zendframework / zend-expressive-authorization-acl

zend-acl adapter for zend-expressive-authorization-acl
BSD 3-Clause "New" or "Revised" License
9 stars 8 forks source link

Documentation of inheritance is incorrect #23

Closed weierophinney closed 5 years ago

weierophinney commented 5 years ago

Per a conversation with a user in Slack, I was pointed to the example ACL in the documentation, which reads:

// config/autoload/authorization.local.php
return [
    // ...
    'zend-expressive-authorization-acl' => [
        'roles' => [
            'administrator' => [],
            'editor'        => ['administrator'],
            'contributor'   => ['editor'],
        ],
        'resources' => [
            'admin.dashboard',
            'admin.posts',
            'admin.publish',
            'admin.settings'
        ],
        'allow' => [
            'administrator' => ['admin.settings'],
            'contributor' => [
                'admin.dashboard',
                'admin.posts',
            ],
            'editor' => [
                'admin.publish'
            ]
        ]
    ]
];

and has the following note:

> In ACL systems, parent roles inherit the permissions of their children.

While the note is correct, the sample ACL sets up the wrong relationships, indicating that the value associated with a role is the list of parent roles, when it is actually the list of child roles.

In order to have the documented behavior, the example should read:

return [
    'zend-expressive-authorization-acl' => [
        'roles' => [
            'contributor'   => [],
            'editor'        => ['contributor'],
            'administrator' => ['editor'],
        ],
        'resources' => [
            'admin.dashboard',
            'admin.posts',
            'admin.publish',
            'admin.settings',
        ],
        'allow' => [
            'administrator' => ['admin.settings'],
            'contributor' => [
                'admin.dashboard',
                'admin.posts',
            ],
            'editor' => [
                'admin.publish',
            ],
        ],
    ],
];

(Both myself and the reporter on Slack have verified the behavior.)