68 lines
1.8 KiB
Markdown
68 lines
1.8 KiB
Markdown
|
|
# ACL
|
|
|
|
The ACL is defined as follows:
|
|
|
|
## Roles
|
|
|
|
Roles define a group of user. like Author, Admin, Guest etc.
|
|
Each role can inherit other roles with the "inherit" key.
|
|
Each role can gain access to a zone (explained later) by the
|
|
"allowed-zones" key. Per default a role is denied access to all zones.
|
|
|
|
## Resources
|
|
|
|
Resources maps directly to `controller` names. If a controller is not
|
|
under the default module. `<module>/<controller>` format is used instead.
|
|
|
|
A special wildcard `*` character can be used to allow access to all
|
|
controllers (most likely only useful for non-default modules).
|
|
|
|
For example the resource `backend/*` Matches all controllers under
|
|
the backend module.
|
|
|
|
### Special controllers.
|
|
|
|
There a 2 controllers that are a bit special,
|
|
`index` and `error` resources are always accessible by everyone (e.g. they
|
|
are not part of the ACL).
|
|
|
|
## Access levels.
|
|
|
|
These are not used in this system. a hardcoded "All" level is used.
|
|
|
|
## Zones
|
|
|
|
Zones defines as 1 or more resources. for example an "backend" zone can
|
|
have 2 controllers/resources (*site-config*, *user-manager*)
|
|
|
|
Zones can also defines entire modules
|
|
|
|
|
|
# Example config.
|
|
|
|
acl.yml
|
|
```yaml
|
|
acl:
|
|
roles:
|
|
guest: # Guests are only allowed to access the public zone.
|
|
allowed-zones: public
|
|
description: Non logged in users
|
|
user: # Users inherits the guest role + has access to user zone.
|
|
inherits: guest
|
|
allowed-zones: user
|
|
description: Logged in users
|
|
admin: # Admins inherits the user role + has access to backend zone.
|
|
inherits: user
|
|
description: Administrators
|
|
allowed-zones: backend
|
|
|
|
zones:
|
|
# Public zone is the start page in
|
|
# index controller + login/logout in auth.
|
|
public: [ auth ]
|
|
# User zone can access profile and settings controllers
|
|
user: [ profile, settings ]
|
|
# Backend zone is the entire backend module.
|
|
backend: backend/*
|
|
```
|