Abilities Plugin for CakePHP 2.x

Abilities is a (very) simple authorization plugin inspired by CanCan.

If you are looking for 1.3 version check 1.3 branch.

Installation

• Clone/Copy plugin files files into app/Plugin/Abilities
• Load plugin in app/Config/bootstrap.php:
  • CakePlugin::load('Abilities');
• Include the ability component in your AppController.php:
  • public $components = array('Abilities.Ability');
• Create AppAbility.php in your app/Lib folder

Also, your AppController must respond to currentUser(). I.e.:

public function currentUser() {
return $this->User->findById($this->Auth->user('id'));
}

Define abilities

In your newly created AppAbiliy.php define it like that:

App::import('Lib', 'Abilities.Ability');
class AppAbility extends Ability {
public function __construct($user) {
parent::__construct($user);
# allow everybody to comment
$this->allow('create', 'Comment');
if (empty($user)) {
# guest
} else {
# some authenticated user
# allow any authenticated user to create posts
$this->allow('create', 'Post');
if ($user['User']['role'] == 'admin') {
# allow admins to do anything
$this->allow('manage', 'all');
} else {
# allow users to edit their profiles. condition is an expression to call with Set::matches
$this->allow('update', 'User', "/User[id={$user['User']['id']}]");
# ... and their posts. condition is a callback
$this->allow('update', 'Post', array($this, 'checkPostAuthor'), true);
}
}
}
public function checkPostAuthor($post) {
return ($post['Post']['user_id'] == $this->user['User']['id']);
}
}

Check abilities

In a view:

<?php if ($this->Ability->check('create', 'Post')): ?>
<?php echo $this->Html->link('New Post', array('action' => 'add')); ?>
<?php endif; ?>
...
<?php if ($this->Ability->check('update', 'Post', $post)): ?>
<?php echo $this->Html->link('Edit', array('action' => 'edit', $post['Post']['id'])); ?>
<?php endif; ?>

In a controller:

function edit($id = null) { $post = $this->Post->read(null, $id); $this->Ability->authorize('update', 'Post', $post);
...
}

This will raise an exception if the user is not allowed to perform the given action. Alternatively, you can set up an error handler. In the AppController:

public function beforeFilter() { $this->Ability->setErrorHandler(array($this, 'onNotAbleError'));
}
public function onNotAbleError() {
$this->Session->setFlash('You are not welcome here');
$this->redirect('/');
}