njasm
commented
6 years ago @MarcoDuizer it depends on your requirements.
What you talking here is not really about authorization but more like Data filtering with this in mind one simple solution is to add a method to your ModelQueryobject and change all your queries on that model and search methods (for grids).
Example 1:
// ModelQuery.php
public function creator()
{
$this->andWhere(['UserID' => Yii::$app->getUser()->getId()]);
return this;
} //code on other places of your application
$values = Model::find()->creator()->where(...)->all();Would suffice according to your post, but let me tell you that in a real world application, this implementation is very naive and will not get you far.
In a real world app, you probably have Teams, and a Team Leader, or Director that must be allowed to see and possible update all the Modelrecords created by an element of his team.
And here, you'll probably better if you jump start with RBAC plus Rules. read about RBAC Rules, those are like business specifications or constraints : http://www.yiiframework.com/doc-2.0/yii-rbac-rule.html
MarcoDuizer
yii-bot
I have an application where users can create their event online. then they can plan the event and do all kind of things with it. The requirement is that only the user that created the event (and user id is stored in the event record) can see their event and edit and delete it. I use RBAC in de DB version with the (mdmsoft/yii2-admin) extension to deny access to all controllers (only not the site controller that handles the anonymous part of the website). But that doesn't help for the access to their own data security. Is it best practice to implement the filtering of the data in the Model definition so all controllers will always get data that the user is allowed to see? Or is it better to use rules from RBAC and implement it at controller level? I tried to get rules in the DB to work but i could get a rule in the database. Followed the documentation but even with that step by step i cant get it to work.
So bottom line, what is best practice with yii 2.0 to let users only see their own data for a specific model?