Khaos :: KhACL

[eluser]lightnb[/eluser]
Hi all,

So I'm trying to figure out how this works in the real world, and I'm a bit confused.

Let's say I have a site with a forum and an article publishing system, and a single user/login system for both.

I would create users like this?:

Code:

/* Setup Users
************************/

// Add Superman and Wonderwoman to the "Administrators" group
$this->khacl->aro->create('Superman', 'Administrators');
$this->khacl->aro->create('WonderWoman', 'Administrators');

// Add Bob and Joe to the "Moderators" group
$this->khacl->aro->create('Bob', 'Moderators');
$this->khacl->aro->create('Joe', 'Moderators');

// Add Tom and Steve to the "Publishers" group
$this->khacl->aro->create('Tom', 'Publisher');
$this->khacl->aro->create('Steve', 'Publisher');

// Create a "Public" user that will be used for unregistered site users...
$this->khacl->aro->create('PublicUser', 'PublicGroup');

And then create a list of actions:

Code:

/* Define actions that site users might perform
****************************************************/

// Actions for the forums
$this->khacl->axo->create('DeleteOwnForumPosts');
$this->khacl->axo->create('DeleteOthersForumPosts');
$this->khacl->axo->create('EditOwnForumPosts');
$this->khacl->axo->create('EditOthersForumPosts');

// Actions for Article Publishing
$this->khacl->axo->create('PublishArticles');
$this->khacl->axo->create('ReadArticles');
$this->khacl->axo->create('CommentOnArticles');

And then Assign users and groups to actions:

Code:

/* Assign permissions to users and groups
****************************************************/

// "Administrators" can perform every action
$this->khacl->allow('Administrators', 'DeleteOwnForumPosts');
$this->khacl->allow('Administrators', 'DeleteOthersForumPosts');
$this->khacl->allow('Administrators', 'EditOwnForumPosts');
$this->khacl->allow('Administrators', 'EditOthersForumPosts');
$this->khacl->allow('Administrators', 'PublishArticles');
$this->khacl->allow('Administrators', 'ReadArticles');
$this->khacl->allow('Administrators', 'CommentOnArticles');

// except "WonderWoman". She can't delete other's posts
$this->khacl->allow('WonderWoman', 'DeleteOthersForumPosts'); // Can I do this to an individual user?

// Moderators can do everything except 'publish articles' and 'delete other's forum posts'
$this->khacl->allow('Moderators', 'DeleteOwnForumPosts');
$this->khacl->allow('Moderators', 'EditOwnForumPosts');
$this->khacl->allow('Moderators', 'EditOthersForumPosts');
$this->khacl->allow('Moderators', 'ReadArticles');
$this->khacl->allow('Moderators', 'CommentOnArticles');

// except "Bob" can 'delete other's posts', cus he's cool ;)
$this->khacl->allow('Bob', 'DeleteOthersForumPosts');

// Publishers can publish articles, and can also edit thier own posts
$this->khacl->allow('Publisher', 'EditOwnForumPosts');
$this->khacl->allow('Publisher', 'PublishArticles');
$this->khacl->allow('Publisher', 'ReadArticles');
$this->khacl->allow('Publisher', 'CommentOnArticles');

// All site users can read articles
$this->khacl->allow('PublicGroup', 'ReadArticles');

Are the above assumptions correct?

But what is the purpose of the ACO then? Would "Forums" and "Articles" be the ACOs?

Second, how would this apply to individual sections, such as forum categories? Let's say Bob can only Edit and Delete posts in the "Birds" Forum category, while "Joe" can only moderate the "Mammals" forum?

Third, how do IDs play into this? Do I just replace the groups and names in the above examples with their appropriate MySQL UIDs instead?