Yii2.按角色进行访问控制。如何添加“或”条件？答案

【问题标题】：Yii2. Access control by roles. How can I add 'OR' condition?Yii2.按角色进行访问控制。如何添加“或”条件？
【发布时间】：2017-09-14 14:23:08
【问题描述】：

我有一个具有以下访问限制的控制器：

'access' => [
                'class' => AccessControl::className(),
                'only' => ['index', 'view', 'create', 'update', 'delete'],
                'rules' => [
                    [
                        'actions' => ['index', 'view'],
                        'allow' => true,
                        'roles' => [RbacComponent::VIEW_EXPENSES_ACCOUNTS_KEY],
                    ],
                    [
                        'actions' => ['create'],
                        'allow' => true,
                        'roles' => [RbacComponent::CREATE_EXPENSES_ACCOUNTS_KEY],
                    ],
                    [
                        'actions' => ['update'],
                        'allow' => true,
                        'roles' => [RbacComponent::EDIT_EXPENSES_ACCOUNTS_KEY],
                    ],
                    [
                        'actions' => ['delete'],
                        'allow' => true,
                        'roles' => [RbacComponent::DELETE_EXPENSES_ACCOUNTS_KEY],
                    ],
                ],
            ],

如何将 'OR' \Yii::$app->user->identity->isOwner() 添加到所有这些规则中？

我尝试使用这个变体：

            [
                'actions' => ['index', 'view'],
                'allow' => true,
                'roles' => [RbacComponent::VIEW_EXPENSES_ACCOUNTS_KEY],
                'matchCallback' => function ($rule, $action) {
                    return \Yii::$app->user->identity->isOwner();
                }
            ],

但是，在这种情况下，它将是“AND”并且不起作用。

我认为这个变种会起作用：

            'rules' => [
                [
                    'actions' => ['index', 'view', 'create', 'update', 'delete'],
                    'allow' => true,
                    'roles' => ['@'],
                    'matchCallback' => function ($rule, $action) {
                        if ($action == 'index') {
                           if (\Yii::$app->user->identity->isOwner() || \Yii::$app->user->can(RbacComponent::VIEW_EXPENSES_ACCOUNTS_KEY)) {
                              return true;
                          }
                        }

                        ... other actions

                    }
                ],

但也许有更好更简单的方法？

【问题讨论】：

标签： yii yii2 yii2-advanced-app yii2-basic-app yii2-validation

【解决方案1】：

您可以简单地在回调中添加一条规则：

'rules' => [
    [
        'actions' => ['index', 'view'],
        'allow' => true,
        'roles' => [RbacComponent::VIEW_EXPENSES_ACCOUNTS_KEY],
    ],
    [
        'actions' => ['create'],
        'allow' => true,
        'roles' => [RbacComponent::CREATE_EXPENSES_ACCOUNTS_KEY],
    ],
    [
        'actions' => ['update'],
        'allow' => true,
        'roles' => [RbacComponent::EDIT_EXPENSES_ACCOUNTS_KEY],
    ],
    [
        'actions' => ['delete'],
        'allow' => true,
        'roles' => [RbacComponent::DELETE_EXPENSES_ACCOUNTS_KEY],
    ],
    [
        'actions' => ['index', 'view', 'create', 'update', 'delete'],
        'allow' => true,
        'matchCallback' => function ($rule, $action) {
            return \Yii::$app->user->identity->isOwner();
        },
    ],
],

【讨论】：

感谢您的回答。我会尽力做到这一点。

【解决方案2】：

这应该可以工作

[
    'allow' => true,
    'roles' => ['owner'],
],

【讨论】：

感谢您的回答，但owner 不是角色。这是一种方法。
但是您可以将owner 设为角色并为该角色添加一些规则。