RBAC & ACL Permissions 🔒

<?php
// Two questions, two different jobs. Don't confuse them.

// AUTHENTICATION = "Who are you?" — proving identity (login).
$loggedInUserId = 7;            // the server already verified the password
$isAuthenticated = $loggedInUserId !== null;

// AUTHORIZATION = "What are you allowed to do?" — checking permission.
// You can be authenticated (logged in) and still NOT be authorized.
$canDeleteUsers = false;        // this user is a plain member, not an admin

echo $isAuthenticated ? "Authenticated: yes\n" : "Authenticated: no\n";

// Deny-by-default: only allow when permission is explicitly true.
if ($canDeleteUsers) {
    echo "Authorized: deleting user...\n";
} else {
    echo "Authorized: NO — 403 Forbidden\n";   // blocked even though logged in
}
?>

Authenticated: yes
Authorized: NO — 403 Forbidden

-- RBAC schema: users get roles, roles grant permissions.
-- Two pivot (join) tables connect the many-to-many relationships.

CREATE TABLE roles (
    id   INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(50) UNIQUE NOT NULL          -- 'viewer', 'editor', 'admin'
);

CREATE TABLE permissions (
    id   INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) UNIQUE NOT NULL         -- 'posts.create', 'users.delete'
);

-- Pivot: which permissions a role grants (many-to-many)
CREATE TABLE role_permissions (
    role_id       INT REFERENCES roles(id),
    permission_id INT REFERENCES permissions(id),
    PRIMARY KEY (role_id, permission_id)      -- no duplicate pairs
);

-- Pivot: which roles a user has (many-to-many)
CREATE TABLE user_roles (
    user_id INT REFERENCES users(id),
    role_id INT REFERENCES roles(id),
    PRIMARY KEY (user_id, role_id)
);

-- A permission a user has = any permission granted by any of their roles.
-- One query answers "can this user do X?":
SELECT 1
FROM   user_roles ur
JOIN   role_permissions rp ON rp.role_id = ur.role_id
JOIN   permissions p       ON p.id = rp.permission_id
WHERE  ur.user_id = 7 AND p.name = 'posts.create'
LIMIT  1;   -- one row back = allowed, no rows = denied

<?php
// Role-Based Access Control (RBAC):
//   Users -> Roles -> Permissions, with role inheritance.
// You never grant a permission to a person — you grant it to a ROLE,
// then give people roles. Change the role once, everyone updates.
class RBAC
{
    /** @var array<string, array<string>> role => its own permissions */
    private array $roles = [];
    /** @var array<string, array<string>> role => roles it inherits from */
    private array $hierarchy = [];
    /** @var array<string, array<string>> userId => roles */
    private array $userRoles = [];

    public function defineRole(string $name, array $permissions): void
    {
        $this->roles[$name] = $permissions;
    }

    public function setHierarchy(string $role, array $inheritsFrom): void
    {
        $this->hierarchy[$role] = $inheritsFrom;   // admin inherits editor, etc.
    }

    public function assignRole(string $userId, string $role): void
    {
        $this->userRoles[$userId][] = $role;
    }

    /** A role's own permissions PLUS everything it inherits (recursively). */
    public function getAllPermissions(string $role): array
    {
        $perms = $this->roles[$role] ?? [];
        foreach ($this->hierarchy[$role] ?? [] as $parent) {
            $perms = array_merge($perms, $this->getAllPermissions($parent));
        }
        return array_values(array_unique($perms));
    }

    /** The one method the rest of your app calls. Deny-by-default. */
    public function can(string $userId, string $permission): bool
    {
        foreach ($this->userRoles[$userId] ?? [] as $role) {
            // strict in_array (3rd arg true) avoids loose "0 == 'x'" bugs
            if (in_array($permission, $this->getAllPermissions($role), true)) {
                return true;                       // a role granted it -> ALLOW
            }
        }
        return false;                              // nothing granted it -> DENY
    }

    public function show(string $userId, string $name, string $permission): void
    {
        $mark = $this->can($userId, $permission) ? "ALLOWED" : "DENIED";
        echo str_pad($name, 18) . str_pad($permission, 16) . "-> {$mark}\n";
    }
}

$rbac = new RBAC();
$rbac->defineRole("viewer", ["posts.view", "comments.view"]);
$rbac->defineRole("editor", ["posts.create", "posts.update", "posts.publish"]);
$rbac->defineRole("admin",  ["users.create", "users.delete", "settings.update"]);

// Hierarchy: admin inherits editor, which inherits viewer.
$rbac->setHierarchy("admin",  ["editor"]);
$rbac->setHierarchy("editor", ["viewer"]);

