diff --git a/404.html b/404.html index 68674b9..1c7f0c7 100644 --- a/404.html +++ b/404.html @@ -9,7 +9,7 @@ - + diff --git a/assets/js/22465cd7.92e3d51b.js b/assets/js/22465cd7.92e3d51b.js deleted file mode 100644 index cc9c695..0000000 --- a/assets/js/22465cd7.92e3d51b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[166],{6066:(e,r,o)=>{o.r(r),o.d(r,{assets:()=>s,contentTitle:()=>t,default:()=>p,frontMatter:()=>c,metadata:()=>l,toc:()=>a});var n=o(4848),i=o(8453);const c={sidebar_label:"Role providers",title:"Role providers",sidebar_position:4},t=void 0,l={id:"role-providers",title:"Role providers",description:"A role provider is an object that returns a list of roles. A role provider must implement the",source:"@site/docs/role-providers.md",sourceDirName:".",slug:"/role-providers",permalink:"/LmcRbac/docs/role-providers",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/role-providers.md",tags:[],version:"current",sidebarPosition:4,frontMatter:{sidebar_label:"Role providers",title:"Role providers",sidebar_position:4},sidebar:"documentationSidebar",previous:{title:"Quick start",permalink:"/LmcRbac/docs/quickstart"},next:{title:"Authorization service",permalink:"/LmcRbac/docs/authorization-service"}},s={},a=[{value:"Built-in role providers",id:"built-in-role-providers",level:2},{value:"LmcRbac\\Role\\InMemoryRoleProvider",id:"lmcrbacroleinmemoryroleprovider",level:3},{value:"LmcRbac\\Role\\ObjectRepositoryRoleProvider",id:"lmcrbacroleobjectrepositoryroleprovider",level:3},{value:"Creating custom role providers",id:"creating-custom-role-providers",level:2}];function d(e){const r={code:"code",h2:"h2",h3:"h3",p:"p",pre:"pre",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(r.p,{children:["A role provider is an object that returns a list of roles. A role provider must implement the\n",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleProviderInterface"})," interface. The only required method is ",(0,n.jsx)(r.code,{children:"getRoles"}),", and must return an array\nof ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleInterface"})," objects."]}),"\n",(0,n.jsx)(r.p,{children:"Roles can come from one of many sources: in memory, from a file, from a database, etc. However, you can specify only one role provider per application."}),"\n",(0,n.jsx)(r.h2,{id:"built-in-role-providers",children:"Built-in role providers"}),"\n",(0,n.jsxs)(r.p,{children:["LmcRbac comes with two built-in role providers: ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})," and ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\ObjectRepositoryRoleProvider"}),". A role\nprovider must be added to the ",(0,n.jsx)(r.code,{children:"role_provider"})," subkey in the configuration file:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n // Role provider config here!\n ]\n ]\n];\n"})}),"\n",(0,n.jsx)(r.h3,{id:"lmcrbacroleinmemoryroleprovider",children:(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})}),"\n",(0,n.jsx)(r.p,{children:"This provider is ideal for small/medium sites with few roles/permissions. All the data is specified in a simple associative array in a\nPHP file."}),"\n",(0,n.jsx)(r.p,{children:"Here is an example of the format you need to use:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'admin' => [\n 'children' => ['member'],\n 'permissions' => ['article.delete']\n ],\n 'member' => [\n 'children' => ['guest'],\n 'permissions' => ['article.edit', 'article.archive']\n ],\n 'guest' => [\n 'permissions' => ['article.read']\n ],\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["The ",(0,n.jsx)(r.code,{children:"children"})," and ",(0,n.jsx)(r.code,{children:"permissions"})," subkeys are entirely optional. Internally, the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})," creates\neither a ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\Role"})," object if the role does not have any children, or a ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\HierarchicalRole"})," if\nthe role has at least one child."]}),"\n",(0,n.jsx)(r.p,{children:"If you are more confident with flat RBAC, the previous config can be re-written to remove any inheritence between roles:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'admin' => [\n 'permissions' => [\n 'article.delete',\n 'article.edit',\n 'article.archive',\n 'article.read'\n ]\n ],\n 'member' => [\n 'permissions' => [\n 'article.edit',\n 'article.archive',\n 'article.read'\n ]\n ],\n 'guest' => [\n 'permissions' => ['article.read']\n ]\n ]\n ]\n ]\n];\n"})}),"\n",(0,n.jsx)(r.h3,{id:"lmcrbacroleobjectrepositoryroleprovider",children:(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\ObjectRepositoryRoleProvider"})}),"\n",(0,n.jsxs)(r.p,{children:["This provider fetches roles from a database using ",(0,n.jsx)(r.code,{children:"Doctrine\\Common\\Persistence\\ObjectRepository"})," interface."]}),"\n",(0,n.jsxs)(r.p,{children:["You can configure this provider by giving an object repository service name that is fetched from the service manager\nusing the ",(0,n.jsx)(r.code,{children:"object_repository"})," key:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\ObjectRepositoryRoleProvider' => [\n 'object_repository' => 'App\\Repository\\RoleRepository',\n 'role_name_property' => 'name'\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["Or you can specify the ",(0,n.jsx)(r.code,{children:"object_manager"})," and ",(0,n.jsx)(r.code,{children:"class_name"})," options:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\ObjectRepositoryRoleProvider' => [\n 'object_manager' => 'doctrine.entitymanager.orm_default',\n 'class_name' => 'App\\Entity\\Role',\n 'role_name_property' => 'name'\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["In both cases, you need to specify the ",(0,n.jsx)(r.code,{children:"role_name_property"})," value, which is the name of the entity's property\nthat holds the actual role name. This is used internally to only load the identity roles, instead of loading\nthe whole table every time."]}),"\n",(0,n.jsxs)(r.p,{children:["Please note that your entity fetched from the table MUST implement the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleInterface"})," interface."]}),"\n",(0,n.jsxs)(r.p,{children:["Sample ORM entity models are provided in the ",(0,n.jsx)(r.code,{children:"/data"})," folder for flat role, hierarchical role and permission."]}),"\n",(0,n.jsx)(r.h2,{id:"creating-custom-role-providers",children:"Creating custom role providers"}),"\n",(0,n.jsxs)(r.p,{children:["To create a custom role provider, you first need to create a class that implements the\n",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleProviderInterface"})," interface."]}),"\n",(0,n.jsx)(r.p,{children:"Then, you need to add it to the role provider manager:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'Application\\Role\\CustomRoleProvider' => [\n // Options\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsx)(r.p,{children:"And the role provider is created using the service manager:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'service_manager' => [\n 'factories' => [\n 'Application\\Role\\CustomRoleProvider' => 'Application\\Factory\\CustomRoleProviderFactory'\n ],\n ],\n];\n"})})]})}function p(e={}){const{wrapper:r}={...(0,i.R)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},8453:(e,r,o)=>{o.d(r,{R:()=>t,x:()=>l});var n=o(6540);const i={},c=n.createContext(i);function t(e){const r=n.useContext(c);return n.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:t(e.components),n.createElement(c.