diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml index 0e0f02c..89e83df 100644 --- a/.github/workflows/codecov.yml +++ b/.github/workflows/codecov.yml @@ -15,10 +15,10 @@ jobs: - ubuntu-latest php: - - "8.1" - "8.2" - "8.3" - "8.4" + - "8.5" steps: - name: Checkout diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index 03d62cb..9976515 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -15,10 +15,10 @@ jobs: - ubuntu-latest php: - - "8.1" - "8.2" - "8.3" - "8.4" + - "8.5" steps: - name: Checkout diff --git a/README.md b/README.md index e735f78..f89ada2 100644 --- a/README.md +++ b/README.md @@ -4,9 +4,9 @@ Rbac authorization model implements [dot-authorization](https://github.com/dotke An authorization service is responsible for deciding if the authenticated identity or guest has access to certain parts of the application. The RBAC model defines roles that can be assigned to users. -The authorization is done on a role basis, not user basis as in ACL. +The authorization is done on a role basis, not a user basis as in ACL. Each role can have one or multiple permissions/privileges assigned. -When deciding if a user is authorized, the requested permission is checked in all user roles and if at least one role has that permission, access is granted. +When deciding if a user is authorized, the requested permission is checked in all user roles, and if at least one role has that permission, access is granted. ## Documentation @@ -15,7 +15,7 @@ Documentation is available at: https://docs.dotkernel.org/dot-rbac/. ## Badges ![OSS Lifecycle](https://img.shields.io/osslifecycle/dotkernel/dot-rbac) -![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.1.0) +![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.2.0) [![GitHub issues](https://img.shields.io/github/issues/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/issues) [![GitHub forks](https://img.shields.io/github/forks/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/network) @@ -36,10 +36,10 @@ composer require dotkernel/dot-rbac ## Configuration -Even if the authorization service can be programmatically configured, we recommend using the configuration based approach. -We further describe how to configure the module, using configuration file. +Even if the authorization service can be programmatically configured, we recommend using the configuration-based approach. +We further describe how to configure the module, using a configuration file. -First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. +First, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. This ensures that all dependencies required by this module are registered in the service manager. It also defines default config values for this module. @@ -75,7 +75,7 @@ Create a configuration file in your `config/autoload` folder and change the modu ], ], - //example for a hierarchical model, less to write but it can be confusing sometimes + //example for a hierarchical model, less to write, but it can be confusing sometimes /*'role_provider' => [ 'type' => 'InMemory', 'options' => [ @@ -114,7 +114,7 @@ Create a configuration file in your `config/autoload` folder and change the modu ## Usage Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters. -There are 2 ways to call the isGranted method. +There are two ways to call the isGranted method. ### First method @@ -137,8 +137,8 @@ $isGranted = $this->authorizationService->isGranted($permission); Whenever you request an authorization check on the authenticated identity, the identity will be provided to the `AuthorizationService` through a registered `IdentityProviderInterface` service. -This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs. -If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. +This is because identity is authentication-dependent, so the module lets you overwrite this service, depending on your needs. +If you want to get the identity from other sources instead of the dot-authentication service, overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. ## Custom role providers @@ -147,8 +147,8 @@ After that, you can use them in the configuration file, as described above. ## Creating assertions -Assertions are checked after permission granting, right before returning the authorization result. -Assertions can have a last word in deciding if someone is authorized for the requested action. +Assertions are checked after permission is granted, right before returning the authorization result. +Assertions can have the last word in deciding if someone is authorized for the requested action. A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`. It is up to you to write the logic inside an assertion. @@ -160,5 +160,5 @@ This interface defines the following method public function assert(AuthorizationInterface $authorization, $context = null); ``` -The context variable can be any external data that an assertion needs in order to decide the authorization status. +The context variable can be any external data that an assertion needs to decide the authorization status. The assertion must return a boolean value, reflecting the assertion pass or failure status. diff --git a/SECURITY.md b/SECURITY.md index 603536f..093a93a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,14 +2,12 @@ ## Supported Versions - | Version | Supported | PHP Version | |---------|--------------------|----------------------------------------------------------------------------------------------------------| -| 4.x | :white_check_mark: | ![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.0.0) | -| 3.x | :x: | ![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/3.5.2) | +| 4.x | :white_check_mark: | ![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.2.0) | +| 