Admin Access Control

IMPORTANT: By default, only administrators can access the Authorization Manager.

The plugin checks if the user is an admin using multiple methods (in order):

1. role_name: Checks if role_name is 'admin', 'administrator', or 'superadmin'
2. role_id: Checks if role_id == 1 (typically admin role)
3. is_admin: Checks if is_admin flag is true
4. email: Checks against a whitelist of admin emails

To customize admin access, add to your config/app.php in the return array:

// In config/app.php, add to the return array:
return [
    // ... existing configuration ...

    'AclManager' => [
        'adminAccess' => [
            // Which role IDs can access the Authorization Manager
            'adminRoleIds' => [1, 2],  // Allow role IDs 1 and 2

            // Which role names can access
            'adminRoleNames' => ['admin', 'superuser'],

            // Specific emails (useful for initial setup)
            'adminEmails' => [
                'admin@example.com',
            ],
        ],
        'redirects' => [
            'login' => ['controller' => 'Users', 'action' => 'login'],
            'unauthorized' => ['controller' => 'Dashboard', 'action' => 'index'],
        ],
    ],
];

Session Timeout and Redirect

When a user's session expires while using the Authorization Manager, they will be redirected to the login page with a redirect parameter containing the original URL.

To handle the redirect in your login controller, add this code after successful authentication:

// In your UsersController login action, after successful authentication:
public function login()
{
    $result = $this->Authentication->getResult();

    if ($result->isValid()) {
        // Check if there's a redirect parameter
        $redirect = $this->request->getQuery('redirect');

        if ($redirect) {
            // Redirect back to the original URL
            return $this->redirect($redirect);
        }

        // Default redirect
        $target = $this->Authentication->getLoginRedirect() ?? '/dashboard';
        return $this->redirect($target);
    }

    if ($this->request->is('post') && !$result->isValid()) {
        $this->Flash->error(__('Invalid username or password'));
    }
}

This ensures users are returned to the Authorization Manager page they were viewing after logging in.

Internationalization (i18n)

The plugin comes with Spanish (es_ES) and Galician (gl_ES) translations out of the box.

To change the language, add to your config/bootstrap.php:

use Cake\I18n\I18n;

// Set Spanish (default)
I18n::setLocale('es_ES');

// Or Galician
I18n::setLocale('gl_ES');

// Or English
I18n::setLocale('en_US');

To add your own translation:

1. Create resources/locales/{locale}/acl_manager.po in your app
2. Copy entries from vendor/mgomezbuceta/cakephp-aclmanager/resources/locales/es_ES/acl_manager.po
3. Translate the msgstr values
4. Run bin/cake i18n extract --plugin AclManager to update

Other Configuration Options

In your config/bootstrap.php:

use Cake\Core\Configure;

// Actions to ignore during resource scan
Configure::write('AclManager.ignoreActions', [
    'isAuthorized',
    'beforeFilter',
    'initialize',
    'AclManager.*',      // Ignore plugin
    'DebugKit.*'         // Ignore DebugKit
]);

// Permission checking mode
Configure::write('AclManager.permissionMode', 'strict'); // or 'permissive'

// Enable permission caching
Configure::write('AclManager.cachePermissions', true);
Configure::write('AclManager.cacheDuration', '+1 hour');

// Default role for new users
Configure::write('AclManager.defaultRoleId', 2);

The plugin creates three tables:

roles - User roles

id, name, description, priority, active, created, modified

permissions - Role permissions

id, role_id, controller, action, plugin, allowed, created, modified

resources - Available resources (auto-discovered)

id, controller, action, plugin, description, active, created, modified

// Load the component
$this->loadComponent('AclManager.AuthorizationManager');

// Check if user is authorized
$allowed = $this->AuthorizationManager->isAuthorized($user);

// Check specific permission
$allowed = $this->AuthorizationManager->checkPermission(
    $roleId,
    'Articles',
    'edit',
    'Blog' // plugin name (optional)
);

// Clear permission cache
$this->AuthorizationManager->clearCache();

// Handle unauthorized access
return $this->AuthorizationManager->handleUnauthorized();

use AclManager\Service\PermissionService;
use AclManager\Service\ResourceScannerService;

// Permission management
$permissionService = new PermissionService();

// Grant permission
$permissionService->grant($roleId, 'Articles', 'edit');

// Deny permission
$permissionService->deny($roleId, 'Articles', 'delete');

// Get permission matrix
$matrix = $permissionService->getPermissionMatrix($roleId);

// Copy permissions between roles
$permissionService->copyPermissions($sourceRoleId, $targetRoleId);

// Resource scanning
$scannerService = new ResourceScannerService();
$stats = $scannerService->scanAndSync();

// Get grouped resources
$resources = $scannerService->getGroupedResources();

No resources showing?

Visit /authorization-manager and click "Sync Resources"

Permission changes not taking effect?

// Clear cache
Configure::write('AclManager.cachePermissions', false);
// Or clear specific cache
$this->AuthorizationManager->clearCache();

Getting "access denied" after setup?

1. Make sure your User has a role_id assigned
2. Verify permissions are granted for that role
3. Check isAuthorized() is properly implemented