README

this package provide a component, filters and other helpers that can be used to check if current yii user has access to the current (or given) route.

The base concept of route permission checks is inspired by the AccessBehaviorTrait from within the dmstr/web package.

Differences:

one package, one job
Modularization of the underlying logic and config so that it can be configured for the whole app and easily used as an access filter, in an RBAC rule, or wherever else it may be needed.
ensures a consistent, but still configurable app wide check component via DI-container
prefix option for the checked RBAC permissions to avoid possible name collisions (check to module route user will be true if the user has "any" user rbac item assigned)

configuration

The package has a yii Bootstrapping class which ensure a valid RouteAccessCheckComponentInterface DI definition in Yii::$container

The default definition is:

  Yii::$container->setSingleton(
      RouteAccessCheckComponentInterface::class,
      RouteAccessCheck::class
  );

To change the defaults, set container definition for RouteAccessCheckComponentInterface in app config:

    'container'    => [
        'singletons' => [
            \handcode\routeAccessCheck\interfaces\RouteAccessCheckComponentInterface::class => [
                'routePermissionPrefix' => 'custom',
            ]
        ]
    ],

As you can see, if you just want to redefine properties like 'routePermissionPrefix' but not the default implementation of the RouteAccessCheck component, you must not define the concrete class for the component here, even if yii will then initialize the interface class itself, which will be invalidConfig.

The Bootstrap class will ensure a valid class definition with the default.

For component config with example see components\RouteAccessCheck

classes and usage of this package

helpers\RouteAccess

This helper class provide a simple way to get an instance of the defined RouteAccessCheckComponentInterface

usage:

    # ......
    try  {
        return RouteAccess::getInstance()->check($route);
    } catch (InvalidConfigException $e) {
        \Yii::error($e->getMessage());
    }
    # ......

interfaces/RouteAccessCheckComponentInterface

Beside that this interface ensures api of a RouteAccessCheckComponent, it is also used to get the instance of the component via Yii::$container.

components\RouteAccessCheck

The class is the default implementation of RouteAccessCheckComponentInterface with the "real" check.

It is implemented as yii component, to be able to configure the naming conventions for the rbac permissions that are checked for routeAccess (levels) throughout the app regardless if the checks are done in the RouteAccessControl filter or in any other place in the app.

Therefor it provides properties which can be used to configure the route permission naming convention for the app via DI-Container.

Example:

route: 'user/admin/role/index'

Component config properties (with default values)

RouteAccessCheck::routePartSeparator = '_'
RouteAccessCheck::routePermissionPrefix = ['route', 'access']

checked permissions:

'route_access_user'
'route_access_user_admin'
'route_access_user_admin_role'
'route_access_user_admin_role_index'

filters\RouteAccessControl

This is an AccessControl filter that can be used within modules or controllers to restrict access to given or current app route.

It will use check() method of the component returned from RouteAccess::getInstance()

Example to add this filter to a user module class to restrict all controller->actions of the module except the login & logout actions of the security controller

    public function behaviors()
    {
        return ArrayHelper::merge(
            parent::behaviors(),
            [
                'routeAccessControl' => [
                    'class' => \handcode\routeAccessCheck\filters\RouteAccessControl::class,
                    'except' => ['security/login', 'security/logout'],
                ],
            ]
        );
    }

handcode / yii2-route-access-check

Package info

Security

Statistics