Hello World

Creating roles/resources in code

The first of the above two, creating roles and resources in code is probably the best approach when the site in question is small and there aren't many roles or they don't change often. It's few SQL queries less and the database relations are simpler.


We simply define the resources and roles in code. Then, to see if an user has access to a resource we just check his role. This can be done by simply saving the user's role in the user database table as text so it will be loaded with the users other info.

Loading roles/resources from a DB

This approach is slightly more complicated.

For this you should create a custom Acl class inheriting from Zend_Acl. Have its constructor load the details from the DB.

For the database structure, you need three tables


In the users table you need to store the ID of the user's role and in resources table the ID of the role required to access it. The inherit_id column in roles table should store the ID of the role that role inherits from, if any.

Example code

Here's an example Acl class for using with a database.

class ResAcl extends Zend_Acl
{
        public function __construct($db)
        {
                $sql = 'SELECT id,
                               name,
                               role_id
                        FROM resources';

                $resources = $db->GetAll($sql);


                $sql = 'SELECT roles.id,
                               roles.name,
                               inherits.name AS inherit_name
                        FROM roles
                        LEFT JOIN roles AS inherits ON inherits.id = roles.inherit_id
                        ORDER BY roles.inherit_id ASC';

                $roles = $db->GetAll($sql);


                //Loop roles and put them in an assoc array by ID
                $roleArray = array();
                foreach($roles as $r)
                {
                        $role = new Zend_Acl_Role($r['name']);

                        //If inherit_name isn't null, have the role
                        //inherit from that, otherwise no inheriting
                        if($r['inherit_name'] !== null)
                                $this->addRole($role,$r['inherit_name']);
                        else
                                $this->addRole($role);

                        $roleArray[$r['id']] = $role;
                }

                foreach($resources as $r)
                {
                        $resource = new Zend_Acl_Resource($r['name']);

                        $role = $roleArray[$r['role_id']];

                        $this->add($resource);
                        $this->allow($role,$resource);
                }
        }
}

This class uses ADODB. I also wrote an example ADODB class for using with Zend_Auth which can be used to load users to use with this code with some minor modifications.

The name column in the roles table isn't absolutely necessary: You could refer to the roles in Acl by just their ID column too, but if you're writing an admin panel it's probably much nicer to present users with a clear text name for the role instead of some weird ID number thingy.

For loading the users' roles, you will have to JOIN the roles.name column by the role_id in the users table.