php - Access control - coding to the activity -

consider (from https://www.owasp.org/index.php/access_control_cheat_sheet):

if (ac.hasaccess(article_edit)) {   //execute activity } 

this correctly implies access control

... policy persisted/centralized in way

my question around how best centralise this.

one obvious way can think of include activities needing access control in class - hardcoding. can call method hasaccess(article_edit) on class. implies whenever activity added application need add class.

another way centralise access control might include controlled activities in database. each time need check access call hasaccess(article_edit) , trigger call database. include method in access control model.

firstly, right track please? there other solutions people favour? might benefits/issues of solutions please?

you hitting "externalized access control" issue. it's great you've thought of decoupling business logic auhthorization logic. need way express authorization logic.

there standard called xacml, extensible access control markup language:

• standard homepage
• definition & architecture
• wikipedia page). xacml, can define access control policies centrally. maintain external policy decision point (pdp) evaluates incoming xacml requests againt set of known policies.

a sample policy looks following using xacml alfa notation:

namespace example{     policy article{         target clause itemtype=="article"         apply firstapplicable         rule editarticle{             target clause actionid == "edit" , userrole == "editor"             permit             condition userid == owner         }     } }