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/22465cd7.f4021b5a.js b/assets/js/22465cd7.f4021b5a.js new file mode 100644 index 0000000..0a53023 --- /dev/null +++ b/assets/js/22465cd7.f4021b5a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[166],{6066:(e,r,o)=>{o.r(r),o.d(r,{assets:()=>t,contentTitle:()=>s,default:()=>h,frontMatter:()=>l,metadata:()=>c,toc:()=>a});var n=o(4848),i=o(8453);const l={sidebar_label:"Roles and Role providers",title:"Roles and Role providers",sidebar_position:4},s=void 0,c={id:"role-providers",title:"Roles and Role providers",description:"Role types",source:"@site/docs/role-providers.md",sourceDirName:".",slug:"/role-providers",permalink:"/LmcRbac/docs/role-providers",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/role-providers.md",tags:[],version:"current",sidebarPosition:4,frontMatter:{sidebar_label:"Roles and Role providers",title:"Roles and Role providers",sidebar_position:4},sidebar:"documentationSidebar",previous:{title:"Quick start",permalink:"/LmcRbac/docs/quickstart"},next:{title:"Authorization service",permalink:"/LmcRbac/docs/authorization-service"}},t={},a=[{value:"Role types",id:"role-types",level:2},{value:"Flat roles",id:"flat-roles",level:3},{value:"Hierarchical roles",id:"hierarchical-roles",level:3},{value:"Role Providers",id:"role-providers",level:2},{value:"Built-in role providers",id:"built-in-role-providers",level:3},{value:"LmcRbac\\Role\\InMemoryRoleProvider",id:"lmcrbacroleinmemoryroleprovider",level:3},{value:"LmcRbac\\Role\\ObjectRepositoryRoleProvider",id:"lmcrbacroleobjectrepositoryroleprovider",level:3},{value:"Creating custom role providers",id:"creating-custom-role-providers",level:2}];function d(e){const r={code:"code",h2:"h2",h3:"h3",p:"p",pre:"pre",...(0,i.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(r.h2,{id:"role-types",children:"Role types"}),"\n",(0,n.jsx)(r.p,{children:"A role is an object that returns a list of permissions that the role has."}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.code,{children:"LmcRbac"})," support two types of roles: hierarchical roles and flat roles."]}),"\n",(0,n.jsx)(r.h3,{id:"flat-roles",children:"Flat roles"}),"\n",(0,n.jsx)(r.p,{children:"A flat role is the simplest role object. It contains the list of permissions that\nthe role has."}),"\n",(0,n.jsxs)(r.p,{children:["Flat roles are defined using by the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\Role"})," class or by classes\nimplementing the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleInterface"}),"."]}),"\n",(0,n.jsx)(r.h3,{id:"hierarchical-roles",children:"Hierarchical roles"}),"\n",(0,n.jsx)(r.p,{children:"A hierarchical role is a role that has child roles and therefore provides\na hierarchy of roles where a role inherit the permissions of all its child roles."}),"\n",(0,n.jsx)(r.p,{children:"For example, a 'user' role may have the 'read' and 'write' permissions, and a 'admin' role\nmay inherit the permissions of the 'user' role plus an additional 'delete' role. In this structure,\nthe 'admin' role will have 'user' as its child role."}),"\n",(0,n.jsx)(r.p,{children:"Hierarchical roles may have flat roles or hierarchical roles as children."}),"\n",(0,n.jsxs)(r.p,{children:["Hierarchical roles are defined using by the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\HierarchicalRole"})," class or by classes\nimplementing the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\HierarchicalRoleInterface"}),"."]}),"\n",(0,n.jsx)(r.h2,{id:"role-providers",children:"Role Providers"}),"\n",(0,n.jsxs)(r.p,{children:["A role provider is an object that returns a list of roles. A role provider must implement the\n",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleProviderInterface"})," interface. The only required method is ",(0,n.jsx)(r.code,{children:"getRoles"}),", and must return an array\nof ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleInterface"})," objects."]}),"\n",(0,n.jsx)(r.p,{children:"Roles can come from one of many sources: in memory, from a file, from a database, etc. However, you can specify only one role provider per application."}),"\n",(0,n.jsx)(r.h3,{id:"built-in-role-providers",children:"Built-in role providers"}),"\n",(0,n.jsxs)(r.p,{children:["LmcRbac comes with two built-in role providers: ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})," and ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\ObjectRepositoryRoleProvider"}),". A role\nprovider must be added to the ",(0,n.jsx)(r.code,{children:"role_provider"})," subkey in the configuration file:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n // Role provider config here!\n ]\n ]\n];\n"})}),"\n",(0,n.jsx)(r.h3,{id:"lmcrbacroleinmemoryroleprovider",children:(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})}),"\n",(0,n.jsx)(r.p,{children:"This provider is ideal for small/medium sites with few roles/permissions. All the data is specified in a simple associative array in a\nPHP file."}),"\n",(0,n.jsx)(r.p,{children:"Here is an example of the format you need to use:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'admin' => [\n 'children' => ['member'],\n 'permissions' => ['article.delete']\n ],\n 'member' => [\n 'children' => ['guest'],\n 'permissions' => ['article.edit', 'article.archive']\n ],\n 'guest' => [\n 'permissions' => ['article.read']\n ],\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["The ",(0,n.jsx)(r.code,{children:"children"})," and ",(0,n.jsx)(r.code,{children:"permissions"})," subkeys are entirely optional. Internally, the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\InMemoryRoleProvider"})," creates\neither a ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\Role"})," object if the role does not have any children, or a ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\HierarchicalRole"})," if\nthe role has at least one child."]}),"\n",(0,n.jsx)(r.p,{children:"If you are more confident with flat RBAC, the previous config can be re-written to remove any inheritence between roles:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'admin' => [\n 'permissions' => [\n 'article.delete',\n 'article.edit',\n 'article.archive',\n 'article.read'\n ]\n ],\n 'member' => [\n 'permissions' => [\n 'article.edit',\n 'article.archive',\n 'article.read'\n ]\n ],\n 'guest' => [\n 'permissions' => ['article.read']\n ]\n ]\n ]\n ]\n];\n"})}),"\n",(0,n.jsx)(r.h3,{id:"lmcrbacroleobjectrepositoryroleprovider",children:(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\ObjectRepositoryRoleProvider"})}),"\n",(0,n.jsxs)(r.p,{children:["This provider fetches roles from a database using ",(0,n.jsx)(r.code,{children:"Doctrine\\Common\\Persistence\\ObjectRepository"})," interface."]}),"\n",(0,n.jsxs)(r.p,{children:["You can configure this provider by giving an object repository service name that is fetched from the service manager\nusing the ",(0,n.jsx)(r.code,{children:"object_repository"})," key:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\ObjectRepositoryRoleProvider' => [\n 'object_repository' => 'App\\Repository\\RoleRepository',\n 'role_name_property' => 'name'\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["Or you can specify the ",(0,n.jsx)(r.code,{children:"object_manager"})," and ",(0,n.jsx)(r.code,{children:"class_name"})," options:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'LmcRbac\\Role\\ObjectRepositoryRoleProvider' => [\n 'object_manager' => 'doctrine.entitymanager.orm_default',\n 'class_name' => 'App\\Entity\\Role',\n 'role_name_property' => 'name'\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsxs)(r.p,{children:["In both cases, you need to specify the ",(0,n.jsx)(r.code,{children:"role_name_property"})," value, which is the name of the entity's property\nthat holds the actual role name. This is used internally to only load the identity roles, instead of loading\nthe whole table every time."]}),"\n",(0,n.jsxs)(r.p,{children:["Please note that your entity fetched from the table MUST implement the ",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleInterface"})," interface."]