Yii Framework 2.0基于角色的访问控制RBAC

Question

学习Yii Framework 2.0我试图从Yii 2.0的文档中使用Role Bases访问控制。但是指南文件对我来说太短，我无法完成这一学习。我已将以下代码添加到我的配置文件中。

'components' => [ 
    'authManager' => [ 
     'class' => 'yii\rbac\DbManager', 
    ], 
], 

我用下面的sql脚本创建数据库表。

drop table [auth_assignment]; 
drop table [auth_item_child]; 
drop table [auth_item]; 
drop table [auth_rule]; 

create table [auth_rule] 
(
    [name] varchar(64) not null, 
    [data] text, 
    [created_at]   integer, 
    [updated_at]   integer, 
    primary key ([name]) 
); 

create table [auth_item] 
(
    [name]     varchar(64) not null, 
    [type]     integer not null, 
    [description]   text, 
    [rule_name]   varchar(64), 
    [data]     text, 
    [created_at]   integer, 
    [updated_at]   integer, 
    primary key ([name]), 
    foreign key ([rule_name]) references [auth_rule] ([name]) on delete set null on update cascade 
); 

create index [idx-auth_item-type] on [auth_item] ([type]); 

create table [auth_item_child] 
(
    [parent]    varchar(64) not null, 
    [child]    varchar(64) not null, 
    primary key ([parent],[child]), 
    foreign key ([parent]) references [auth_item] ([name]) on delete cascade on update cascade, 
    foreign key ([child]) references [auth_item] ([name]) on delete cascade on update cascade 
); 

create table [auth_assignment] 
(
    [item_name]   varchar(64) not null, 
    [user_id]    varchar(64) not null, 
    [created_at]   integer, 
    primary key ([item_name], [user_id]), 
    foreign key ([item_name]) references [auth_item] ([name]) on delete cascade on update cascade 
); 

我已经建立了以下认证数据。

class RbacController extends Controller 
{ 
    public function actionInit() 
    { 
     $auth = Yii::$app->authManager; 

     // add "createPost" permission 
     $createPost = $auth->createPermission('createPost'); 
     $createPost->description = 'Create a post'; 
     $auth->add($createPost); 

     // add "updatePost" permission 
     $updatePost = $auth->createPermission('updatePost'); 
     $updatePost->description = 'Update post'; 
     $auth->add($updatePost); 

     // add "author" role and give this role the "createPost" permission 
     $author = $auth->createRole('author'); 
     $auth->add($author); 
     $auth->addChild($author, $createPost); 

     // add "admin" role and give this role the "updatePost" permission 
     // as well as the permissions of the "author" role 
     $admin = $auth->createRole('admin'); 
     $auth->add($admin); 
     $auth->addChild($admin, $updatePost); 
     $auth->addChild($admin, $author); 

     // Assign roles to users. 1 and 2 are IDs returned by IdentityInterface::getId() 
     // usually implemented in your User model. 
     $auth->assign($author, 2); 
     $auth->assign($admin, 1); 
    } 
} 

当经由该控制器访问该actionInit（）方法，在上述数据库中的表中充满了基于上述码的数据。此外，在我的用户表中，我有两个用户，admin用户的ID号为1，author用户的ID号为2.我使用以下代码创建用户。

public function create() 
{ 
    if ($this->validate()) { 
     $user = new User(); 
     $user->username = $this->username; 
     $user->email = $this->email; 
     $user->setPassword($this->password); 
     $user->generateAuthKey(); 
     $user->save(false); 

     // the following three lines were added: 
     $auth = Yii::$app->authManager; 
     $authorRole = $auth->getRole('author'); 
     $auth->assign($authorRole, $user->getId()); 

     return $user; 
    } 

    return null; 
} 

通过上面的代码，所有新插入的用户都将是作者。通过下面的if语句，我可以授予或拒绝访问。

if (\Yii::$app->user->can('createPost')) { 
    // create post 
} 

if (\Yii::$app->user->can('updatePost')) { 
    // update post 
} 

到目前为止好。一切正常。上述代码的场景是，普通作者可以创建帖子，但不能更新帖子。管理员可以更新帖子，并可以做一切作者可以做的事。现在我想让普通作者能够更新他/她自己的帖子。我不知道该怎么走。我遵循Yii Guide Documentation/Secury/Authorization段落基于角色的访问控制（RBAC）。我从来没有使用过Yii 1.这就是为什么我无法解释Yii 2.0文档RBAC的简短解释。

Answer 1

你需要访问规则和文档都清楚，所以像

namespace app\rbac; 

use yii\rbac\Rule; 

/** 
* Checks if authorID matches user passed via params 
*/ 
class AuthorRule extends Rule 
{ 
    public $name = 'isAuthor'; 

    /** 
    * @param string|integer $user the user ID. 
    * @param Item $item the role or permission that this rule is associated with 
    * @param array $params parameters passed to ManagerInterface::checkAccess(). 
    * @return boolean a value indicating whether the rule permits the role or permission it is associated with. 
    */ 
    public function execute($user, $item, $params) 
    { 
     return isset($params['post']) ? $params['post']->createdBy == $user : false; 
    } 
} 

创建它，然后，

$auth = Yii::$app->authManager; 

// add the rule 
$rule = new \app\rbac\AuthorRule; 
$auth->add($rule); 

// add the "updateOwnPost" permission and associate the rule with it. 
$updateOwnPost = $auth->createPermission('updateOwnPost'); 
$updateOwnPost->description = 'Update own post'; 
$updateOwnPost->ruleName = $rule->name; 
$auth->add($updateOwnPost); 

// "updateOwnPost" will be used from "updatePost" 
$auth->addChild($updateOwnPost, $updatePost); 

// allow "author" to update their own posts 
$auth->addChild($author, $updateOwnPost); 

最后ASIGN作用注册它加入你的RBAC角色到用户

$auth = Yii::$app->authManager; 
$authorRole = $auth->getRole('author'); 
$auth->assign($authorRole, $userid_here); 

检查用户是否有能力编辑下面的使用代码，其中$ post是帖子的模型

if (\Yii::$app->user->can('updatePost', ['post' => $post])) { 
    // update post 
} 

所有这些都来自指南。 让我知道，如果你在我的脚本中有任何问题

Answer 2

if (\Yii::$app->user->can('updatePost', ['post' => $post])) { 
    // update post } 

，我改变$post与$model

if (\Yii::$app->user->can('updatePost', ['post' => $model])) { 
    // update post } 

然后它工作。