Policy final readonly class

Minn\Http\Policy · public/minn/src/Minn/Http/Policy.php · 115 lines

What a route requires of its caller, as data on the route: the router enforces it before the handler runs, so a grep over the attributes is the authorization surface. The two refusals are the reference's: a caller who is not signed in gets the sign-in code (401), a signed-in caller who lacks the capability gets the refusal code (403); how a bad nonce is answered belongs to whoever judges the policy. A policy that names a subject has the record looked up first, and answers the record's 404 before either refusal, which is the reference's order.

Written inline in the attribute with `new`, which is what an attribute argument allows: `policy: new Policy(Access::Cap, 'upload_files', refuse: 'rest_cannot_create', message: '...')`.

Uses 3

Http Access Subject

Used by 53 (show)

Admin\AppController Admin\BundleController Admin\EditorController Admin\LanguageController Admin\OverviewController Admin\PackagesController Admin\PreferencesController Admin\RenderController Admin\SessionsController Admin\SiteController Admin\StructureController Admin\SystemController Admin\ThemesController Admin\UpdatesController Admin\V1Controller Engine Front\AssetsController Front\CommentPostController Front\FrontController Front\ProbeController Front\SitemapController Route RouteRow Router Login\LoginController Rest\ApplicationPasswordsController Rest\BatchController Rest\BlockRendererController Rest\BlockTypesController Rest\BlocksController Rest\CommentsController Rest\DeclaredPostsController Rest\DeclaredTermsController Rest\GlobalStylesController Rest\IndexController Rest\InstalledThemesController Rest\MediaController Rest\MenusController Rest\NavigationController Rest\PluginsController Rest\PolicyGate Rest\PostsController Rest\PostsWriteController Rest\RevisionsController Rest\SearchController Rest\SettingsController Rest\SidebarsController Rest\StatusesController Rest\TemplatesController Rest\TermsController Rest\UsersController Rest\WidgetsController Runtime\AjaxController

Constants and properties

prop	`readonly Minn\Http\Access $access`	Promoted from the constructor.
prop	`readonly ?string $cap`	Promoted from the constructor.
prop	`readonly array $caps`	Promoted from the constructor.
prop	`readonly ?string $param`	Promoted from the constructor.
prop	`readonly string $signIn`	Promoted from the constructor.
prop	`readonly string $signInMessage`	Promoted from the constructor.
prop	`readonly string $refuse`	Promoted from the constructor.
prop	`readonly string $message`	Promoted from the constructor.
prop	`readonly ?Minn\Http\Policy $edit`	Promoted from the constructor.
prop	`readonly ?Minn\Http\Subject $subject`	Promoted from the constructor.
prop	`readonly ?string $missing`	Promoted from the constructor.
prop	`readonly ?string $missingMessage`	Promoted from the constructor.
prop	`readonly int $signInStatus`	Promoted from the constructor.
prop	`readonly ?string $verb`	Promoted from the constructor.
prop	`readonly ?array $opener`	Promoted from the constructor.

Public

new

__construct(Minn\Http\Access $access = Minn\Http\Access::Public, ?string $cap = NULL, array $caps = array ( ), ?string $param = NULL, string $signIn = 'rest_not_logged_in', string $signInMessage = 'You are not currently logged in.', string $refuse = 'rest_forbidden', string $message = 'Sorry, you are not allowed to do that.', ?Minn\Http\Policy $edit = NULL, ?Minn\Http\Subject $subject = NULL, ?string $missing = NULL, ?string $missingMessage = NULL, int $signInStatus = 401, ?string $verb = NULL, ?array $opener = NULL)

`$caps`	`list<string>`	further capabilities every one of which the caller must hold
`$param`	`string\|null`	the pattern capture holding the object id an Own policy judges, or the subject's id
`$edit`	`Policy\|null`	a policy judged as well when the request asks for the edit context
`$subject`	`Subject\|null`	the record the capture names, looked up before the caller is judged
`$missing`	`string\|null`	the 404 code when the subject does not exist; the subject's own when null
`$missingMessage`	`string\|null`	its message; the subject's own when null
`$signInStatus`	`int`	the status a signed-out caller is refused with (the reference answers some routes' signed-out writes 404, not 401)
`$verb`	`string\|null`	what a Type or Taxonomy route does (create, edit, delete), judged with the type's or taxonomy's own capabilities

method

isPublic(): bool#

Whether the route is open to anyone with nothing to look up, so the gate need not run at all.

method

missingCode(): string#

The 404 code a missing subject earns.

method

missingText(): string#

The 404 message a missing subject earns.

method

capabilities(): array#

Every capability the policy asks for by name, the one on the object included, so a listing can show what a route takes.

@return list<string>

method

toArray(): array#

The policy as data, for the route catalogue. @return array<string, mixed>

@return array<string, mixed>

method

describe(): string#

The policy in one line, for the route index and the docs.