}),"\n",(0,n.jsxs)(r.p,{children:["Sample ORM entity models are provided in the ",(0,n.jsx)(r.code,{children:"/data"})," folder for flat role, hierarchical role and permission."]}),"\n",(0,n.jsx)(r.h2,{id:"creating-custom-role-providers",children:"Creating custom role providers"}),"\n",(0,n.jsxs)(r.p,{children:["To create a custom role provider, you first need to create a class that implements the\n",(0,n.jsx)(r.code,{children:"LmcRbac\\Role\\RoleProviderInterface"})," interface."]}),"\n",(0,n.jsx)(r.p,{children:"Then, you need to add it to the role provider manager:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'lmc_rbac' => [\n 'role_provider' => [\n 'Application\\Role\\CustomRoleProvider' => [\n // Options\n ],\n ],\n ],\n];\n"})}),"\n",(0,n.jsx)(r.p,{children:"And the role provider is created using the service manager:"}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-php",children:"return [\n 'service_manager' => [\n 'factories' => [\n 'Application\\Role\\CustomRoleProvider' => 'Application\\Factory\\CustomRoleProviderFactory'\n ],\n ],\n];\n"})})]})}function h(e={}){const{wrapper:r}={...(0,i.R)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},8453:(e,r,o)=>{o.d(r,{R:()=>s,x:()=>c});var n=o(6540);const i={},l=n.createContext(i);function s(e){const r=n.useContext(l);return n.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(l.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8070e160.0e398fca.js b/assets/js/8070e160.0e398fca.js new file mode 100644 index 0000000..4f79c00 --- /dev/null +++ b/assets/js/8070e160.0e398fca.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[822],{7495:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var s=i(4848),t=i(8453);const r={sidebar_label:"Quick start",sidebar_position:3,title:"Quick Start"},o=void 0,c={id:"quickstart",title:"Quick Start",description:"Once the library has been installed by Composer, you will need to copy the",source:"@site/docs/quickstart.md",sourceDirName:".",slug:"/quickstart",permalink:"/LmcRbac/docs/quickstart",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/quickstart.md",tags:[],version:"current",sidebarPosition:3,frontMatter:{sidebar_label:"Quick start",sidebar_position:3,title:"Quick Start"},sidebar:"documentationSidebar",previous:{title:"Concepts",permalink:"/LmcRbac/docs/concepts"},next:{title:"Roles and Role providers",permalink:"/LmcRbac/docs/role-providers"}},d={},a=[{value:"Defining roles",id:"defining-roles",level:2},{value:"Basic authorization",id:"basic-authorization",level:2},{value:"Using assertions",id:"using-assertions",level:2}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.R)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["Once the library has been installed by Composer, you will need to copy the\n",(0,s.jsx)(n.code,{children:"config/lmcrbac.global.php"})," file from ",(0,s.jsx)(n.code,{children:"LmcRbac"})," to the ",(0,s.jsx)(n.code,{children:"config/autoload"})," folder."]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["On older versions of ",(0,s.jsx)(n.code,{children:"LmcRbac"}),", the configuration file is named ",(0,s.jsx)(n.code,{children:"config/config.global.php"}),"."]})}),"\n",(0,s.jsx)(n.h2,{id:"defining-roles",children:"Defining roles"}),"\n",(0,s.jsx)(n.p,{children:"By default, no roles and no permissions are defined."}),"\n",(0,s.jsxs)(n.p,{children:["Roles and permissions are defined by a Role Provider. ",(0,s.jsx)(n.code,{children:"LmcRbac"})," ships with two roles providers:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["a simple ",(0,s.jsx)(n.code,{children:"InMemoryRoleProvider"})," that uses an associative array to define roles and their permission. This is the default."]}),"\n",(0,s.jsxs)(n.li,{children:["a ",(0,s.jsx)(n.code,{children:"ObjectRepositoyRoleProvider"})," that is based on Doctrine ORM."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["To quickly get started, let's use the ",(0,s.jsx)(n.code,{children:"InMemoryRoleProvider"})," role provider."]}),"\n",(0,s.jsxs)(n.p,{children:["In the ",(0,s.jsx)(n.code,{children:"config/autoload/lmcrbac.global.php"}),", add the following:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-php",children:" [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'guest',\n 'user' => [\n 'permissions' => ['create', 'edit'],\n ],\n 'admin' => [\n 'children' => ['user'],\n 'permissions' => ['delete'],\n ],\n ],\n ],\n ],\n];\n"})}),"\n",(0,s.jsxs)(n.p,{children:["This defines 3 roles: a ",(0,s.jsx)(n.code,{children:"guest"})," role, a ",(0,s.jsx)(n.code,{children:"user"})," role having 2 permissions, and a ",(0,s.jsx)(n.code,{children:"admin"})," role which has the ",(0,s.jsx)(n.code,{children:"user"})," role as\na child and with its own permission. If the hierarchy is flattened:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"guest"})," has no permission"]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"user"})," has permissions ",(0,s.jsx)(n.code,{children:"create"})," and ",(0,s.jsx)(n.code,{children:"edit"})]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"admin"})," has permissions ",(0,s.jsx)(n.code,{children:"create"}),", ",(0,s.jsx)(n.code,{children:"edit"})," and ",(0,s.jsx)(n.code,{children:"delete"})]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"basic-authorization",children:"Basic authorization"}),"\n",(0,s.jsx)(n.p,{children:"The authorization service can get retrieved from service manager container and used to check if a permission\nis granted to an identity:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-php",children:"get('\\LmcRbac\\Service\\AuthorizationServiceInterface');\n \n /** @var \\LmcRbac\\Identity\\IdentityInterface $identity */\n if ($authorizationService->isGranted($identity, 'create')) {\n /** do something */\n }\n"})}),"\n",(0,s.jsxs)(n.p,{children:["If ",(0,s.jsx)(n.code,{children:"$identity"})," has the role ",(0,s.jsx)(n.code,{children:"user"})," and/or ",(0,s.jsx)(n.code,{children:"admin"})," then the authorization is granted. If the identity has the role ",(0,s.jsx)(n.code,{children:"guest"}),", then authorization\nis denied."]}),"\n",(0,s.jsx)(n.admonition,{type:"info",children:(0,s.jsxs)(n.p,{children:["If ",(0,s.jsx)(n.code,{children:"$identity"})," is null (no identity), then the guest role is assumed which is set to ",(0,s.jsx)(n.code,{children:"'guest'"})," by default. The guest role\ncan be configured in the ",(0,s.jsx)(n.code,{children:"lmcrbac.config.php"})," file. More on this in the ",(0,s.jsx)(n.a,{href:"/LmcRbac/docs/configuration",children:"Configuration"})," section."]})}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.code,{children:"LmcRbac"})," does not provide any logic to instantiate an identity entity. It is assumed that\nthe application will instantiate an entity that implements ",(0,s.jsx)(n.code,{children:"\\LmcRbac\\Identity\\IdentityInterface"})," which defines the ",(0,s.jsx)(n.code,{children:"getRoles()"}),"\nmethod."]})}),"\n",(0,s.jsx)(n.h2,{id:"using-assertions",children:"Using assertions"}),"\n",(0,s.jsxs)(n.p,{children:["Even if an identity has the ",(0,s.jsx)(n.code,{children:"user"})," role granting it the ",(0,s.jsx)(n.code,{children:"edit"})," permission, it should not have the authorization to edit another identity's resource."]}),"\n",(0,s.jsx)(n.p,{children:"This can be achieved using dynamic assertion."}),"\n",(0,s.jsxs)(n.p,{children:["An assertion is a function that implements the ",(0,s.jsx)(n.code,{children:"\\LmcRbac\\Assertion\\AssertionInterface"})," and is configured in the configuration\nfile."]