<?phpnamespaceApp\Domain;
useWebFiori\Http\SecurityPrincipal;
class User implements SecurityPrincipal {
publicfunction__construct(
publicint$id,
publicstring$name,
publicstring$role
) {
}
publicfunctiongetAuthorities(): array {
returnmatch ($this->role) {
'admin' => ['users.manage', 'orders.manage', 'orders.view'],
'customer' => ['orders.create', 'orders.view'],
default => []
};
}
publicfunctiongetId(): int|string {
return$this->id;
}
publicfunctiongetName(): string {
return$this->name;
}
publicfunctiongetRoles(): array {
return [$this->role];
}
publicfunctionisActive(): bool {
returntrue;
}
}

useWebFiori\Http\SecurityContext;
// Set authenticated user
SecurityContext::setCurrentUser($user);
// Check authentication
SecurityContext::isAuthenticated(); // true if user is set and active// Get current user$user = SecurityContext::getCurrentUser();
// Check roles and authorities
SecurityContext::hasRole('admin');
SecurityContext::hasAuthority('orders.manage');
// Clear (e.g., on logout)
SecurityContext::clear();

useWebFiori\Http\Annotations\RequiresAuth;
useWebFiori\Http\Annotations\RestController;
#[RestController('orders', 'Order API')]
#[RequiresAuth] // All methods require authenticationclass OrderService extends WebService {
publicfunctionisAuthorized(): bool {
return SecurityContext::isAuthenticated();
}
// ...
}

useWebFiori\Http\Annotations\PreAuthorize;
// Single role check
#[PreAuthorize("hasRole('admin')")]
publicfunctiondeleteUser(): array { ... }
// Single authority check
#[PreAuthorize("hasAuthority('orders.manage')")]
publicfunctionshipOrder(): array { ... }
// Multiple roles (any)
#[PreAuthorize("hasAnyRole('admin', 'moderator')")]
publicfunctionbanUser(): array { ... }
// Combined with AND
#[PreAuthorize("isAuthenticated() && hasAuthority('reports.view')")]
publicfunctiongetReport(): array { ... }
// Combined with OR
#[PreAuthorize("hasRole('admin') || hasAuthority('orders.manage')")]
publicfunctioncancelOrder(): array { ... }

#[AllowAnonymous]
publicfunctiongetPublicData(): array { ... }

useWebFiori\Framework\Access;
// Define roles with permissions
Access::role('customer', ['orders.create', 'orders.view', 'orders.cancel']);
Access::role('staff', ['orders.view', 'orders.update', 'orders.ship']);
Access::role('admin', ['orders.create', 'orders.view', 'orders.cancel',
'orders.update', 'orders.ship', 'orders.manage']);
// Assign role to user (for storage-backed scenarios)
Access::assignRoleToUser($userId, 'customer');

Access::role('manager', ['reports.view'])->inherits('staff');
// manager now has: reports.view + all staff permissions

// Pass user object — reads roles from getRoles() if no internal mapping exists
Access::can($user, 'orders.cancel');
// Pass user ID — uses roles from assignRoleToUser() or storage
Access::can(42, 'orders.cancel');

useWebFiori\Framework\AccessManager;
useWebFiori\Framework\Storage\DatabaseAccessStorage;
$manager = newAccessManager(newDatabaseAccessStorage($connectionName));
$manager->loadFromStorage(); // load roles/permissions from DB

$manager->saveToStorage();

<?phpnamespaceApp\Policies;
useApp\Domain\Order;
class OrderCancelPolicy {
publicfunctiongetPermission(): string {
return'orders.cancel';
}
publicfunctionevaluate($user, ?object$resource = null): bool {
if ($resource === null || !$resourceinstanceof Order) {
returnfalse;
}
// Only pending orders can be cancelledif ($resource->status !== 'pending') {
returnfalse;
}
// Admin can cancel any pending orderif (in_array('admin', $user->getRoles())) {
returntrue;
}
// Customers can only cancel their own ordersreturn$user->getId() === $resource->userId;
}
}

useApp\Policies\OrderCancelPolicy;
useWebFiori\Framework\Access;
Access::registerPolicy(newOrderCancelPolicy());

$order = $orderRepo->findById($id);
if (!Access::can($user, 'orders.cancel', $order)) {
thrownewForbiddenException('You cannot cancel this order.');
}

<?phpnamespaceApp\Ini;
useApp\Policies\OrderCancelPolicy;
useApp\Policies\OrderViewPolicy;
useWebFiori\Framework\Access;
class Privileges {
publicstaticfunctioninitialize() {
// RBAC
Access::role('customer', ['orders.create', 'orders.view', 'orders.cancel']);
Access::role('admin', ['orders.create', 'orders.view', 'orders.cancel', 'orders.manage']);
// ABAC
Access::registerPolicy(newOrderViewPolicy());
Access::registerPolicy(newOrderCancelPolicy());
}
}

<?phpnamespaceApp\Middleware;
useWebFiori\Framework\Access;
useWebFiori\Framework\Middleware\AbstractMiddleware;
useWebFiori\Http\SecurityContext;
class SecurityContextLoader extends AbstractMiddleware {
publicfunctionbefore(Request$request, Response$response) {
$userId = SessionsManager::get('user-id');
if ($userId === null) {
SecurityContext::clear();
return;
}
$user = $this->loadUser($userId);
if ($user !== null && $user->isActive()) {
SecurityContext::setCurrentUser($user);
Access::assignRoleToUser($user->getId(), $user->role);
}
}
}

#[RestController('orders', 'Order API')]
#[RequiresAuth]
class OrderService extends WebService {
publicfunctionisAuthorized(): bool {
return SecurityContext::isAuthenticated();
}
#[DeleteMapping]
#[PreAuthorize("hasAuthority('orders.cancel')")]
publicfunctioncancelOrder(?int$id = null): array {
$order = $this->repo->findById($id);
$user = SecurityContext::getCurrentUser();
// ABAC: policy checks ownership + statusif (!Access::can($user, 'orders.cancel', $order)) {
thrownewForbiddenException('Cannot cancel this order.');
}
$order->status = 'cancelled';
$this->repo->save($order);
return [$order];
}
}