Documentation

Acl
in package

ACL class

Tags
category

Pop

author

Nick Sagona, III nick@popphp.org

copyright

Copyright (c) 2009-2026 Nick Sagona, III

license

https://www.popphp.org/license New BSD License

version
5.0.0

Table of Contents

Properties

$allowed  : array<string|int, mixed>
Array of allowed roles, resources and permissions
$assertions  : array<string|int, mixed>
Array of assertions
$denied  : array<string|int, mixed>
Array of denied roles, resources and permissions
$multiStrict  : bool
Multi strict flag
$parentStrict  : bool
Parent strict flag
$policies  : array<string|int, mixed>
Array of policies
$resources  : array<string|int, mixed>
Array of resources
$roles  : array<string|int, mixed>
Array of roles
$strict  : bool
Strict flag

Methods

__construct()  : mixed
Constructor
addPolicy()  : Acl
Add policy
addResource()  : Acl
Add a resource
addResources()  : Acl
Add resources
addRole()  : Acl
Add a role
addRoles()  : Acl
Add roles
allow()  : Acl
Allow a role permission to a resource or resources
createAssertion()  : void
Create assertion
deleteAssertion()  : void
Delete assertion
deny()  : Acl
Deny a role permission to a resource or resources
evaluatePolicies()  : bool|null
Evaluate policies
evaluatePolicy()  : bool|null
Evaluate policy
getAllowedPermissions()  : array<string|int, mixed>
Get the effective allowed permissions for a role on a resource, merged with inheritance. Returns ['*'] if access is unrestricted (either via an explicit '*' permission or an empty permission list at any level of the role's parent chain), or [] if no rule exists.
getAssertionKey()  : string|null
Get assertion key
getDeniedPermissions()  : array<string|int, mixed>
Get the effective denied permissions for a role on a resource, merged with inheritance. Returns ['*'] if denial is unrestricted (either via an explicit '*' permission or an empty permission list at any level of the role's parent chain), or [] if no rule exists.
getResource()  : AclResource|null
Get a resource
getResources()  : array<string|int, mixed>
Get resources
getRole()  : AclRole|null
Get a role
getRoles()  : array<string|int, mixed>
Get roles
hasAssertionKey()  : bool
Has assertion key
hasPolicies()  : bool
Has policies
hasResource()  : bool
See if a resource has been added
hasResources()  : bool
Has resources
hasRole()  : bool
See if a role has been added
hasRoles()  : bool
Has roles
isAllowed()  : bool
Determine if the role is allowed
isAllowedMulti()  : bool
Determine if multiple roles are allowed
isAllowedMultiStrict()  : bool
Determine if multiple roles are allowed using the strict parameter All of the roles must be allowed to return true, otherwise it will return false
isDenied()  : bool
Determine if a role is denied
isDeniedMulti()  : bool
Determine if multiple roles are denied
isDeniedMultiStrict()  : bool
Determine if multiple roles are denied using the strict parameter All of the roles must be denied to return true, otherwise it will return false
isMultiStrict()  : bool
See if ACL object is set to multi strict
isParentStrict()  : bool
See if ACL object is set to parent strict
isStrict()  : bool
See if ACL object is set to strict
removeAllowRule()  : Acl
Remove an allow rule
removeDenyRule()  : Acl
Remove a deny rule
removeResource()  : Acl
Remove a resource
removeRole()  : Acl
Remove a role
setMultiStrict()  : Acl
Set multi strict
setParentStrict()  : Acl
Set parent strict
setStrict()  : Acl
Set strict
deleteRuleAssertions()  : void
Delete the assertions for a role/resource's full permission set, shared by removeRole() and removeResource()
generateAssertionKey()  : string
Generate assertion key
getEffectivePermissions()  : array<string|int, mixed>
Shared walk for getAllowedPermissions()/getDeniedPermissions()
removeRule()  : Acl
Shared implementation for removeAllowRule()/removeDenyRule()
resolveDenied()  : bool
Shared deny evaluation used by isDenied() and, internally, isAllowed() (which passes in an already-evaluated policy result to avoid evaluating policies twice per isAllowed() call).
setRule()  : Acl
Shared implementation for allow()/deny()
traverseChildren()  : void
Traverse child roles to add them to the ACL object
verifyResource()  : bool
Verify resource
verifyRole()  : bool
Verify role

Properties

$allowed

Array of allowed roles, resources and permissions

protected array<string|int, mixed> $allowed = []

$assertions

Array of assertions

protected array<string|int, mixed> $assertions = ['allowed' => [], 'denied' => []]

$denied

Array of denied roles, resources and permissions

protected array<string|int, mixed> $denied = []

$multiStrict

Multi strict flag

protected bool $multiStrict = false

$parentStrict

Parent strict flag

protected bool $parentStrict = false

$policies

Array of policies

protected array<string|int, mixed> $policies = []

$resources

Array of resources

protected array<string|int, mixed> $resources = []