}),"\n",(0,s.jsxs)(n.p,{children:["Let's modify the ",(0,s.jsx)(n.code,{children:"lmcrbac.config.php"})," file as follows:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-php",children:" [\n 'role_provider' => [\n /* roles and permissions\n ],\n 'assertion_map' => [\n 'edit' => function ($permission, IdentityInterface $identity = null, $resource = null) {\n if ($resource->getOwnerId() === $identity->getId() {\n return true;\n } else {\n return false;\n }\n ],\n ],\n];\n"})}),"\n",(0,s.jsx)(n.p,{children:"Then use the authorization service passing the resource (called a 'context') in addition to the permission:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-php",children:"get('\\LmcRbac\\Service\\AuthorizationServiceInterface');\n \n /** @var \\LmcRbac\\Identity\\IdentityInterface $identity */\n if ($authorizationService->isGranted($identity, 'edit', $resource)) {\n /** do something */\n }\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Dynanmic assertions are further discussed in the ",(0,s.jsx)(n.a,{href:"assertions",children:"Dynamic Assertions"})," section."]})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},8453:(e,n,i)=>{i.d(n,{R:()=>o,x:()=>c});var s=i(6540);const t={},r=s.createContext(t);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8070e160.6fcd7787.js b/assets/js/8070e160.6fcd7787.js deleted file mode 100644 index 939b888..0000000 --- a/assets/js/8070e160.6fcd7787.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[822],{7495:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var t=i(4848),s=i(8453);const r={sidebar_label:"Quick start",sidebar_position:3,title:"Quick Start"},o=void 0,c={id:"quickstart",title:"Quick Start",description:"Once the library has been installed by Composer, you will need to copy the",source:"@site/docs/quickstart.md",sourceDirName:".",slug:"/quickstart",permalink:"/LmcRbac/docs/quickstart",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/quickstart.md",tags:[],version:"current",sidebarPosition:3,frontMatter:{sidebar_label:"Quick start",sidebar_position:3,title:"Quick Start"},sidebar:"documentationSidebar",previous:{title:"Concepts",permalink:"/LmcRbac/docs/concepts"},next:{title:"Role providers",permalink:"/LmcRbac/docs/role-providers"}},d={},a=[{value:"Defining roles",id:"defining-roles",level:2},{value:"Basic authorization",id:"basic-authorization",level:2},{value:"Using assertions",id:"using-assertions",level:2}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsxs)(n.p,{children:["Once the library has been installed by Composer, you will need to copy the\n",(0,t.jsx)(n.code,{children:"config/lmcrbac.global.php"})," file from ",(0,t.jsx)(n.code,{children:"LmcRbac"})," to the ",(0,t.jsx)(n.code,{children:"config/autoload"})," folder."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsxs)(n.p,{children:["On older versions of ",(0,t.jsx)(n.code,{children:"LmcRbac"}),", the configuration file is named ",(0,t.jsx)(n.code,{children:"config/config.global.php"}),"."]})}),"\n",(0,t.jsx)(n.h2,{id:"defining-roles",children:"Defining roles"}),"\n",(0,t.jsx)(n.p,{children:"By default, no roles and no permissions are defined."}),"\n",(0,t.jsxs)(n.p,{children:["Roles and permissions are defined by a Role Provider. ",(0,t.jsx)(n.code,{children:"LmcRbac"})," ships with two roles providers:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["a simple ",(0,t.jsx)(n.code,{children:"InMemoryRoleProvider"})," that uses an associative array to define roles and their permission. This is the default."]}),"\n",(0,t.jsxs)(n.li,{children:["a ",(0,t.jsx)(n.code,{children:"ObjectRepositoyRoleProvider"})," that is based on Doctrine ORM."]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["To quickly get started, let's use the ",(0,t.jsx)(n.code,{children:"InMemoryRoleProvider"})," role provider."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.code,{children:"config/autoload/lmcrbac.global.php"}),", add the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-php",children:" [\n 'role_provider' => [\n 'LmcRbac\\Role\\InMemoryRoleProvider' => [\n 'guest',\n 'user' => [\n 'permissions' => ['create', 'edit'],\n ],\n 'admin' => [\n 'children' => ['user'],\n 'permissions' => ['delete'],\n ],\n ],\n ],\n ],\n];\n"})}),"\n",(0,t.jsxs)(n.p,{children:["This defines 3 roles: a ",(0,t.jsx)(n.code,{children:"guest"})," role, a ",(0,t.jsx)(n.code,{children:"user"})," role having 2 permissions, and a ",(0,t.jsx)(n.code,{children:"admin"})," role which has the ",(0,t.jsx)(n.code,{children:"user"})," role as\na child and with its own permission. If the hierarchy is flattened:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.code,{children:"guest"})," has no permission"]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.code,{children:"user"})," has permissions ",(0,t.jsx)(n.code,{children:"create"})," and ",(0,t.jsx)(n.code,{children:"edit"})]}),"\n",(0,t.jsxs)(n.li,{children:[(0,t.jsx)(n.code,{children:"admin"})," has permissions ",(0,t.jsx)(n.code,{children:"create"}),", ",(0,t.jsx)(n.code,{children:"edit"})," and ",(0,t.jsx)(n.code,{children:"delete"})]}),"\n"]}),"\n",(0,t.jsx)(n.h2,{id:"basic-authorization",children:"Basic authorization"}),"\n",(0,t.jsx)(n.p,{children:"The authorization service can get retrieved from service manager container and used to check if a permission\nis granted to an identity:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-php",children:"get('\\LmcRbac\\Service\\AuthorizationServiceInterface');\n \n /** @var \\LmcRbac\\Identity\\IdentityInterface $identity */\n if ($authorizationService->isGranted($identity, 'create')) {\n /** do something */\n }\n"})}),"\n",(0,t.jsxs)(n.p,{children:["If ",(0,t.jsx)(n.code,{children:"$identity"})," has the role ",(0,t.jsx)(n.code,{children:"user"})," and/or ",(0,t.jsx)(n.code,{children:"admin"})," then the authorization is granted. If the identity has the role ",(0,t.jsx)(n.code,{children:"guest"}),", then authorization\nis denied."]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["If ",(0,t.jsx)(n.code,{children:"$identity"})," is null (no identity), then the guest role is assumed which is set to ",(0,t.jsx)(n.code,{children:"'guest'"})," by default. The guest role\ncan be configured in the ",(0,t.jsx)(n.code,{children:"lmcrbac.config.php"})," file. More on this in the ",(0,t.jsx)(n.a,{href:"/LmcRbac/docs/configuration",children:"Configuration"})," section."]})}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:[(0,t.jsx)(n.code,{children:"LmcRbac"})," does not provide any logic to instantiate an identity entity. It is assumed that\nthe application will instantiate an entity that implements ",(0,t.jsx)(n.code,{children:"\\LmcRbac\\Identity\\IdentityInterface"})," which defines the ",(0,t.jsx)(n.code,{children:"getRoles()"}),"\nmethod."]})}),"\n",(0,t.jsx)(n.h2,{id:"using-assertions",children:"Using assertions"}),"\n",(0,t.jsxs)(n.p,{children:["Even if an identity has the ",(0,t.jsx)(n.code,{children:"user"})," role granting it the ",(0,t.jsx)(n.code,{children:"edit"})," permission, it should not have the authorization to edit another identity's resource."]}),"\n",(0,t.jsx)(n.p,{children:"This can be achieved using dynamic assertion."}),"\n",(0,t.jsxs)(n.p,{children:["An assertion is a function that implements the ",(0,t.jsx)(n.code,{children:"\\LmcRbac\\Assertion\\AssertionInterface"})," and is configured in the configuration\nfile."]