Class \Scrivo\AccessController

The AccessController class implements the fuctionality to determine user access level to objects like pages and assets.

Access rights are expressed as bit flags. There are three different access right defined:

• AccessController::READ_ACCESS: first bit set (=1)
• AccessController::WRITE_ACCESS: second bit set (=2)
• AccessController::PUBLISH_ACCESS: third bit set (=4)

It is important to note that Scrivo uses access levels internally. This means that although there are different permissions (READ_ACCESS, WRITE_ACCESS, etc.) defined they are not used indivudally: WRITE_ACCESS always implies READ_ACCESS permission (WRITE_ACCESS always means READ_ACCESS+WRITE_ACCESS, PUBLISH_ACCESS always means READ_ACCESS+WRITE_ACCESS+PUBLISH_ACCESS).

This means that when you retrieve a permission you are guaranteed to retrieve one of the values (0, 1, 3 or 7). Using bit flags might suggest otherwise, but note that other combinations are not possible.

This also means that you can use either bitwise operations or comparison when checking a permission:

if (AccessController::getPermission($aContext, $anObjectId) >= AccessController::ACCESS_LEVEL_READ) { ... }

is equivalent to:

if (AccessController::getPermission($aContext, $anObjectId) & AccessController::ACCESS_LEVEL_READ) { ... }

Note that AccessController::checkPermission(...) is probably easier to use.

Another feature is that Scrivo users are differentiated into three catagories which limits the range of atainable permissions:

• Members (Users::STATUS_MEMBER), these users represent the group of users that visit the actual site: Their users access levels can only be one of NO_ACCESS or READ_ACCESS.
• Editors (Users::STATUS_EDITOR), the users that login in to do editing work Scrivo: These users have access level can range from READ_ACCESS to PUBLISH_ACCESS.
• Super users (Users::STATUS_ADMIN), users that can access everything. These users always have PUBLISH_ACCESS.

In other words members can read what they are allowed to but never write, editors can write (and possibly publish) what they are allowed to and always read and admins can do everthing.

For a description of Scrivo user see the Scrivo::User class and to see how access rights are granted to users see the Scrivo::Role class.

Defined in: AccessController.php.