dereuromark/cakephp-tinyauth

Deny support using `!`?

dereuromark opened this issue · 11 comments

dereuromark commented

Is this something people see as useful to have for Authentication?

tinyauth_allow.ini

Users = index, view ; Public access to index and view action
Extras.Offers = *, !delete ; All expect delete action are public

If not we can close this again

saeideng commented

what happened id someone uses 👇 ?

Extras.Offers =!delete,  *

( change order )

dereuromark commented

Same, the order in the file would not matter.

dereuromark commented

Something similar could be made possible for Authorization (ACL):

tinyauth_acl.ini

[Groups]
* = admin, user ; All roles have access by default to all actions
adminOnly = !user ; But then restrict this action to only admins
saeideng commented

is this for Authorization?? or Authentication ??
for authorization this can be very useful , but for Authentication no idea

dereuromark commented

I clarified it per example now.

dereuromark commented

If someone wants to implement this as minor, feel free to do so.
Should be a simple addition with tests and docs.

  • 👀1
dereuromark commented

I checked, the syntax with ! is only valid with quotes around: Extras.Offers = "!delete", * etc.
Not sure if that is then still worth persuing..
We might have to use a different format than INI maybe?

dereuromark commented

Done via #96

saeideng commented

I checked, the syntax with ! is only valid with quotes around:

👎 for force quotes

Not sure if that is then still worth persuing..

no now

dereuromark commented

dont use deny then. only needed for this

  • 😄1
dereuromark commented

do u have a better idea? how we can solve it?