Yii-Permission

Use Casbin in Yii 2.0 PHP Framework.

Installation

Getting Composer package

Require this package in the composer.json of your Yii 2.0 project. This will download the package.

composer require casbin/yii-permission

Configuring application

To use this extension, you have to configure the Casbin class in your application configuration:

return [
    //....
    'components' => [
        'permission' => [
            'class' => \yii\permission\Permission::class,
            
            /*
             * Casbin model setting.
             */
            'model' => [
                // Available Settings: "file", "text"
                'config_type' => 'file',
                'config_file_path' => '/path/to/casbin-model.conf',
                'config_text' => '',
            ],

            // Casbin adapter .
            'adapter' => \yii\permission\Adapter::class,

            /*
             * Casbin database setting.
             */
            'database' => [
                // Database connection for following tables.
                'connection' => '',
                // CasbinRule tables and model.
                'casbin_rules_table' => '{{%casbin_rule}}',
            ],
        ],
    ]
];

Usage

Quick start

Once installed you can do stuff like this:

$permission = \Yii::$app->permission;

// adds permissions to a user
$permission->addPermissionForUser('eve', 'articles', 'read');
// adds a role for a user.
$permission->addRoleForUser('eve', 'writer');
// adds permissions to a rule
$permission->addPolicy('writer', 'articles','edit');

You can check if a user has a permission like this:

// to check if a user has permission
if ($permission->enforce("eve", "articles", "edit")) {
    // permit eve to edit articles
} else {
    // deny the request, show an error
}

Using Enforcer Api

It provides a very rich api to facilitate various operations on the Policy:

Gets all roles:

$permission->getAllRoles(); // ['writer', 'reader']

Gets all the authorization rules in the policy.:

$permission->getPolicy();

Gets the roles that a user has.

$permission->getRolesForUser('eve'); // ['writer']

Gets the users that has a role.

$permission->getUsersForRole('writer'); // ['eve']

Determines whether a user has a role.

$permission->hasRoleForUser('eve', 'writer'); // true or false

Adds a role for a user.

$permission->addRoleForUser('eve', 'writer');

Adds a permission for a user or role.

// to user
$permission->addPermissionForUser('eve', 'articles', 'read');
// to role
$permission->addPermissionForUser('writer', 'articles','edit');

Deletes a role for a user.

$permission->deleteRoleForUser('eve', 'writer');

Deletes all roles for a user.

$permission->deleteRolesForUser('eve');

Deletes a role.

$permission->deleteRole('writer');

Deletes a permission.

$permission->deletePermission('articles', 'read'); // returns false if the permission does not exist (aka not affected).

Deletes a permission for a user or role.

$permission->deletePermissionForUser('eve', 'articles', 'read');

Deletes permissions for a user or role.

// to user
$permission->deletePermissionsForUser('eve');
// to role
$permission->deletePermissionsForUser('writer');

Gets permissions for a user or role.

$permission->getPermissionsForUser('eve'); // return array

Determines whether a user has a permission.

$permission->hasPermissionForUser('eve', 'articles', 'read');  // true or false

Using Yii Authorization

It allows you to integrate Yii's authorization with the Casbin permission management system.

(1) AccessChecker

Add the accessChecker configuration in your application's config/web.php file:

$config = [
    'components' => [
        'user' => [
            ...
            'accessChecker' => 'yii\permission\components\PermissionChecker',
        ]
];

Once configured, you can use the can() method to check if a user has permission to perform certain actions:

$user->can('acrticles,read');

(2) Behaviors

The PermissionControl behavior allows you to enforce permission checks at the controller level. Add the PermissionControl behavior to your controller's behaviors() method:

public function behaviors()
{
    return [
        'permission' => [
            'class' => \yii\permission\components\PermissionControl::class,
            'user' => $user, // optional, defaults to \Yii::$app->user
            'only' => ['read-articles', 'write-articles'],
            'policy' => [
                [
                    'allow' => true,
                    'actions' => ['read-articles'],
                    'enforce' => ['articles', 'read']
                ],
                [
                    'allow' => true,
                    'actions' => ['write-articles'],
                    'enforce' => ['articles', 'write']
                ]
            ],
            'denyCallback' => function ($policy, $action) {
                // custom action when access is denied
            } // optional, defaults to throwing an exception
        ]
    ];
}

Note: Additionally,You can also configure a denyCallback for each policy, which will be invoked when the user does not meet the required permission. This callback takes precedence. The configuration is similar to Yii's official AccessControl.

See Casbin API for more APIs.

Define your own model.conf

Supported models.

Learning Casbin

You can find the full documentation of Casbin on the website.