}),"\n",(0,t.jsxs)(n.p,{children:["Let's modify the ",(0,t.jsx)(n.code,{children:"lmcrbac.config.php"})," file as follows:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-php",children:" [\n 'role_provider' => [\n /* roles and permissions\n ],\n 'assertion_map' => [\n 'edit' => function ($permission, IdentityInterface $identity = null, $resource = null) {\n if ($resource->getOwnerId() === $identity->getId() {\n return true;\n } else {\n return false;\n }\n ],\n ],\n];\n"})}),"\n",(0,t.jsx)(n.p,{children:"Then use the authorization service passing the resource (called a 'context') in addition to the permission:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-php",children:"get('\\LmcRbac\\Service\\AuthorizationServiceInterface');\n \n /** @var \\LmcRbac\\Identity\\IdentityInterface $identity */\n if ($authorizationService->isGranted($identity, 'edit', $resource)) {\n /** do something */\n }\n"})}),"\n",(0,t.jsxs)(n.p,{children:["Dynanmic assertions are further discussed in the ",(0,t.jsx)(n.a,{href:"assertions",children:"Dynamic Assertions"})," section."]})]})}function h(e={}){const{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},8453:(e,n,i)=>{i.d(n,{R:()=>o,x:()=>c});var t=i(6540);const s={},r=t.createContext(s);function o(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ae2b06ff.51ca71b8.js b/assets/js/ae2b06ff.51ca71b8.js deleted file mode 100644 index 8a5989d..0000000 --- a/assets/js/ae2b06ff.51ca71b8.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[975],{6331:e=>{e.exports=JSON.parse('{"version":{"pluginId":"default","version":"current","label":"Next","banner":null,"badge":false,"noIndex":false,"className":"docs-version-current","isLast":true,"docsSidebars":{"documentationSidebar":[{"type":"link","label":"Getting Started","href":"/LmcRbac/docs/gettingstarted","docId":"gettingstarted","unlisted":false},{"type":"link","label":"Concepts","href":"/LmcRbac/docs/concepts","docId":"concepts","unlisted":false},{"type":"link","label":"Quick start","href":"/LmcRbac/docs/quickstart","docId":"quickstart","unlisted":false},{"type":"link","label":"Role providers","href":"/LmcRbac/docs/role-providers","docId":"role-providers","unlisted":false},{"type":"link","label":"Authorization service","href":"/LmcRbac/docs/authorization-service","docId":"authorization-service","unlisted":false},{"type":"link","label":"Dynamic Assertions","href":"/LmcRbac/docs/assertions","docId":"assertions","unlisted":false},{"type":"link","label":"Configuration","href":"/LmcRbac/docs/configuration","docId":"configuration","unlisted":false},{"type":"link","label":"Migration Guide","href":"/LmcRbac/docs/migration","docId":"migration","unlisted":false}]},"docs":{"assertions":{"id":"assertions","title":"Dynamic Assertions","description":"Dynamic Assertions provide the capability to perform extra validations when","sidebar":"documentationSidebar"},"authorization-service":{"id":"authorization-service","title":"Authorization Service","description":"Usage","sidebar":"documentationSidebar"},"concepts":{"id":"concepts","title":"Concepts","description":"Role-Based Access Control (RBAC)","sidebar":"documentationSidebar"},"configuration":{"id":"configuration","title":"Configuring LmcRbac","description":"LmcRbac is configured via the lmc_rbac key in the application config.","sidebar":"documentationSidebar"},"gettingstarted":{"id":"gettingstarted","title":"Get started","description":"Requirements","sidebar":"documentationSidebar"},"migration":{"id":"migration","title":"Migration Guide","description":"Migrating from ZF-Commons RBAC v3","sidebar":"documentationSidebar"},"quickstart":{"id":"quickstart","title":"Quick Start","description":"Once the library has been installed by Composer, you will need to copy the","sidebar":"documentationSidebar"},"role-providers":{"id":"role-providers","title":"Role providers","description":"A role provider is an object that returns a list of roles. A role provider must implement the","sidebar":"documentationSidebar"}}}}')}}]); \ No newline at end of file diff --git a/assets/js/ae2b06ff.858b0957.js b/assets/js/ae2b06ff.858b0957.js new file mode 100644 index 0000000..67b9005 --- /dev/null +++ b/assets/js/ae2b06ff.858b0957.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[975],{6331:e=>{e.exports=JSON.parse('{"version":{"pluginId":"default","version":"current","label":"Next","banner":null,"badge":false,"noIndex":false,"className":"docs-version-current","isLast":true,"docsSidebars":{"documentationSidebar":[{"type":"link","label":"Getting Started","href":"/LmcRbac/docs/gettingstarted","docId":"gettingstarted","unlisted":false},{"type":"link","label":"Concepts","href":"/LmcRbac/docs/concepts","docId":"concepts","unlisted":false},{"type":"link","label":"Quick start","href":"/LmcRbac/docs/quickstart","docId":"quickstart","unlisted":false},{"type":"link","label":"Roles and Role providers","href":"/LmcRbac/docs/role-providers","docId":"role-providers","unlisted":false},{"type":"link","label":"Authorization service","href":"/LmcRbac/docs/authorization-service","docId":"authorization-service","unlisted":false},{"type":"link","label":"Dynamic Assertions","href":"/LmcRbac/docs/assertions","docId":"assertions","unlisted":false},{"type":"link","label":"Configuration","href":"/LmcRbac/docs/configuration","docId":"configuration","unlisted":false},{"type":"link","label":"Migration Guide","href":"/LmcRbac/docs/migration","docId":"migration","unlisted":false}]},"docs":{"assertions":{"id":"assertions","title":"Dynamic Assertions","description":"Dynamic Assertions provide the capability to perform extra validations when","sidebar":"documentationSidebar"},"authorization-service":{"id":"authorization-service","title":"Authorization Service","description":"Usage","sidebar":"documentationSidebar"},"concepts":{"id":"concepts","title":"Concepts","description":"Role-Based Access Control (RBAC)","sidebar":"documentationSidebar"},"configuration":{"id":"configuration","title":"Configuring LmcRbac","description":"LmcRbac is configured via the lmc_rbac key in the application config.","sidebar":"documentationSidebar"},"gettingstarted":{"id":"gettingstarted","title":"Get started","description":"Requirements","sidebar":"documentationSidebar"},"migration":{"id":"migration","title":"Migration Guide","description":"Migrating from ZF-Commons RBAC v3","sidebar":"documentationSidebar"},"quickstart":{"id":"quickstart","title":"Quick Start","description":"Once the library has been installed by Composer, you will need to copy the","sidebar":"documentationSidebar"},"role-providers":{"id":"role-providers","title":"Roles and Role providers","description":"Role types","sidebar":"documentationSidebar"}}}}')}}]); \ No newline at end of file diff --git a/assets/js/bbbbc39d.72a60da4.js b/assets/js/bbbbc39d.72a60da4.js deleted file mode 100644 index cd5c62e..0000000 --- a/assets/js/bbbbc39d.72a60da4.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[690],{2794:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>c,default:()=>l,frontMatter:()=>s,metadata:()=>o,toc:()=>a});var i=n(4848),r=n(8453);const s={sidebar_label:"Authorization service",sidebar_position:5,title:"Authorization Service"},c=void 0,o={id:"authorization-service",title:"Authorization Service",description:"Usage",source:"@site/docs/authorization-service.md",sourceDirName:".",slug:"/authorization-service",permalink:"/LmcRbac/docs/authorization-service",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/authorization-service.md",tags:[],version:"current",sidebarPosition:5,frontMatter:{sidebar_label:"Authorization service",sidebar_position:5,title:"Authorization Service"},sidebar:"documentationSidebar",previous:{title:"Role providers",permalink:"/LmcRbac/docs/role-providers"},next:{title:"Dynamic Assertions",permalink:"/LmcRbac/docs/assertions"}},d={},a=[{value:"Usage",id:"usage",level:3},{value:"Reference",id:"reference",level:3}];function h(e){const t={a:"a",code:"code",h3:"h3",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h3,{id:"usage",children:"Usage"}),"\n",(0,i.jsxs)(t.p,{children:["The Authorization service can be retrieved from the service manager using the name\n",(0,i.jsx)(t.code,{children:"LmcRbac\\Service\\AuthorizationServiceInterface"})," and injected into your code:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-php",children:"get(LmcRbac\\Service\\AuthorizationServiceInterface::class);\n\n"})}),"\n",(0,i.jsx)(t.h3,{id:"reference",children:"Reference"}),"\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.code,{children:"LmcRbac\\Service\\AuthorizationServiceInterface"})," defines the following method:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"isGranted(?IdentityInterface $identity, string $permission, $context = null): bool"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Parameter"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$identity"})}),(0,i.jsxs)(t.td,{children:["The identity whose roles to checks. ",(0,i.jsx)("br",{}),"If ",(0,i.jsx)(t.code,{children:"$identity"})," is null, then the ",(0,i.jsx)(t.code,{children:"guest"})," is used. ",(0,i.jsx)("br",{}),"The ",(0,i.jsx)(t.code,{children:"guest"})," role is definable via configuration and defaults to ",(0,i.jsx)(t.code,{children:"'guest'"}),"."]