$rbac->assignRole("u1", "admin");    // Alice
$rbac->assignRole("u2", "editor");   // Bob
$rbac->assignRole("u3", "viewer");   // Charlie

echo "=== Access Checks ===\n";
$rbac->show("u1", "Alice (admin)",   "users.delete");
$rbac->show("u1", "Alice (admin)",   "posts.view");      // inherited twice over
$rbac->show("u2", "Bob (editor)",    "posts.create");
$rbac->show("u2", "Bob (editor)",    "users.delete");    // not granted -> deny
$rbac->show("u3", "Charlie (viewer)","posts.view");
$rbac->show("u3", "Charlie (viewer)","posts.create");    // not granted -> deny

$adminPerms = $rbac->getAllPermissions("admin");
echo "\nAdmin has " . count($adminPerms) . " permissions (own + inherited).\n";
?>

=== Access Checks ===
Alice (admin)     users.delete    -> ALLOWED
Alice (admin)     posts.view      -> ALLOWED
Bob (editor)      posts.create    -> ALLOWED
Bob (editor)      users.delete    -> DENIED
Charlie (viewer)  posts.view      -> ALLOWED
Charlie (viewer)  posts.create    -> DENIED

Admin has 8 permissions (own + inherited).

<?php
// Access Control List (ACL): permissions on a SPECIFIC resource, per user.
// RBAC says "editors can edit posts". ACL says "Bob can edit THIS post".
// Use ACL when access is per-object: shared docs, private folders, etc.
class ACL
{
    /** @var array<string, array<string>> "userId:resourceId" => actions */
    private array $entries = [];

    public function grant(string $userId, string $resource, array $actions): void
    {
        $this->entries["{$userId}:{$resource}"] = $actions;
    }

    public function allows(string $userId, string $resource, string $action): bool
    {
        $actions = $this->entries["{$userId}:{$resource}"] ?? [];
        return in_array($action, $actions, true);   // deny-by-default
    }
}

$acl = new ACL();
// Bob owns doc-7 (read + write); Carol was shared it read-only.
$acl->grant("bob",   "doc-7", ["read", "write", "delete"]);
$acl->grant("carol", "doc-7", ["read"]);

// Ask the ACL per (user, resource, action). Anyone unlisted is denied.
printf("Bob   write doc-7 : %s\n", $acl->allows("bob",   "doc-7", "write")  ? "yes" : "no");
printf("Carol write doc-7 : %s\n", $acl->allows("carol", "doc-7", "write")  ? "yes" : "no");
printf("Carol read  doc-7 : %s\n", $acl->allows("carol", "doc-7", "read")   ? "yes" : "no");
printf("Dave  read  doc-7 : %s\n", $acl->allows("dave",  "doc-7", "read")   ? "yes" : "no");
?>

Bob   write doc-7 : yes
Carol write doc-7 : no
Carol read  doc-7 : yes
Dave  read  doc-7 : no

<?php
// A POLICY centralises the rules for one resource type (here: Post).
// A GATE is a single yes/no question you ask the policy.
// This is the Laravel pattern, written from scratch so you see the wiring.

class Post
{
    public function __construct(public int $id, public int $authorId) {}
}

class PostPolicy
{
    public function __construct(private RBAC $rbac) {}

    /** Can $userId update THIS post? Role permission OR ownership. */
    public function update(string $userId, Post $post): bool
    {
        // 1) Admins/editors with the role permission can edit any post...
        if ($this->rbac->can($userId, "posts.update")) {
            return true;
        }
        // 2) ...otherwise you may only edit a post you own (OWNERSHIP CHECK).
        return (int) $userId === $post->authorId;
    }

    /** Only admins may delete — and never your own account loophole here. */
    public function delete(string $userId): bool
    {
        return $this->rbac->can($userId, "posts.delete");
    }
}

// Minimal RBAC so this snippet runs on its own.
class RBAC
{
    private array $userPerms = [];
    public function assign(string $u, array $perms): void { $this->userPerms[$u] = $perms; }
    public function can(string $u, string $perm): bool
    {
        return in_array($perm, $this->userPerms[$u] ?? [], true);
    }
}

$rbac = new RBAC();
$rbac->assign("10", ["posts.update", "posts.delete"]);  // user 10 = editor
$rbac->assign("20", []);                                 // user 20 = plain member

$policy = new PostPolicy($rbac);
$post   = new Post(id: 99, authorId: 20);                // owned by user 20

