Php Yii Framework 2.0基于角色的访问控制RBAC
在学习Yii Framework 2.0时,我尝试使用Yii 2.0文档中的角色库访问控制。但是指南文档对我来说太短了,我无法完成这项学习。我已将以下代码添加到配置文件中Php Yii Framework 2.0基于角色的访问控制RBAC,php,yii2,rbac,role-based-access-control,Php,Yii2,Rbac,Role Based Access Control,在学习Yii Framework 2.0时,我尝试使用Yii 2.0文档中的角色库访问控制。但是指南文档对我来说太短了,我无法完成这项学习。我已将以下代码添加到配置文件中 'components' => [ 'authManager' => [ 'class' => 'yii\rbac\DbManager', ], ], 我已经用下面的sql脚本创建了数据库表 drop table [auth_assignment]; drop table [
'components' => [
'authManager' => [
'class' => 'yii\rbac\DbManager',
],
],
我已经用下面的sql脚本创建了数据库表
drop table [auth_assignment];
drop table [auth_item_child];
drop table [auth_item];
drop table [auth_rule];
create table [auth_rule]
(
[name] varchar(64) not null,
[data] text,
[created_at] integer,
[updated_at] integer,
primary key ([name])
);
create table [auth_item]
(
[name] varchar(64) not null,
[type] integer not null,
[description] text,
[rule_name] varchar(64),
[data] text,
[created_at] integer,
[updated_at] integer,
primary key ([name]),
foreign key ([rule_name]) references [auth_rule] ([name]) on delete set null on update cascade
);
create index [idx-auth_item-type] on [auth_item] ([type]);
create table [auth_item_child]
(
[parent] varchar(64) not null,
[child] varchar(64) not null,
primary key ([parent],[child]),
foreign key ([parent]) references [auth_item] ([name]) on delete cascade on update cascade,
foreign key ([child]) references [auth_item] ([name]) on delete cascade on update cascade
);
create table [auth_assignment]
(
[item_name] varchar(64) not null,
[user_id] varchar(64) not null,
[created_at] integer,
primary key ([item_name], [user_id]),
foreign key ([item_name]) references [auth_item] ([name]) on delete cascade on update cascade
);
我用以下代码构建了身份验证数据
class RbacController extends Controller
{
public function actionInit()
{
$auth = Yii::$app->authManager;
// add "createPost" permission
$createPost = $auth->createPermission('createPost');
$createPost->description = 'Create a post';
$auth->add($createPost);
// add "updatePost" permission
$updatePost = $auth->createPermission('updatePost');
$updatePost->description = 'Update post';
$auth->add($updatePost);
// add "author" role and give this role the "createPost" permission
$author = $auth->createRole('author');
$auth->add($author);
$auth->addChild($author, $createPost);
// add "admin" role and give this role the "updatePost" permission
// as well as the permissions of the "author" role
$admin = $auth->createRole('admin');
$auth->add($admin);
$auth->addChild($admin, $updatePost);
$auth->addChild($admin, $author);
// Assign roles to users. 1 and 2 are IDs returned by IdentityInterface::getId()
// usually implemented in your User model.
$auth->assign($author, 2);
$auth->assign($admin, 1);
}
}
当通过此控制器访问此actionInit()方法时,上述数据库表中已填充了基于上述代码的数据。此外,在我的用户表中,我有两个用户,admin user的id号为1,author user的id号为2。我使用以下代码创建一个用户
public function create()
{
if ($this->validate()) {
$user = new User();
$user->username = $this->username;
$user->email = $this->email;
$user->setPassword($this->password);
$user->generateAuthKey();
$user->save(false);
// the following three lines were added:
$auth = Yii::$app->authManager;
$authorRole = $auth->getRole('author');
$auth->assign($authorRole, $user->getId());
return $user;
}
return null;
}
使用上述代码,所有新插入的用户都将成为作者。通过下面的if语句,我可以授予或拒绝访问权限
if (\Yii::$app->user->can('createPost')) {
// create post
}
if (\Yii::$app->user->can('updatePost')) {
// update post
}
到目前为止还不错。一切正常。上述代码的场景是普通作者可以创建帖子,但不能更新帖子。管理员可以更新后,可以做一切作者可以做的。现在我希望普通作者能够更新他/她自己的帖子。我不知道如何从这里走得更远。我遵循了Yii指南文档/安全/授权段落基于角色的访问控制(RBAC)。我从来没有用过Yii 1。这就是为什么我对Yii 2.0文档RBAC无法进行如此简短的解释。您需要访问规则,并且文档很清晰,所以请像这样创建它
namespace app\rbac;
use yii\rbac\Rule;
/**
* Checks if authorID matches user passed via params
*/
class AuthorRule extends Rule
{
public $name = 'isAuthor';
/**
* @param string|integer $user the user ID.
* @param Item $item the role or permission that this rule is associated with
* @param array $params parameters passed to ManagerInterface::checkAccess().
* @return boolean a value indicating whether the rule permits the role or permission it is associated with.
*/
public function execute($user, $item, $params)
{
return isset($params['post']) ? $params['post']->createdBy == $user : false;
}
}
然后,将其添加到您的RBAC角色中
$auth = Yii::$app->authManager;
// add the rule
$rule = new \app\rbac\AuthorRule;
$auth->add($rule);
// add the "updateOwnPost" permission and associate the rule with it.
$updateOwnPost = $auth->createPermission('updateOwnPost');
$updateOwnPost->description = 'Update own post';
$updateOwnPost->ruleName = $rule->name;
$auth->add($updateOwnPost);
// "updateOwnPost" will be used from "updatePost"
$auth->addChild($updateOwnPost, $updatePost);
// allow "author" to update their own posts
$auth->addChild($author, $updateOwnPost);
最后,在注册中将角色分配给用户
$auth = Yii::$app->authManager;
$authorRole = $auth->getRole('author');
$auth->assign($authorRole, $userid_here);
检查用户是否有能力编辑下面的使用代码,其中$post是post的模型
if (\Yii::$app->user->can('updatePost', ['post' => $post])) {
// update post
}
所有这些都是从指南中摘取的。
如果你有任何问题,请告诉我
if (\Yii::$app->user->can('updatePost', ['post' => $post])) {
// update post }
在我的脚本中,我使用$model
if (\Yii::$app->user->can('updatePost', ['post' => $model])) {
// update post }
然后它就可以工作了。什么是难以理解的?根据文档,我无法让它与updateOwnPost一起工作,并且不知道如果访问链接,访问检查部分下变量$post的值是多少。如果你能帮忙,我真的很感激!这就是$post模型。您可以编辑您的问题,以提出您想要的具体问题,并解释您所做的工作,以便给出具体的解决方案吗?我刚刚用我迄今为止所做的工作和我的问题所在编辑了我的问题。您文本下的代码:“将其添加到您的RBAC角色中”,将其放在actionInit()中的我的RbacController中方法?我可以用上面的方法检查任何型号的post吗?我还是不明白它怎么知道这张支票是关于哪个型号的。你不想签入型号。检查应在控制器操作中进行,而不是在模型中。如果在控制器范围内使用beforeAction/init方法,并且如果是针对单个操作,则在执行任何受保护的指令之前在顶部进行检查。此处的名称“post”是否重要($param[]内的键),或者它是否适用于除postController之外的任何其他控制器?我假设updatePost的关联数组必须与给定给key的名称匹配,但它适用于除Post之外的任何模型。我错了吗?