$roles

Array of roles

protected array<string|int, mixed> $roles = []

$strict

Strict flag

protected bool $strict = false

Methods

__construct()

Constructor

public __construct() : mixed

Instantiate the ACL object

addPolicy()

Add policy

public addPolicy(string $method, mixed $role[, mixed $resource = null ]) : Acl
Parameters
$method : string
$role : mixed
$resource : mixed = null
Return values
Acl

addResources()

Add resources

public addResources(array<string|int, mixed> $resources) : Acl
Parameters
$resources : array<string|int, mixed>
Return values
Acl

addRoles()

Add roles

public addRoles(array<string|int, mixed> $roles) : Acl
Parameters
$roles : array<string|int, mixed>
Return values
Acl

allow()

Allow a role permission to a resource or resources

public allow(mixed $role[, mixed $resource = null ][, mixed $permission = null ][, AssertionInterface|null $assertion = null ]) : Acl
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
$assertion : AssertionInterface|null = null
Tags
throws
Exception
Return values
Acl

createAssertion()

Create assertion

public createAssertion(AssertionInterface $assertion, string $type, mixed $role[, mixed $resource = null ][, string|null $permission = null ]) : void
Parameters
$assertion : AssertionInterface
$type : string
$role : mixed
$resource : mixed = null
$permission : string|null = null
Tags
throws
InvalidArgumentException

deleteAssertion()

Delete assertion

public deleteAssertion(string $type, mixed $role[, mixed $resource = null ][, string|null $permission = null ]) : void
Parameters
$type : string
$role : mixed
$resource : mixed = null
$permission : string|null = null

deny()

Deny a role permission to a resource or resources

public deny(mixed $role[, mixed $resource = null ][, mixed $permission = null ][, AssertionInterface|null $assertion = null ]) : Acl
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
$assertion : AssertionInterface|null = null
Tags
throws
Exception
Return values
Acl

evaluatePolicies()

Evaluate policies

public evaluatePolicies([mixed $role = null ][, mixed $resource = null ][, mixed $permission = null ]) : bool|null
Parameters
$role : mixed = null
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
throws
Exception

if a policy method isn't callable on the role

Return values
bool|null

evaluatePolicy()

Evaluate policy

public evaluatePolicy(string $method, mixed $role[, mixed $resource = null ]) : bool|null
Parameters
$method : string
$role : mixed
$resource : mixed = null
Tags
throws
Exception
throws
Exception

if a policy method isn't callable on the role

Return values
bool|null

getAllowedPermissions()

Get the effective allowed permissions for a role on a resource, merged with inheritance. Returns ['*'] if access is unrestricted (either via an explicit '*' permission or an empty permission list at any level of the role's parent chain), or [] if no rule exists.

public getAllowedPermissions(mixed $role, mixed $resource) : array<string|int, mixed>
Parameters
$role : mixed
$resource : mixed
Tags
throws
Exception
Return values
array<string|int, mixed>

getAssertionKey()

Get assertion key

public getAssertionKey(string $type, mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : string|null
Parameters
$type : string
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
InvalidArgumentException
Return values
string|null

getDeniedPermissions()

Get the effective denied permissions for a role on a resource, merged with inheritance. Returns ['*'] if denial is unrestricted (either via an explicit '*' permission or an empty permission list at any level of the role's parent chain), or [] if no rule exists.

public getDeniedPermissions(mixed $role, mixed $resource) : array<string|int, mixed>
Parameters
$role : mixed
$resource : mixed
Tags
throws
Exception
Return values
array<string|int, mixed>

getResource()

Get a resource

public getResource(string $resource) : AclResource|null
Parameters
$resource : string
Return values
AclResource|null

getResources()

Get resources

public getResources() : array<string|int, mixed>
Return values
array<string|int, mixed>

getRole()

Get a role

public getRole(string $role) : AclRole|null
Parameters
$role : string
Return values
AclRole|null

getRoles()

Get roles

public getRoles() : array<string|int, mixed>
Return values
array<string|int, mixed>

hasAssertionKey()

Has assertion key

public hasAssertionKey(string $type, mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$type : string
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
InvalidArgumentException
Return values
bool

hasPolicies()

Has policies

public hasPolicies() : bool
Return values
bool

hasResource()

See if a resource has been added

public hasResource(string $resource) : bool
Parameters
$resource : string
Return values
bool

hasResources()

Has resources

public hasResources() : bool
Return values
bool

hasRole()

See if a role has been added

public hasRole(string $role) : bool
Parameters
$role : string
Return values
bool

hasRoles()

Has roles

public hasRoles() : bool
Return values
bool

isAllowed()

Determine if the role is allowed

public isAllowed(mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isAllowedMulti()

Determine if multiple roles are allowed

public isAllowedMulti(array<string|int, mixed> $roles[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$roles : array<string|int, mixed>
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isAllowedMultiStrict()

