User Access Levels on PHP

Question

I am new to php and I an currently creating a e-commerce site. I have created a CMS backend for the admin to add/edit/delete products, manage orders, manage shop configuration and add/edit/delete users.

I am having trouble finding out how to set user permissions/access rights so that: - General staff only have access to managing orders and - management staff have access to everything

So basically giving users a role which will give them restrictions or full access to everything.

Is there any tutorials or anyone with previous experience of adding this feature who can point me in the right direction?

Any help will be greatly appreciated. Thanks

Answer 1

An alternative design to what @Johnathan suggests would be a user HAS_MANY roles and each role HAS_MANY permissions.

Users:
  + id
  + name

Roles:
  + id
  + name

Permissions:
  + id
  + name

Then you link users to each of their roles, (and roles to each of their permissions), like this:

RolesUsers:
  + id
  + role_id  /* Associate a Role to a User */
  + user_id  /* Associate a User to a Role */

RolePermissions:
  + id
  + role_id       /* Associate a Role to a Permission */
  + permission_id /* Associate a Permission to a Role */

Rather than cascading roles, or only allowing a user to be in a single role - users having multiple roles provides the most amount of flexibility.

Answer 2

Permissions are associated with Roles, and Users are associated with Roles. While there are, undoubtedly, many ways to implement this type of system, what follows is a quick concept from which you could begin thinking:

Users:
  + userid
  + roleid /* Associate a Role to a User */

Roles:
  + roleid
  + rolename

Permissions:
  + permissionid
  + permissionname

RolePermissions:
  + roleid
  + permissionid /* Associate a Permission to a Role */

Note in the first table how the role is associated directly from within the user table. You could break this out and put it in its own table if you wanted to assign multiple roles to a user.

Once this is all in place, or something similar to it, you can track the user's role via a session variable, and determine whether or not the user is permitted to perform any given action by looking up the id/name of that action, and the id/name of their role, in the RolePermissions table.

if ( $user->allowed( 'deleteUser' ) ) {
  $users->remove( $uid );
}

Of course the database side is only the first part of the work. Next you would need to implement the connections between the database, and your code.

Answer 3

There are several ways of doing this that depends on how your app is going to grow. If you're pretty sure you'll only have these two profiles, then just add a "profile" field in your "user" table.

I suppose you have already implemented the login management, then you probably keep the logged user id in session. Just keep the profile type also and every time you display some component that should be accessible to the managers only, wrap it in

<?php if ($_SESSION['logged_user_profile'] == 'manager'): ?>
<!-- display your thing here -->
<?php endif; ?>

Note that this would only hide the elements. You would have to perform this check everywhere in your code also to prevent the corresponding actions from being executed...

A (much) better way if you use an MVC framework like CodeIgniter for instance would be to hook all requests through your access controller and redirect the user to a "access forbidden" page if he tries to access something he's not allowed to. This way, your access is controlled in one spot only.

Well, this is a complex subject that heavily depends on the architecture of your project so sorry if this doesn't answer your question correctly.

Answer 4

Extending from Jonathan's structure, I made a few modifications :

Users:
  + userid
  + roleid /* Associate a Role to a User */

Roles:
  + roleid
  + rolename
  + roleinherit /* Added this field */

Permissions:
  + permissionid
  + permissionname

RolePermissions:
  + roleid
  + permissionid /* Associate a Permission to a Role */

Being able to inherit from other roles can really help simplifying access control. For example, you could say that the "moderator" role inherits the "user" role which inherits the "guest" role. That way, you never have a guest that can do things even a moderator can't do.

Of course, this structure might be harder to implement as you can no longer create a simple query to check. A good way to handle these would be to create a recursive function that pulls data for the user's role, then merges it with the results of this function for the inherited role.

function getPermissions($roleID) {
    // get info about this role and store it in $permissions. Assume we also set $inheritFrom
    if ($inheritFrom == 0) return $permissions;
    else return array_merge($permissions, getPermissions($inheritFrom));
}

Make sure to cache the results of this function, because it might become heavy.