// The gate: ask the policy, then act. Deny-by-default if it returns false.
printf("Editor (10) update post 99 : %s\n", $policy->update("10", $post) ? "ALLOW" : "DENY");
printf("Owner  (20) update post 99 : %s\n", $policy->update("20", $post) ? "ALLOW" : "DENY");
printf("Other  (30) update post 99 : %s\n", $policy->update("30", $post) ? "ALLOW" : "DENY");
printf("Member (20) delete any post: %s\n", $policy->delete("20")        ? "ALLOW" : "DENY");
?>

Editor (10) update post 99 : ALLOW
Owner  (20) update post 99 : ALLOW
Other  (30) update post 99 : DENY
Member (20) delete any post: DENY

<?php
// 🎯 YOUR TURN — finish the can() check, then run it.
// can() must return true ONLY when one of the user's roles grants the permission.

class Auth
{
    private array $rolePerms = ["editor" => ["posts.create", "posts.update"]];
    private array $userRoles = ["bob" => ["editor"]];

    public function can(string $userId, string $permission): bool
    {
        foreach ($this->userRoles[$userId] ?? [] as $role) {
            // 1) Is $permission inside this role's permission list?
            if (in_array($permission, $this->rolePerms[$role] ?? [], ___)) {  // 👉 strict compare: put  true
                return ___;          // 👉 a role granted it — return  true
            }
        }
        return ___;                  // 👉 deny-by-default — return  false
    }
}

$auth = new Auth();
echo $auth->can("bob", "posts.create") ? "create: ALLOW\n" : "create: DENY\n";
echo $auth->can("bob", "users.delete") ? "delete: ALLOW\n" : "delete: DENY\n";

// ✅ Expected output:
//    create: ALLOW
//    delete: DENY
?>

create: ALLOW
delete: DENY

<?php
// 🎯 YOUR TURN — add the OWNERSHIP check so authors can edit their own post.
// Rule: allow if the user has 'posts.update', OR if they wrote the post.

class Post { public function __construct(public int $authorId) {} }

function canUpdate(bool $hasUpdatePerm, int $userId, Post $post): bool
{
    if ($hasUpdatePerm) {
        return true;                 // editors can edit anything
    }
    // 👉 Otherwise allow ONLY when this user owns the post.
    return $userId === ___;          // 👉 compare $userId with  $post->authorId
}

$post = new Post(authorId: 42);
echo canUpdate(false, 42, $post) ? "author edits own : ALLOW\n" : "author edits own : DENY\n";
echo canUpdate(false, 99, $post) ? "stranger edits   : ALLOW\n" : "stranger edits   : DENY\n";
echo canUpdate(true,  99, $post) ? "editor edits any : ALLOW\n" : "editor edits any : DENY\n";

// ✅ Expected output:
//    author edits own : ALLOW
//    stranger edits   : DENY
//    editor edits any : ALLOW
?>

author edits own : ALLOW
stranger edits   : DENY
editor edits any : ALLOW

<?php
// Enforce authorization in ONE place: middleware that runs before the
// controller. Routes declare the permission they need; the gate blocks
// anyone who lacks it with 403 — the server is the source of truth.
class RBAC
{
    private array $userPerms = [];
    public function assign(string $u, array $perms): void { $this->userPerms[$u] = $perms; }
    public function can(string $u, string $perm): bool
    {
        return in_array($perm, $this->userPerms[$u] ?? [], true);
    }
}

class AuthorizeMiddleware
{
    public function __construct(private RBAC $rbac) {}

    /** Returns the HTTP status this request would receive. */
    public function handle(array $request, string $permission): int
    {
        if ($request['userId'] === null) {
            return 401;                 // not logged in -> Unauthorized
        }
        if (!$this->rbac->can($request['userId'], $permission)) {
            return 403;                 // logged in but not allowed -> Forbidden
        }
        return 200;                     // OK — let the controller run
    }
}

$rbac = new RBAC();
$rbac->assign("u1", ["users.manage", "posts.manage", "settings.update"]); // admin
$rbac->assign("u2", ["posts.manage"]);                                    // editor

$mw = new AuthorizeMiddleware($rbac);

$routes = [
    ["path" => "GET /admin/users", "perm" => "users.manage",    "userId" => "u1"],
    ["path" => "DELETE /users/5",  "perm" => "users.manage",    "userId" => "u2"],
    ["path" => "POST /posts",      "perm" => "posts.manage",    "userId" => "u2"],
    ["path" => "PUT /settings",    "perm" => "settings.update", "userId" => null],
];

foreach ($routes as $r) {
    $status = $mw->handle($r, $r["perm"]);
    echo str_pad($r["path"], 22) . "-> {$status}\n";
}
?>

GET /admin/users      -> 200
DELETE /users/5       -> 403
POST /posts           -> 200
PUT /settings         -> 401