josegonzalez/sanction — Issue #14: Readme Help Doc Updates - Listing permissions low to high
Author: sugitime
Created: 2011-12-19 18:00:01+00:00
State: open

It will be useful to know that the order in which the permissions are declared must be low to high. For instance:

// If this access declaration comes first, this will be the ONLY declaration that Sanction uses. Once this fails, Sanction will
// not continue on to other rules
Permit::access(
array('controller' => array('posts', 'configs', 'comments'),
array('auth' => array('User.role' => array('admin'))),
array('redirect' => array('controller' => 'posts', 'action' => 'view')
);

// So this declaration will be effectively useless.
Permit::access(
array('controller' => array('posts'), 'action' => array('edit'),
array('auth' => array('User.role' => array('admin'))),
array('redirect' => array('controller' => 'posts', 'action' => 'view')
);

To do what is trying to be done here, the most restrictive rule (i.e. the one that limits the controller AND action, as opposed to just the controller) should come first. So this is how it should be declared:

Permit::access(
array('controller' => array('posts'), 'action' => array('edit'),
array('auth' => array('User.role' => array('admin'))),
array('redirect' => array('controller' => 'posts', 'action' => 'view')
);

Permit::access(
array('controller' => array('posts', 'configs', 'comments'),
array('auth' => array('User.role' => array('admin'))),
array('redirect' => array('controller' => 'posts', 'action' => 'view')
);