You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+33-20
Original file line number
Diff line number
Diff line change
@@ -1,35 +1,40 @@
1
1
# dot-rbac
2
2
3
-
Rbac authorization model implements [dot-authorization](https://github.com/dotkernel/dot-authorization)'s `AuthorizationInterface`. An authorization service is responsible for deciding if the authenticated identity or guest has access to certain parts of the application.
3
+
Rbac authorization model implements [dot-authorization](https://github.com/dotkernel/dot-authorization)'s `AuthorizationInterface`.
4
+
An authorization service is responsible for deciding if the authenticated identity or guest has access to certain parts of the application.
4
5
5
-
The RBAC model defines roles that can be assigned to users. The authorization is done on a role basis, not user basis as in ACL. Each role can have one or multiple permissions/privileges assigned. When deciding if a user is authorized, the requested permission is checked in all user roles and if at least one role has that permission, access is granted.
6
+
The RBAC model defines roles that can be assigned to users.
7
+
The authorization is done on a role basis, not user basis as in ACL.
8
+
Each role can have one or multiple permissions/privileges assigned.
9
+
When deciding if a user is authorized, the requested permission is checked in all user roles and if at least one role has that permission, access is granted.
Run the following command in your project root directory
24
+
Run the following command in your project root directory:
23
25
24
-
```bash
25
-
$ composer require dotkernel/dot-rbac
26
+
```shell
27
+
composer require dotkernel/dot-rbac
26
28
```
27
29
28
30
## Configuration
29
31
30
-
Even if the authorization service can be programmatically configured, we recommend using the configuration based approach. We further describe how to configure the module, using configuration file.
32
+
Even if the authorization service can be programmatically configured, we recommend using the configuration based approach.
33
+
We further describe how to configure the module, using configuration file.
31
34
32
-
First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. This ensures that all dependencies required by this module are registered in the service manager. It also defines default config values for this module.
35
+
First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config.
36
+
This ensures that all dependencies required by this module are registered in the service manager.
37
+
It also defines default config values for this module.
33
38
34
39
Create a configuration file in your `config/autoload` folder and change the module options as needed.
35
40
@@ -101,19 +106,21 @@ Create a configuration file in your `config/autoload` folder and change the modu
101
106
102
107
## Usage
103
108
104
-
Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters. There are 2 ways to call the isGranted method.
109
+
Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters.
Whenever you request an authorization check on the authenticated identity, the identity will be provided to the `AuthorizationService` through a registered `IdentityProviderInterface` service.
125
132
126
-
This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs. If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface.
133
+
This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs.
134
+
If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface.
127
135
128
136
## Custom role providers
129
137
130
-
Write your own role provider by implementing the `RoleProviderInterface` and register it in the `RoleProviderPluginManager`. After that, you can use them in the configuration file, as described above.
138
+
Write your own role provider by implementing the `RoleProviderInterface` and register it in the `RoleProviderPluginManager`.
139
+
After that, you can use them in the configuration file, as described above.
131
140
132
141
## Creating assertions
133
142
134
-
Assertions are checked after permission granting, right before returning the authorization result. Assertions can have a last word in deciding if someone is authorized for the requested action. A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`. It is up to you to write the logic inside an assertion.
143
+
Assertions are checked after permission granting, right before returning the authorization result.
144
+
Assertions can have a last word in deciding if someone is authorized for the requested action.
145
+
A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`.
146
+
It is up to you to write the logic inside an assertion.
135
147
136
148
An assertion has to implement the `AssertionInterface` and be registered in the `AssertionPluginManager`.
137
149
@@ -141,4 +153,5 @@ This interface defines the following method
141
153
public function assert(AuthorizationInterface $authorization, $context = null);
142
154
```
143
155
144
-
The context variable can be any external data that an assertion needs in order to decide the authorization status. The assertion must return a boolean value, reflecting the assertion pass or failure status.
156
+
The context variable can be any external data that an assertion needs in order to decide the authorization status.
157
+
The assertion must return a boolean value, reflecting the assertion pass or failure status.
Copy file name to clipboardExpand all lines: docs/book/v3/configuration.md
+3-1
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,9 @@
3
3
Even if the authorization service can be programmatically configured, we recommend using the configuration based approach.
4
4
We further describe how to configure the module, using the configuration file.
5
5
6
-
First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. This ensures that all dependencies required by this module are registered in the service manager. It also defines default config values for this module.
6
+
First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config.
7
+
This ensures that all dependencies required by this module are registered in the service manager.
8
+
It also defines default config values for this module.
7
9
8
10
Create a configuration file in your `config/autoload` folder and change the module options as needed.
Copy file name to clipboardExpand all lines: docs/book/v3/customization.md
+10-4
Original file line number
Diff line number
Diff line change
@@ -4,15 +4,20 @@
4
4
5
5
Whenever you request an authorization check on the authenticated identity, the identity will be provided to the `AuthorizationService` through a registered `IdentityProviderInterface` service.
6
6
7
-
This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs. If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface.
7
+
This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs.
8
+
If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface.
8
9
9
10
## Custom role providers
10
11
11
-
Write your own role provider by implementing the `RoleProviderInterface` and register it in the `RoleProviderPluginManager`. After that, you can use them in the configuration file, as described above.
12
+
Write your own role provider by implementing the `RoleProviderInterface` and register it in the `RoleProviderPluginManager`.
13
+
After that, you can use them in the configuration file, as described above.
12
14
13
15
## Creating assertions
14
16
15
-
Assertions are checked after permission granting, right before returning the authorization result. Assertions can have a last word in deciding if someone is authorized for the requested action. A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`. It is up to you to write the logic inside an assertion.
17
+
Assertions are checked after permission granting, right before returning the authorization result.
18
+
Assertions can have a last word in deciding if someone is authorized for the requested action.
19
+
A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`.
20
+
It is up to you to write the logic inside an assertion.
16
21
17
22
An assertion has to implement the `AssertionInterface` and be registered in the `AssertionPluginManager`.
18
23
@@ -22,4 +27,5 @@ This interface defines the following method
22
27
public function assert(AuthorizationInterface $authorization, $context = null);
23
28
```
24
29
25
-
The context variable can be any external data that an assertion needs in order to decide the authorization status. The assertion must return a boolean value, reflecting the assertion pass or failure status.
30
+
The context variable can be any external data that an assertion needs in order to decide the authorization status.
31
+
The assertion must return a boolean value, reflecting the assertion pass or failure status.
Copy file name to clipboardExpand all lines: docs/book/v3/usage.md
+4-3
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,17 @@
1
1
# Usage
2
2
3
-
Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters. There are 2 ways to call the isGranted method.
3
+
Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters.
0 commit comments