PHPackages                             oat-sa/extension-tao-dac-simple - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. oat-sa/extension-tao-dac-simple

ActiveTao-extension

oat-sa/extension-tao-dac-simple
===============================

extension that allows admin to give access to some resources to other people

v10.0.0(2mo ago)580.8k↑37.5%31GPL-2.0-onlyPHPCI passing

Since Sep 22Pushed 2mo ago42 watchersCompare

[ Source](https://github.com/oat-sa/extension-tao-dac-simple)[ Packagist](https://packagist.org/packages/oat-sa/extension-tao-dac-simple)[ Docs](http://www.taotesting.com)[ RSS](/packages/oat-sa-extension-tao-dac-simple/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (5)Versions (161)Used By (1)

Simple Data Access Control
==========================

[](#simple-data-access-control)

[![codecov](https://camo.githubusercontent.com/926803afb1c3f77b70df784ce743c007ae2b57da40472596fed4f94a315e1ede/68747470733a2f2f636f6465636f762e696f2f67682f6f61742d73612f657874656e73696f6e2d74616f2d6461632d73696d706c652f6272616e63682f6d61737465722f67726170682f62616467652e7376673f746f6b656e3d6e4a6c72673563513337)](https://codecov.io/gh/oat-sa/extension-tao-dac-simple)

Simple Data Access Control allows the restriction of which user can access which resources, in the way compatible with Advanced Search.

Access Privileges are granted either to users directly or to roles, applying to all users who have that specific role.

Privileges are given per resource, so that in order to remove the write access to all items within a class, the new access rights need to be applied recursively to all resources by checking "recursive" before saving the changes.

Privileges are additive, meaning that if:

- Role A has write and read access to Item 1
- User X has read access to Item 1
- And User X has the Role A

Then User X he will have read and write access to Item 1

How to enable ACL management
----------------------------

[](#how-to-enable-acl-management)

In order to see the `Access control` button on the backoffice panel a few changes are necessary.

### Enable this in the actions

[](#enable-this-in-the-actions)

Change the `actions/structures.xml` file by adding the attribute `allowClassActions="true"` in the `actions` node:

```

```

### Enable ACL in an endpoint

[](#enable-acl-in-an-endpoint)

Add the annotation `requiresRight` with proper `field` and `grant level` to check permissions:

```
class MyController extends tao_actions_SaSModule
{
    /**
     * @requiresRight id READ
     */
    public function editInstance()
    {
      //...
    }
}
```

### Checking ACL internally (without annotations) in the endpoint

[](#checking-acl-internally-without-annotations-in-the-endpoint)

If extending `tao_actions_RdfController` we can use the method `hasWriteAccess`:

```
class MyController extends tao_actions_SaSModule
{
    public function editItem()
    {
        $item = $this->getCurrentInstance();

        if ($this->hasWriteAccess($item->getUri())) {
            // Do something
        }
    }
}
```

Or we can use the `DataAccessControl` implementation directly:

```
$user = $this->getSession()->getUser();
$item = $this->getCurrentInstance();
$dataAccessControl = new \oat\tao\model\accessControl\data\DataAccessControl();

$canWrite = $dataAccessControl->hasPrivileges($user, [$item->getUri() => 'WRITE']);
$canRead = $dataAccessControl->hasPrivileges($user, [$item->getUri() => 'READ']);
```

Permissions save strategies
---------------------------

[](#permissions-save-strategies)

Currently, we have the following saving/propagating permissions strategies:

- [SyncPermissionsStrategy](./model/SyncPermissionsStrategy.php) (Default): Overwrites existent permissions with the new ones provided by the user.
- [SavePermissionsStrategy](./model/SavePermissionsStrategy.php): Merges existing permissions with the new ones provided by the user.

**IMPORTANT**: Saving with *recursive* option is very dangerous, cause will override permissions for all subclasses and resources.

The permission strategy is configured here `config/taoDacSimple/PermissionsService.conf.php`. Example:

```