Determine if multiple roles are allowed using the strict parameter All of the roles must be allowed to return true, otherwise it will return false

public isAllowedMultiStrict(array<string|int, mixed> $roles[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$roles : array<string|int, mixed>
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isDenied()

Determine if a role is denied

public isDenied(mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isDeniedMulti()

Determine if multiple roles are denied

public isDeniedMulti(array<string|int, mixed> $roles[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$roles : array<string|int, mixed>
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isDeniedMultiStrict()

Determine if multiple roles are denied using the strict parameter All of the roles must be denied to return true, otherwise it will return false

public isDeniedMultiStrict(array<string|int, mixed> $roles[, mixed $resource = null ][, mixed $permission = null ]) : bool
Parameters
$roles : array<string|int, mixed>
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
bool

isMultiStrict()

See if ACL object is set to multi strict

public isMultiStrict() : bool
Return values
bool

isParentStrict()

See if ACL object is set to parent strict

public isParentStrict() : bool
Return values
bool

isStrict()

See if ACL object is set to strict

public isStrict() : bool
Return values
bool

removeAllowRule()

Remove an allow rule

public removeAllowRule(mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : Acl
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
Acl

removeDenyRule()

Remove a deny rule

public removeDenyRule(mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : Acl
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
Acl

removeResource()

Remove a resource

public removeResource(mixed $resource) : Acl

All allow/deny rules, assertions and policies referencing this resource (across every role) are purged.

Parameters
$resource : mixed
Tags
throws
Exception
Return values
Acl

removeRole()

Remove a role

public removeRole(mixed $role) : Acl

Children are reparented onto the removed role's own parent (or become root roles if it had none). All allow/deny rules, assertions and policies referencing this role are purged.

Parameters
$role : mixed
Tags
throws
Exception
Return values
Acl

setMultiStrict()

Set multi strict

public setMultiStrict([bool $multiStrict = true ]) : Acl
Parameters
$multiStrict : bool = true
Return values
Acl

setParentStrict()

Set parent strict

public setParentStrict([bool $parentStrict = true ]) : Acl
Parameters
$parentStrict : bool = true
Return values
Acl

setStrict()

Set strict

public setStrict([bool $strict = true ][, bool|null $multiStrict = null ]) : Acl
Parameters
$strict : bool = true
$multiStrict : bool|null = null
Return values
Acl

deleteRuleAssertions()

Delete the assertions for a role/resource's full permission set, shared by removeRole() and removeResource()

protected deleteRuleAssertions(string $type, string $roleName, string $resourceName, array<string|int, mixed> $permissions) : void
Parameters
$type : string
$roleName : string
$resourceName : string
$permissions : array<string|int, mixed>

generateAssertionKey()

Generate assertion key

protected generateAssertionKey(mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : string
Parameters
$role : mixed
$resource : mixed = null
$permission : mixed = null
Return values
string

getEffectivePermissions()

Shared walk for getAllowedPermissions()/getDeniedPermissions()

protected getEffectivePermissions(string $type, mixed $role, mixed $resource) : array<string|int, mixed>
Parameters
$type : string
$role : mixed
$resource : mixed
Tags
throws
Exception
Return values
array<string|int, mixed>

removeRule()

Shared implementation for removeAllowRule()/removeDenyRule()

protected removeRule(string $type, mixed $role[, mixed $resource = null ][, mixed $permission = null ]) : Acl
Parameters
$type : string
$role : mixed
$resource : mixed = null
$permission : mixed = null
Tags
throws
Exception
Return values
Acl

resolveDenied()

Shared deny evaluation used by isDenied() and, internally, isAllowed() (which passes in an already-evaluated policy result to avoid evaluating policies twice per isAllowed() call).

protected resolveDenied(mixed $role, mixed $resource, mixed $permission, bool|null $policyResult) : bool
Parameters
$role : mixed
$resource : mixed
$permission : mixed
$policyResult : bool|null
Tags
throws
Exception
Return values
bool

setRule()

Shared implementation for allow()/deny()

protected setRule(string $type, mixed $role[, mixed $resource = null ][, mixed $permission = null ][, AssertionInterface|null $assertion = null ]) : Acl
Parameters
$type : string
$role : mixed
$resource : mixed = null
$permission : mixed = null
$assertion : AssertionInterface|null = null
Tags
throws
Exception
Return values
Acl

traverseChildren()

Traverse child roles to add them to the ACL object

protected traverseChildren(array<string|int, mixed> $childRoles) : void
Parameters
$childRoles : array<string|int, mixed>

verifyResource()

Verify resource

protected verifyResource(mixed $resource) : bool
Parameters
$resource : mixed
Tags
throws
Exception
Return values
bool

verifyRole()

Verify role

protected verifyRole(mixed $role) : bool
Parameters
$role : mixed
Tags
throws
Exception
Return values
bool 

        

        
    




    

    

                                

                

                                
    

        On this page

        
    


                

                            

            

    

        

            
Search results