php - Generating a list of permissions -

this question has answer here:

• how can implement access control list in web mvc application? 3 answers

i'm working on custom framework strictly fun , educational purposes. i've read on this question on how implement permissions , answers; either using decorator pattern , / or checking permissions based on url dispatcher.

my question how white list of permissions should generated? don't want every method in controllers require permission execute, could, example, use special naming convention such preceding method names "x":

class calendarcontroller {     public function index($year = null, $month = null, $day = null)     {         // display calendar (no permission needed)     }      public function xaddevent()     {         // display form add event (permission required)     }      public function xaddeventsubmit()     {         // submit form add event (permission required)     } } 

i write script iterate through of controllers , return x-methods, giving me list of permissions assign different roles.

another option hard-code permissions property of each controller, example:

class calendarcontroller {     public $permissions = array('addevent',                                 'addeventsubmit');      public function index($year = null, $month = null, $day = null)     {         // display calendar (no permission needed)     }       public function addevent()     {         // display form add event (permission required)     }      public function addeventsubmit()     {         // submit form add event (permission required)     } } 

are there better alternatives or on right track?

_{note: expansion on solution provided in linked article. not comment on answers hakre.}

as understand question, issue not want set access rights each method separately.

option 1: don't decorate

in solution, involves decorator, 1 of benefits that, when use secured class (for example controller, though can part of application), not need know has been decorated. therefore, if have controllers should accessible anyone, can not decorate those.

this approach require factory, responsible instantiation of controller, have list of controller should or should-not wrapped in decorator. since require if statement consult list, consider instances on call more 1 method (which, in case, exclude controllers).

option 2: wildcards , whitelists

a different way tackle take advantage of how check authorization.

$command = [ get_class($this->target), $method ]; 

this token, checked against. means acl receives not name of method, full class name (including namespace, btw). gives opportunity create list of rules include both name of class , method. along lines of:

controllers\identification::*  anonymous controllers\*::*               admin controllers\users::view        authenticated controllers\users::remove      manager controllers\users::add         manager 

the idea save configuration define allowed interactions. acl goes down list, checking user's group, , on first match returns result (in example admins can access except login page, allowed unauthenticated users). again, particular example depend on implementing @ least partial groups-contain-groups functionality.

i reiterate, should use white-lists this. there no significant risk added, if forget allow managers remove users, but, if forget deny users remove other users, can critical mistake when using blacklist based authorization.

_{my 2 cents}