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$permission"})}),(0,i.jsx)(t.td,{children:"The permission to check against"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$context"})}),(0,i.jsx)(t.td,{children:"A context that will be passed to dynamic assertions that are defined for the permission"})]})]})]}),"\n",(0,i.jsxs)(t.p,{children:["More on dynamic assertions can be found in the ",(0,i.jsx)(t.a,{href:"/LmcRbac/docs/assertions",children:"Assertions"})," section."]}),"\n",(0,i.jsxs)(t.p,{children:["More on the ",(0,i.jsx)(t.code,{children:"guest"})," role can be found in the ",(0,i.jsx)(t.a,{href:"/LmcRbac/docs/configuration",children:"Configuration"})," section."]})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},8453:(e,t,n)=>{n.d(t,{R:()=>c,x:()=>o});var i=n(6540);const r={},s=i.createContext(r);function c(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/bbbbc39d.d20ba463.js b/assets/js/bbbbc39d.d20ba463.js new file mode 100644 index 0000000..5cb5b7c --- /dev/null +++ b/assets/js/bbbbc39d.d20ba463.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkdocs=self.webpackChunkdocs||[]).push([[690],{2794:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>c,default:()=>l,frontMatter:()=>s,metadata:()=>o,toc:()=>a});var i=n(4848),r=n(8453);const s={sidebar_label:"Authorization service",sidebar_position:5,title:"Authorization Service"},c=void 0,o={id:"authorization-service",title:"Authorization Service",description:"Usage",source:"@site/docs/authorization-service.md",sourceDirName:".",slug:"/authorization-service",permalink:"/LmcRbac/docs/authorization-service",draft:!1,unlisted:!1,editUrl:"https://github.com/lm-commons/lmcrbac/tree/master/docs/docs/authorization-service.md",tags:[],version:"current",sidebarPosition:5,frontMatter:{sidebar_label:"Authorization service",sidebar_position:5,title:"Authorization Service"},sidebar:"documentationSidebar",previous:{title:"Roles and Role providers",permalink:"/LmcRbac/docs/role-providers"},next:{title:"Dynamic Assertions",permalink:"/LmcRbac/docs/assertions"}},d={},a=[{value:"Usage",id:"usage",level:3},{value:"Reference",id:"reference",level:3}];function h(e){const t={a:"a",code:"code",h3:"h3",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h3,{id:"usage",children:"Usage"}),"\n",(0,i.jsxs)(t.p,{children:["The Authorization service can be retrieved from the service manager using the name\n",(0,i.jsx)(t.code,{children:"LmcRbac\\Service\\AuthorizationServiceInterface"})," and injected into your code:"]}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-php",children:"get(LmcRbac\\Service\\AuthorizationServiceInterface::class);\n\n"})}),"\n",(0,i.jsx)(t.h3,{id:"reference",children:"Reference"}),"\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.code,{children:"LmcRbac\\Service\\AuthorizationServiceInterface"})," defines the following method:"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"isGranted(?IdentityInterface $identity, string $permission, $context = null): bool"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Parameter"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$identity"})}),(0,i.jsxs)(t.td,{children:["The identity whose roles to checks. ",(0,i.jsx)("br",{}),"If ",(0,i.jsx)(t.code,{children:"$identity"})," is null, then the ",(0,i.jsx)(t.code,{children:"guest"})," is used. ",(0,i.jsx)("br",{}),"The ",(0,i.jsx)(t.code,{children:"guest"})," role is definable via configuration and defaults to ",(0,i.jsx)(t.code,{children:"'guest'"}),"."]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$permission"})}),(0,i.jsx)(t.td,{children:"The permission to check against"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"$context"})}),(0,i.jsx)(t.td,{children:"A context that will be passed to dynamic assertions that are defined for the permission"})]})]})]}),"\n",(0,i.jsxs)(t.p,{children:["More on dynamic assertions can be found in the ",(0,i.jsx)(t.a,{href:"/LmcRbac/docs/assertions",children:"Assertions"})," section."]}),"\n",(0,i.jsxs)(t.p,{children:["More on the ",(0,i.jsx)(t.code,{children:"guest"})," role can be found in the ",(0,i.jsx)(t.a,{href:"/LmcRbac/docs/configuration",children:"Configuration"})," section."]})]})}function l(e={}){const{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},8453:(e,t,n)=>{n.d(t,{R:()=>c,x:()=>o});var i=n(6540);const r={},s=i.createContext(r);function c(e){const t=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),i.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/runtime~main.46347062.js b/assets/js/runtime~main.39377a35.js similarity index 56% rename from assets/js/runtime~main.46347062.js rename to assets/js/runtime~main.39377a35.js index 39d2e85..b53f21a 100644 --- a/assets/js/runtime~main.46347062.js +++ b/assets/js/runtime~main.39377a35.js @@ -1 +1 @@ -(()=>{"use strict";var e,a,t,r,c,f={},o={};function d(e){var a=o[e];if(void 0!==a)return a.exports;var t=o[e]={exports:{}};return f[e].call(t.exports,t,t.exports,d),t.exports}d.m=f,e=[],d.O=(a,t,r,c)=>{if(!t){var f=1/0;for(i=0;i=c)&&Object.keys(d.O).every((e=>d.O[e](t[n])))?t.splice(n--,1):(o=!1,c0&&e[i-1][2]>c;i--)e[i]=e[i-1];e[i]=[t,r,c]},d.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return d.d(a,{a:a}),a},t=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,d.t=function(e,r){if(1&r&&(e=this(e)),8&r)return e;if("object"==typeof e&&e){if(4&r&&e.__esModule)return e;if(16&r&&"function"==typeof e.then)return e}var c=Object.create(null);d.r(c);var f={};a=a||[null,t({}),t([]),t(t)];for(var o=2&r&&e;"object"==typeof o&&!~a.indexOf(o);o=t(o))Object.getOwnPropertyNames(o).forEach((a=>f[a]=()=>e[a]));return f.default=()=>e,d.d(c,f),c},d.d=(e,a)=>{for(var t in a)d.o(a,t)&&!d.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:a[t]})},d.f={},d.e=e=>Promise.all(Object.keys(d.f).reduce(((a,t)=>(d.f[t](e,a),a)),[])),d.u=e=>"assets/js/"+({0:"45a5cd1f",48:"a94703ab",61:"1f391b9e",72:"3ea8b8bd",98:"a7bd4aaa",123:"1fe90995",134:"393be207",143:"7fcaebdf",166:"22465cd7",167:"3d87926a",209:"01a85c17",218:"da7e18d7",231:"ff0cfdc0",235:"a7456010",249:"ccc49370",316:"23a87c5d",401:"17896441",472:"814f3328",530:"c50cf196",549:"295b567d",634:"c4f5d8e4",643:"a6aa9e1f",647:"5e95c892",677:"d01ab9e4",690:"bbbbc39d",693:"be7218de",711:"9e4087bc",731:"e0182378",742:"aba21aa0",754:"60894653",813:"6875c492",822:"8070e160",858:"36994c47",873:"9ed00105",903:"acecf23e",975:"ae2b06ff"}[e]||e)+"."+{0:"2284be79",48:"a8e86096",61:"afd6222f",72:"9c1937a3",98:"7acfaa26",123:"efa65370",134:"af3ff5fe",143:"64a524a2",166:"92e3d51b",167:"460c4f67",209:"80194efd",218:"c0f3cf19",231:"9f96691c",235:"47cad1bc",237:"02cb92cf",242:"8f375f31",249:"af21bf9f",316:"cf52af67",401:"241f5da3",472:"7c82429c",530:"bad4c04a",538:"3a792d77",549:"3992908d",634:"d71f1299",643:"4810414c",647:"4bba8c03",677:"ba0ad46c",690:"72a60da4",693:"dbc47048",711:"c2e72ae7",731:"0f08ffe0",742:"eb7bf6f2",754:"56a747fc",813:"3f033c5c",822:"6fcd7787",858:"5b43e344",873:"bb7a2b98",903:"b132695f",975:"51ca71b8"}[e]+".js",d.miniCssF=e=>{},d.