The Bakery Everything CakePHP

Update: 14th May 2008

After some discussion regarding this component (thanks Sam), I thought I would point out at this stage that the component is really geared towards "Role-based" authentication, something I hadn't even noticed at while building it.

That being said, it makes it even more unlikely that it would be used in a non-HABTM type situation - so be aware if you are thinking of using this is a "User belongsTo Group" that you may find it hard to get the fluid access control you want.

On the other hand if you are using it purely to restrict access with NO group control, then it couldn't be easier!

Firstly thanks to everyone who encouraged me after the first release of DarkAuth. Looking back at it, it was flawed yet I got support from the community and have worked to better it.

Again, I'd better whet your appetite with just how easy it is to use.

Let's say you have a SecretsController which you want to restrict access to:

Controller Class:

Download code <?php 
class SecretsController extends AppController {
  var $name = 'Secrets';
  var $_DarkAuth;

...

}
?>
See what I did there? Now you'd have to be logged in to access this Controller. So, now you want to refine this to allow only logged on users that are a member of the group Admin or the group SecretKeepers. Easy!

Controller Class:

Download code <?php 
class SecretsController extends AppController {
  var $name = 'Secrets';
  var $_DarkAuth = array('required'=>array('Admin','SecretKeepers'));

...

}
?>
Not bad eh? So moving on, by default your users if not allowed access will see your specified "deny" page, but you want them to be redirected back to /public. Again, straightforward.

Controller Class:

Download code <?php 
class SecretsController extends AppController {
  var $name = 'Secrets';
  var $_DarkAuth = array(
         'required'=>array('Admin','SecretKeepers'),
         'onDeny'=>'/public'
      );

...

}
?>
Now, any attempt to access your SecretsController will be presented with a login page if not logged in and if logged in but not a member of the group, will be redirected to /public.

This can be done per action as well, to further enhance the usefullness of the component. E.g. you have a DocumentsController which might have some top secret documents in it. You only want members of the group TopBrass to be able to see them.

Controller Class:

Download code <?php 
  function display($id=0){
    $this->Document->id = $id;
    $doc = $this->Document->read();

    if($doc['Document']['top_secret'] == true){
       $this->DarkAuth->requiresAuth('TopBrass');
    }
    ...

  }
?>
Note that the function DarkAuth::requiresAuth() stops processing after you call it and will bring up an "access denied" view if authentication fails. So no need to exit().

Or more common if you wanted to show content based on whether authentication was present? The DarkAuth::isAllowed() function returns whether access is allowed, but doesn't stop processing:

Controller Class:

Download code <?php 
  if($this->DarkAuth->isAllowed(array('ChocolateLover'))){
    $data = $this->CookieJar->findAll(array('Chocolate'=>true));
  }else{
    $data = $this->CookieJar->findAll(array('Chocolate'=>false));
  }
?>
The final selling point (in my opinion)! $_DarkAuth available in the View, automatically populated with the user info from the user model and the access control list. e.g.

View Template:

Download code
<?php
  pr($_DarkAuth);
?>

Yields if logged in:

Download code
array(
      'User' => array(
                      'id' => 1
                      'username' => superstar
                      'password' => abcdef1234567890abcdef1234567890
                      'other_info' => Some data
                )
  'Access' => array(
                    'group_you_have_access_to' => 1
                    'another_group_you_have_access_to' => 1
                    'group_you_have_NO_access_to' => 0
              )
)

Which means you can do this:

View Template:

Download code
<?php
if(!empty($_DarkAuth['User'])){ 
  echo "Some content for logged in people!";
}
if($_DarkAuth['Access']['some_group']){
  echo "You have access to 'some_group'";
}else{
  echo "You don't have access to 'some_group'";
}
?>

Convinced? I hope so. Now on the Code and Setup!