PermissionSet

The resolved authorization state for one request: the flat list of {@see GrantedPermission}s the resolver produced, plus the `'*'` superuser grant if the actor held it. Answers "can this actor do * X?" ({@see self::can()}) and "why?" ({@see self::sourcesOf()}). It may hold the same permission from more than one source (a role AND a flat scope) — that is what makes authorization explainable. Immutable by construction.

public function __construct(array $granted, bool $grantsAll = false, ?Milpa\Auth\PermissionSource $allSource = null):

Parameters

public function can(string $resource, string $action, ?string $namespace = null): bool

Whether the actor can perform $action on $resource (optionally scoped to $namespace). See {@see self::allows()}.

Parameters

public function allows(Milpa\Auth\Permission $permission): bool

Whether $permission is granted — true if `'*'` was granted, else an exact key match. No glob.

Parameters

public function all(): array

public function sourcesOf(Milpa\Auth\Permission $permission): array

Every source that granted $permission (each path, not deduped), preceded by the `'*'` source when this set grants all. Empty when $permission is not granted.

Parameters

public function grantsAll(): bool