3.x | :x: | ![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/3.7.0) | | <= 2.x | :x: | | - ## Reporting Potential Security Issues If you have encountered a potential security vulnerability in this project, @@ -25,7 +23,7 @@ When reporting issues, please provide the following information: We request that you contact us via the email address above and give the project contributors a chance to resolve the vulnerability and issue a new release prior to any public exposure; this helps protect the project's -users, and provides them with a chance to upgrade and/or update in order to +users and provides them with a chance to upgrade and/or update to protect their applications. diff --git a/composer.json b/composer.json index f135839..861d8fb 100644 --- a/composer.json +++ b/composer.json @@ -22,7 +22,7 @@ } }, "require": { - "php": "~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0", + "php": "~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0", "dotkernel/dot-authorization": "^3.6.0", "laminas/laminas-authentication": "^2.16.0", "laminas/laminas-servicemanager": "^4.0", @@ -52,7 +52,7 @@ ], "cs-check": "phpcs", "cs-fix": "phpcbf", - "test": "phpunit --colors=always", - "static-analysis": "phpstan analyse --memory-limit 1G" + "static-analysis": "phpstan analyse --memory-limit 1G", + "test": "phpunit --colors=always" } } diff --git a/docs/book/v3/configuration.md b/docs/book/v3/configuration.md index a683842..125f573 100644 --- a/docs/book/v3/configuration.md +++ b/docs/book/v3/configuration.md @@ -1,9 +1,9 @@ # Configuration -Even if the authorization service can be programmatically configured, we recommend using the configuration based approach. -We further describe how to configure the module, using the configuration file. +Even if the authorization service can be programmatically configured, we recommend using the configuration-based approach. +We further describe how to configure the module using the configuration file. -First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. +First, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. This ensures that all dependencies required by this module are registered in the service manager. It also defines default config values for this module. @@ -39,7 +39,7 @@ Create a configuration file in your `config/autoload` folder and change the modu ], ], - //example for a hierarchical model, less to write but it can be confusing sometimes + //example for a hierarchical model, less to write, but it can be confusing sometimes /*'role_provider' => [ 'type' => 'InMemory', 'options' => [ diff --git a/docs/book/v3/customization.md b/docs/book/v3/customization.md index 5a91914..3876438 100644 --- a/docs/book/v3/customization.md +++ b/docs/book/v3/customization.md @@ -4,8 +4,8 @@ Whenever you request an authorization check on the authenticated identity, the identity will be provided to the `AuthorizationService` through a registered `IdentityProviderInterface` service. -This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs. -If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. +This is because identity is authentication-dependent, so the module lets you overwrite this service, depending on your needs. +If you want to get the identity from other sources instead of the dot-authentication service, overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. ## Custom role providers @@ -14,8 +14,8 @@ After that, you can use them in the configuration file, as described above. ## Creating assertions -Assertions are checked after permission granting, right before returning the authorization result. -Assertions can have a last word in deciding if someone is authorized for the requested action. +Assertions are checked after permission is granted, right before returning the authorization result. +Assertions can have the last word in deciding if someone is authorized for the requested action. A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`. It is up to you to write the logic inside an assertion. @@ -27,5 +27,5 @@ This interface defines the following method public function assert(AuthorizationInterface $authorization, $context = null); ``` -The context variable can be any external data that an assertion needs in order to decide the authorization status. +The context variable can be any external data that an assertion needs to decide the authorization status. The assertion must return a boolean value, reflecting the assertion pass or failure status. diff --git a/docs/book/v3/overview.md b/docs/book/v3/overview.md index 8a39c7f..0e6d4a5 100644 --- a/docs/book/v3/overview.md +++ b/docs/book/v3/overview.md @@ -1,6 +1,6 @@ # dot-rbac -The rbac authorization service decides if the authenticated identity or guest has access to certain parts of the application +The rbac authorization service decides if the authenticated identity or guest has access to certain parts of the application. ## Badges @@ -11,7 +11,7 @@ The rbac authorization service decides if the authenticated identity or guest ha [![GitHub forks](https://img.shields.io/github/forks/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/network) [![GitHub stars](https://img.shields.io/github/stars/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/stargazers) [![GitHub license](https://img.shields.io/github/license/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/blob/3.0/LICENSE.md) -[![Build Static](https://github.com/dotkernel/dot-rbac/actions/workflows/continuous-integration.yml/badge.svg?branch=3.0)](https://github.com/dotkernel/dot-rbac/actions/workflows/continuous-integration.yml) +[![Build