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),d.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),r={},c="docs:",d.l=(e,a,t,f)=>{if(r[e])r[e].push(a);else{var o,n;if(void 0!==t)for(var b=document.getElementsByTagName("script"),i=0;i{o.onerror=o.onload=null,clearTimeout(s);var c=r[e];if(delete r[e],o.parentNode&&o.parentNode.removeChild(o),c&&c.forEach((e=>e(t))),a)return a(t)},s=setTimeout(l.bind(null,void 0,{type:"timeout",target:o}),12e4);o.onerror=l.bind(null,o.onerror),o.onload=l.bind(null,o.onload),n&&document.head.appendChild(o)}},d.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},d.p="/LmcRbac/",d.gca=function(e){return e={17896441:"401",60894653:"754","45a5cd1f":"0",a94703ab:"48","1f391b9e":"61","3ea8b8bd":"72",a7bd4aaa:"98","1fe90995":"123","393be207":"134","7fcaebdf":"143","22465cd7":"166","3d87926a":"167","01a85c17":"209",da7e18d7:"218",ff0cfdc0:"231",a7456010:"235",ccc49370:"249","23a87c5d":"316","814f3328":"472",c50cf196:"530","295b567d":"549",c4f5d8e4:"634",a6aa9e1f:"643","5e95c892":"647",d01ab9e4:"677",bbbbc39d:"690",be7218de:"693","9e4087bc":"711",e0182378:"731",aba21aa0:"742","6875c492":"813","8070e160":"822","36994c47":"858","9ed00105":"873",acecf23e:"903",ae2b06ff:"975"}[e]||e,d.p+d.u(e)},(()=>{var e={354:0,869:0};d.f.j=(a,t)=>{var r=d.o(e,a)?e[a]:void 0;if(0!==r)if(r)t.push(r[2]);else if(/^(354|869)$/.test(a))e[a]=0;else{var c=new Promise(((t,c)=>r=e[a]=[t,c]));t.push(r[2]=c);var f=d.p+d.u(a),o=new Error;d.l(f,(t=>{if(d.o(e,a)&&(0!==(r=e[a])&&(e[a]=void 0),r)){var c=t&&("load"===t.type?"missing":t.type),f=t&&t.target&&t.target.src;o.message="Loading chunk "+a+" failed.\n("+c+": "+f+")",o.name="ChunkLoadError",o.type=c,o.request=f,r[1](o)}}),"chunk-"+a,a)}},d.O.j=a=>0===e[a];var a=(a,t)=>{var r,c,f=t[0],o=t[1],n=t[2],b=0;if(f.some((a=>0!==e[a]))){for(r in o)d.o(o,r)&&(d.m[r]=o[r]);if(n)var i=n(d)}for(a&&a(t);b{"use strict";var e,a,t,r,c,o={},f={};function d(e){var a=f[e];if(void 0!==a)return a.exports;var t=f[e]={exports:{}};return o[e].call(t.exports,t,t.exports,d),t.exports}d.m=o,e=[],d.O=(a,t,r,c)=>{if(!t){var o=1/0;for(i=0;i=c)&&Object.keys(d.O).every((e=>d.O[e](t[n])))?t.splice(n--,1):(f=!1,c0&&e[i-1][2]>c;i--)e[i]=e[i-1];e[i]=[t,r,c]},d.n=e=>{var a=e&&e.__esModule?()=>e.default:()=>e;return d.d(a,{a:a}),a},t=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,d.t=function(e,r){if(1&r&&(e=this(e)),8&r)return e;if("object"==typeof e&&e){if(4&r&&e.__esModule)return e;if(16&r&&"function"==typeof e.then)return e}var c=Object.create(null);d.r(c);var o={};a=a||[null,t({}),t([]),t(t)];for(var f=2&r&&e;"object"==typeof f&&!~a.indexOf(f);f=t(f))Object.getOwnPropertyNames(f).forEach((a=>o[a]=()=>e[a]));return o.default=()=>e,d.d(c,o),c},d.d=(e,a)=>{for(var t in a)d.o(a,t)&&!d.o(e,t)&&Object.defineProperty(e,t,{enumerable:!0,get:a[t]})},d.f={},d.e=e=>Promise.all(Object.keys(d.f).reduce(((a,t)=>(d.f[t](e,a),a)),[])),d.u=e=>"assets/js/"+({0:"45a5cd1f",48:"a94703ab",61:"1f391b9e",72:"3ea8b8bd",98:"a7bd4aaa",123:"1fe90995",134:"393be207",143:"7fcaebdf",166:"22465cd7",167:"3d87926a",209:"01a85c17",218:"da7e18d7",231:"ff0cfdc0",235:"a7456010",249:"ccc49370",316:"23a87c5d",401:"17896441",472:"814f3328",530:"c50cf196",549:"295b567d",634:"c4f5d8e4",643:"a6aa9e1f",647:"5e95c892",677:"d01ab9e4",690:"bbbbc39d",693:"be7218de",711:"9e4087bc",731:"e0182378",742:"aba21aa0",754:"60894653",813:"6875c492",822:"8070e160",858:"36994c47",873:"9ed00105",903:"acecf23e",975:"ae2b06ff"}[e]||e)+"."+{0:"2284be79",48:"a8e86096",61:"afd6222f",72:"9c1937a3",98:"7acfaa26",123:"efa65370",134:"af3ff5fe",143:"64a524a2",166:"f4021b5a",167:"460c4f67",209:"80194efd",218:"c0f3cf19",231:"9f96691c",235:"47cad1bc",237:"02cb92cf",242:"8f375f31",249:"af21bf9f",316:"cf52af67",401:"241f5da3",472:"7c82429c",530:"bad4c04a",538:"3a792d77",549:"3992908d",634:"d71f1299",643:"4810414c",647:"4bba8c03",677:"ba0ad46c",690:"d20ba463",693:"dbc47048",711:"c2e72ae7",731:"0f08ffe0",742:"eb7bf6f2",754:"56a747fc",813:"3f033c5c",822:"0e398fca",858:"5b43e344",873:"bb7a2b98",903:"b132695f",975:"858b0957"}[e]+".js",d.miniCssF=e=>{},d.g=function(){if("object"==typeof globalThis)return globalThis;try{return this||new Function("return this")()}catch(e){if("object"==typeof window)return window}}(),d.o=(e,a)=>Object.prototype.hasOwnProperty.call(e,a),r={},c="docs:",d.l=(e,a,t,o)=>{if(r[e])r[e].push(a);else{var f,n;if(void 0!==t)for(var b=document.getElementsByTagName("script"),i=0;i{f.onerror=f.onload=null,clearTimeout(s);var c=r[e];if(delete r[e],f.parentNode&&f.parentNode.removeChild(f),c&&c.forEach((e=>e(t))),a)return a(t)},s=setTimeout(l.bind(null,void 0,{type:"timeout",target:f}),12e4);f.onerror=l.bind(null,f.onerror),f.onload=l.bind(null,f.onload),n&&document.head.appendChild(f)}},d.r=e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},d.p="/LmcRbac/",d.gca=function(e){return e={17896441:"401",60894653:"754","45a5cd1f":"0",a94703ab:"48","1f391b9e":"61","3ea8b8bd":"72",a7bd4aaa:"98","1fe90995":"123","393be207":"134","7fcaebdf":"143","22465cd7":"166","3d87926a":"167","01a85c17":"209",da7e18d7:"218",ff0cfdc0:"231",a7456010:"235",ccc49370:"249","23a87c5d":"316","814f3328":"472",c50cf196:"530","295b567d":"549",c4f5d8e4:"634",a6aa9e1f:"643","5e95c892":"647",d01ab9e4:"677",bbbbc39d:"690",be7218de:"693","9e4087bc":"711",e0182378:"731",aba21aa0:"742","6875c492":"813","8070e160":"822","36994c47":"858","9ed00105":"873",acecf23e:"903",ae2b06ff:"975"}[e]||e,d.p+d.u(e)},(()=>{var e={354:0,869:0};d.f.j=(a,t)=>{var r=d.o(e,a)?e[a]:void 0;if(0!==r)if(r)t.push(r[2]);else if(/^(354|869)$/.test(a))e[a]=0;else{var c=new Promise(((t,c)=>r=e[a]=[t,c]));t.push(r[2]=c);var o=d.p+d.u(a),f=new Error;d.l(o,(t=>{if(d.o(e,a)&&(0!==(r=e[a])&&(e[a]=void 0),r)){var c=t&&("load"===t.type?"missing":t.type),o=t&&t.target&&t.target.src;f.message="Loading chunk "+a+" failed.\n("+c+": "+o+")",f.name="ChunkLoadError",f.type=c,f.request=o,r[1](f)}}),"chunk-"+a,a)}},d.O.j=a=>0===e[a];var a=(a,t)=>{var r,c,o=t[0],f=t[1],n=t[2],b=0;if(o.some((a=>0!==e[a]))){for(r in f)d.o(f,r)&&(d.m[r]=f[r]);if(n)var i=n(d)}for(a&&a(t);b - + diff --git a/blog/archive.html b/blog/archive.html index 0a9c4ac..39e56d3 100644 --- a/blog/archive.html +++ b/blog/archive.html @@ -9,7 +9,7 @@ - + diff --git a/blog/new-documentation.html b/blog/new-documentation.html index 3864043..2ee22f5 100644 --- a/blog/new-documentation.html +++ b/blog/new-documentation.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags.html b/blog/tags.html index 398088e..daacbec 100644 --- a/blog/tags.html +++ b/blog/tags.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags/authorization.html b/blog/tags/authorization.html index 61bb22b..aceda46 100644 --- a/blog/tags/authorization.html +++ b/blog/tags/authorization.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags/laminas.html b/blog/tags/laminas.html index 125d317..67c6ea3 100644 --- a/blog/tags/laminas.html +++ b/blog/tags/laminas.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags/lm-commons.html b/blog/tags/lm-commons.html index 3119ccd..1bc22ec 100644 --- a/blog/tags/lm-commons.html +++ b/blog/tags/lm-commons.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags/lmc-rbac.html b/blog/tags/lmc-rbac.html index fb25a37..93bc0ef 100644 --- a/blog/tags/lmc-rbac.html +++ b/blog/tags/lmc-rbac.html @@ -9,7 +9,7 @@ - + diff --git a/blog/tags/php.html b/blog/tags/php.html index a8a2bed..03005b8 100644 --- a/blog/tags/php.html +++ b/blog/tags/php.html @@ -9,7 +9,7 @@ - + diff --git a/docs/assertions.html b/docs/assertions.html index 3d7eb3b..c469d0a 100644 --- a/docs/assertions.html +++ b/docs/assertions.html @@ -9,11 +9,11 @@ - + -

