return ['Groups' => ['id' => $groupId]];
    }

Implement parentNode function in User entity

Add the following implementation of parentNode to the file src/Model/Entity/User.php.

    public function parentNode() {
        if (!$this->id) {
            return null;
        }
        if (isset($this->role_id)) {
            $roleId = $this->role_id;
        } else {
            $Users = TableRegistry::get('Users');
            $user = $Users->find('all', ['fields' => ['role_id']])->where(['id' => $this->id])->first();
            $roleId = $user->role_id;
        }
        if (!$roleId) {
            return null;
        }
        return ['Roles' => ['id' => $roleId]];
    }

Create a group, role, and user.

Allow all. Add in AppController.php.

public function initialize() {
    parent::initialize();

    ...
    $this->Auth->allow();
}

Now create a group, role, and user.

Access the plugin

Now navigate to http://www.domain.com/AclManager ( or http://www.domain.com/admin/AclManager If AclManager.admin is set to true ), just click "Update ACOs and AROs and set default values", after update ACOs and AROs, remove $this->Auth->allow() from AppController.php and enjoy!

Known issues

Not known.

Changelog

v1.3

Added

AclManager.hideDenied Hide plugins, controllers and actions denied in ACLs lists.

Changed

AclManager.ignoreActions Ignore all plugins, controllers and actions you don't want to add to your ACLs.

Configure::write('AclManager.ignoreActions', array(
    'actionName', // ignore action
    'Plugin.*', // Ignore the plugin
    'Plugin.Controller/*', // Ignore the plugin controller
    'Plugin.Controller/Action', // Ignore specific action from the plugin
    'Error/*' // Ignore the controller
    'Error/Action' // Ignore specifc action from controller
));

Updated indexctp and permissioins.ctp: Show or hide ACLs that do not have permissions in the ACL list. Show flash messages below the actions panel.
Fixed acoUpdate syncronization.

About CakePHP 3.x Acl Manager

CakePHP 3.x - AclManager is a single plugin for manage CakePHP 3.x ACLs, based on the original idea of Frédéric Massart (FMCorz) for CakePHP 2.x.

This project will be deprecated in favor of CakePHP 4.x - AclManager.

All code will be moved to the repository https://github.com/ivanamat/cakephp-aclmanager in order to continue future versions.

Author

Iván Amat on GitHub
www.ivanamat.es

Licensed

MIT License

ivanamat / cakephp3-aclmanager

readme