Static](https://github.com/dotkernel/dot-rbac/actions/workflows/continuous-integration.yml/badge.svg?branch=3.0)](https://github.com/dotkernel/dot-rbac/actions/workflows/continuous-integration.yml) [![codecov](https://codecov.io/gh/dotkernel/dot-rbac/graph/badge.svg?token=GCK6C92N83)](https://codecov.io/gh/dotkernel/dot-rbac) [![PHPStan](https://github.com/dotkernel/dot-rbac/actions/workflows/static-analysis.yml/badge.svg?branch=3.0)](https://github.com/dotkernel/dot-rbac/actions/workflows/static-analysis.yml) diff --git a/docs/book/v3/usage.md b/docs/book/v3/usage.md index a1ad715..bec20fc 100644 --- a/docs/book/v3/usage.md +++ b/docs/book/v3/usage.md @@ -1,7 +1,7 @@ # Usage Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters. -There are 2 ways to call the isGranted method. +There are two ways to call the isGranted method. ## First method diff --git a/docs/book/v4/configuration.md b/docs/book/v4/configuration.md index a683842..125f573 100644 --- a/docs/book/v4/configuration.md +++ b/docs/book/v4/configuration.md @@ -1,9 +1,9 @@ # Configuration -Even if the authorization service can be programmatically configured, we recommend using the configuration based approach. -We further describe how to configure the module, using the configuration file. +Even if the authorization service can be programmatically configured, we recommend using the configuration-based approach. +We further describe how to configure the module using the configuration file. -First of all, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. +First, you should enable the module in your application by merging this package's `ConfigProvider` with your application's config. This ensures that all dependencies required by this module are registered in the service manager. It also defines default config values for this module. @@ -39,7 +39,7 @@ Create a configuration file in your `config/autoload` folder and change the modu ], ], - //example for a hierarchical model, less to write but it can be confusing sometimes + //example for a hierarchical model, less to write, but it can be confusing sometimes /*'role_provider' => [ 'type' => 'InMemory', 'options' => [ diff --git a/docs/book/v4/customization.md b/docs/book/v4/customization.md index 5a91914..3876438 100644 --- a/docs/book/v4/customization.md +++ b/docs/book/v4/customization.md @@ -4,8 +4,8 @@ Whenever you request an authorization check on the authenticated identity, the identity will be provided to the `AuthorizationService` through a registered `IdentityProviderInterface` service. -This is because identity is authentication dependent, so the module lets you overwrite this service, depending on your needs. -If you want to get the identity from other sources instead of the dot-authentication service, just overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. +This is because identity is authentication-dependent, so the module lets you overwrite this service, depending on your needs. +If you want to get the identity from other sources instead of the dot-authentication service, overwrite the `IdentityProviderInterface::class` service in the service manager with your own implementation of this interface. ## Custom role providers @@ -14,8 +14,8 @@ After that, you can use them in the configuration file, as described above. ## Creating assertions -Assertions are checked after permission granting, right before returning the authorization result. -Assertions can have a last word in deciding if someone is authorized for the requested action. +Assertions are checked after permission is granted, right before returning the authorization result. +Assertions can have the last word in deciding if someone is authorized for the requested action. A good assertion example could be an edit permission, but with the restriction that it should be able to edit the item just if the `user id` matches the item's `owner id`. It is up to you to write the logic inside an assertion. @@ -27,5 +27,5 @@ This interface defines the following method public function assert(AuthorizationInterface $authorization, $context = null); ``` -The context variable can be any external data that an assertion needs in order to decide the authorization status. +The context variable can be any external data that an assertion needs to decide the authorization status. The assertion must return a boolean value, reflecting the assertion pass or failure status. diff --git a/docs/book/v4/overview.md b/docs/book/v4/overview.md index 3a1385a..72b22ce 100644 --- a/docs/book/v4/overview.md +++ b/docs/book/v4/overview.md @@ -1,11 +1,11 @@ # dot-rbac -The rbac authorization service decides if the authenticated identity or guest has access to certain parts of the application +The rbac authorization service decides if the authenticated identity or guest has access to certain parts of the application. ## Badges ![OSS Lifecycle](https://img.shields.io/osslifecycle/dotkernel/dot-rbac) -![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.1.0) +![PHP from Packagist (specify version)](https://img.shields.io/packagist/php-v/dotkernel/dot-rbac/4.2.0) [![GitHub issues](https://img.shields.io/github/issues/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/issues) [![GitHub forks](https://img.shields.io/github/forks/dotkernel/dot-rbac)](https://github.com/dotkernel/dot-rbac/network) diff --git a/docs/book/v4/usage.md b/docs/book/v4/usage.md index a1ad715..bec20fc 100644 --- a/docs/book/v4/usage.md +++ b/docs/book/v4/usage.md @@ -1,7 +1,7 @@ # Usage Whenever you need to check if someone is authorized to take some actions, inject the `AuthorizationInterface::class` service into your class, then call the `isGranted` method with the correct parameters. -There are 2 ways to call the isGranted method. +There are two ways to call the isGranted method. ## First method