Dynamic Assertions

Dynamic Assertions provide the capability to perform extra validations when +

Dynamic Assertions

Dynamic Assertions provide the capability to perform extra validations when the authorization service's isGranted() method is called.

As described in Authorization Service, it is possible to pass a context to the isGranted() method. This context is then passed to dynamic assertion functions. This context can be any object type.

diff --git a/docs/authorization-service.html b/docs/authorization-service.html index d8bd82d..31f5d5a 100644 --- a/docs/authorization-service.html +++ b/docs/authorization-service.html @@ -9,11 +9,11 @@ - + -

Authorization Service

Usage​

+

Authorization Service

Usage​

The Authorization service can be retrieved from the service manager using the name LmcRbac\Service\AuthorizationServiceInterface and injected into your code:

<?php
    /** @var \Psr\Container\ContainerInterface $container */
    $authorizationService = $container->get(LmcRbac\Service\AuthorizationServiceInterface::class);

@@ -22,6 +22,6 @@

ReferenceisGranted(?IdentityInterface $identity, string $permission, $context = null): bool

ParameterDescription
$identityThe identity whose roles to checks.
If $identity is null, then the guest is used.
The guest role is definable via configuration and defaults to 'guest'.
$permissionThe permission to check against
$contextA context that will be passed to dynamic assertions that are defined for the permission

More on dynamic assertions can be found in the Assertions section.

-

More on the guest role can be found in the Configuration section.

+

More on the guest role can be found in the Configuration section.

\ No newline at end of file diff --git a/docs/concepts.html b/docs/concepts.html index a99fb40..e9b86ad 100644 --- a/docs/concepts.html +++ b/docs/concepts.html @@ -9,11 +9,11 @@ - + -

Concepts

Role-Based Access Control (RBAC) +

Concepts

Role-Based Access Control (RBAC) is an approach to restricting system access to authorized users by putting emphasis on roles and their permissions.

In the RBAC model:

diff --git a/docs/configuration.html b/docs/configuration.html index f56a5a6..b5d3921 100644 --- a/docs/configuration.html +++ b/docs/configuration.html @@ -9,11 +9,11 @@ - + -

Configuring LmcRbac

LmcRbac is configured via the lmc_rbac key in the application config.

+

Configuring LmcRbac

LmcRbac is configured via the lmc_rbac key in the application config.

This is typically achieved by creating a config/autoload/lmcrbac.global.php file. A sample configuration file is provided in the config/ folder.

Reference​

diff --git a/docs/gettingstarted.html b/docs/gettingstarted.html index 2f9693e..1e848ba 100644 --- a/docs/gettingstarted.html +++ b/docs/gettingstarted.html @@ -9,11 +9,11 @@ - + -

Get started

Requirements​

+

Get started

Requirements​

  • PHP 7.3 or higher
diff --git a/docs/migration.html b/docs/migration.html index 28494c3..4c0ce28 100644 --- a/docs/migration.html +++ b/docs/migration.html @@ -9,11 +9,11 @@ - + -

Migration Guide

Migrating from ZF-Commons RBAC v3​

+

Migration Guide

Migrating from ZF-Commons RBAC v3​

The ZF-Commons Rbac was created for the Zend Framework. When the Zend Framework was migrated to the Laminas project, the LM-Commons organization was created to provide components formerly provided by ZF-Commons.

When ZfcRbac was moved to LM-Commons, it was split into two repositories:

diff --git a/docs/quickstart.html b/docs/quickstart.html index 3265508..3a247e0 100644 --- a/docs/quickstart.html +++ b/docs/quickstart.html @@ -9,11 +9,11 @@ - + -

Quick Start

Once the library has been installed by Composer, you will need to copy the +

Quick Start

Once the library has been installed by Composer, you will need to copy the config/lmcrbac.global.php file from LmcRbac to the config/autoload folder.

note

On older versions of LmcRbac, the configuration file is named config/config.global.php.

Defining roles​

@@ -53,6 +53,6 @@

Using asser 
<?php
return [
    'lmc_rbac' => [
        'role_provider' => [
            /* roles and permissions
        ],
        'assertion_map' => [
            'edit' => function ($permission, IdentityInterface $identity = null, $resource = null) {
                        if ($resource->getOwnerId() === $identity->getId() {
                            return true;
                        } else {
                            return false;
                      }
        ],
    ],
];

Then use the authorization service passing the resource (called a 'context') in addition to the permission:

<?php

    /** @var \Psr\Container\ContainerInterface $container */
    $authorizationService = $container->get('\LmcRbac\Service\AuthorizationServiceInterface');
    
    /** @var \LmcRbac\Identity\IdentityInterface $identity */
    if ($authorizationService->isGranted($identity, 'edit', $resource)) {
        /** do something */
    }
-

Dynanmic assertions are further discussed in the Dynamic Assertions section.

+

Dynanmic assertions are further discussed in the Dynamic Assertions section.

\ No newline at end of file diff --git a/docs/role-providers.html b/docs/role-providers.html index 14ae5ce..f9822a2 100644 --- a/docs/role-providers.html +++ b/docs/role-providers.html @@ -3,21 +3,39 @@ -Role providers | LmcRbac +Roles and Role providers | LmcRbac - + -

Role providers

A role provider is an object that returns a list of roles. A role provider must implement the +

Roles and Role providers

Role types​

+

A role is an object that returns a list of permissions that the role has.

+

LmcRbac support two types of roles: hierarchical roles and flat roles.

+

Flat roles​

+

A flat role is the simplest role object. It contains the list of permissions that +the role has.

+

Flat roles are defined using by the LmcRbac\Role\Role class or by classes +implementing the LmcRbac\Role\RoleInterface.

+

Hierarchical roles​

+

A hierarchical role is a role that has child roles and therefore provides +a hierarchy of roles where a role inherit the permissions of all its child roles.

+

For example, a 'user' role may have the 'read' and 'write' permissions, and a 'admin' role +may inherit the permissions of the 'user' role plus an additional 'delete' role. In this structure, +the 'admin' role will have 'user' as its child role.

+

Hierarchical roles may have flat roles or hierarchical roles as children.

+

Hierarchical roles are defined using by the LmcRbac\Role\HierarchicalRole class or by classes +implementing the LmcRbac\Role\HierarchicalRoleInterface.

+

Role Providers​

+

A role provider is an object that returns a list of roles. A role provider must implement the LmcRbac\Role\RoleProviderInterface interface. The only required method is getRoles, and must return an array of LmcRbac\Role\RoleInterface objects.

Roles can come from one of many sources: in memory, from a file, from a database, etc. However, you can specify only one role provider per application.

-

Built-in role providers​

+

Built-in role providers​

LmcRbac comes with two built-in role providers: LmcRbac\Role\InMemoryRoleProvider and LmcRbac\Role\ObjectRepositoryRoleProvider. A role provider must be added to the role_provider subkey in the configuration file:

return [
    'lmc_rbac' => [
        'role_provider' => [
            // Role provider config here!
        ]
    ]
];
@@ -49,6 +67,6 @@ 

return [
    'lmc_rbac' => [
        'role_provider' => [
            'Application\Role\CustomRoleProvider' => [
                // Options
            ],
        ],
    ],
];

And the role provider is created using the service manager:

-
return [
    'service_manager' => [
        'factories' => [
            'Application\Role\CustomRoleProvider' => 'Application\Factory\CustomRoleProviderFactory'
        ],
    ],
];
+
return [
    'service_manager' => [
        'factories' => [
            'Application\Role\CustomRoleProvider' => 'Application\Factory\CustomRoleProviderFactory'
        ],
    ],
];
\ No newline at end of file diff --git a/index.html b/index.html index 161062a..ee929f8 100644 --- a/index.html +++ b/index.html @@ -9,7 +9,7 @@ - + diff --git a/markdown-page.html b/markdown-page.html index 53966d6..49193cd 100644 --- a/markdown-page.html +++ b/markdown-page.html @@ -9,7 +9,7 @@ - +