Konr mentioned this quite a while ago, but I thought I’d bring it up here in case anyone else stumbles across this article.

Instead of this:

// if role is publisher, he can always modify a post
if ($user->getRoleId() == ‘publisher’) {
return true;
}

I do this:

$acl->allow(‘publisher’, ‘blogPost’, array(‘publish’,'modify’));

Just to be clear; Is there any reason (besides demonstration purposes) to check the publisher’s roleId via the assertion class vs. int he allow definition?

In your class UserCanModifyBlogPostAssertion, you are throwing an InvalidArgumentException if the role is not a User or the resource is not a BlogPost. I’ve found that this can cause a problem if you query the ACL with strings instead of objects:

$acl->isAllowed(‘user’, $blogPost, ‘modify’); // throws exception

Although the query doesn’t make a whole lot of sense, this is still correct usage of Zend_Acl. It may be better to return false in your assertion if you can’t work with the passed in objects.

That’s actually pretty funny, believe it or not. (-:

class Post implements Zend_Acl_Resource_Interface {
public $id;
public $authorId;
public function __construct($id = null, $authorId = null) {
$this->id = $id;
$this->authorId = $authorId;
}
public function isAuthor(User $user) {
return $user->id == $this->authorId;
}
public function getResourceId() {
if ($this->id) {
return “posts-{$this->id}”;
} else {
return “posts”;
}
}
}

class IsAuthorOfPost implements Zend_Acl_Assert_Interface {
public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null) {
// type checks
return $resource->isAuthor($role);
}
}

$acl = new Zend_Acl();
$acl->addRole(“users”)
->addRole(“authors”, array(“users”))
->addRole(“admins”)
->addResource(“posts”)
->allow(“admins”, “posts”)
->allow(“authors”, “posts”, “create”)
->allow(“authors”, “posts”, array(“delete”, “edit”), new IsAuthorOfPost());

$allan = new User(1, “users”);
$acl->addRole($allan, $allan->role);

$mary = new User(2, “authors”);
$acl->addRole($mary, $mary->role);

$joe = new User(3, “authors”);
$acl->addRole($joe, $joe->role);

$mike = new User(4, “admins”);
$acl->addRole($mike, $mike->role);

var_dump($acl->isAllowed($allan, new Post(), “create”)); // false, users cannot create posts
var_dump($acl->isAllowed($mary, new Post(), “create”)); // true, authors can create posts
var_dump($acl->isAllowed($joe, new Post(), “create”)); // true, authors can create posts
var_dump($acl->isAllowed($mike, new Post(), “create”)); // true, admins can do anything with a post

$joesPost = new Post(1, $joe->id);
$acl->addResource($joesPost, “posts”);

var_dump($acl->isAllowed($allan, $joesPost, “edit”)); // false, Allan is not an author
var_dump($acl->isAllowed($mary, $joesPost, “edit”)); // false, Marry is not the author of the post
var_dump($acl->isAllowed($joe, $joesPost, “edit”)); // true, Joe is the author of the post
var_dump($acl->isAllowed($mike, $joesPost, “edit”)); // true, admins can do anything with posts