Skip to content
This repository was archived by the owner on Jan 30, 2020. It is now read-only.

Commit a0373dc

Browse files
committed
Refactor of LIFO/FILO role parents
1 parent 18c7b67 commit a0373dc

File tree

1 file changed

+20
-4
lines changed

1 file changed

+20
-4
lines changed

doc/book/usage.md

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,26 @@ having inherited conflicting rules from different parent roles.
103103
rule that is directly applicable to the query. In this case, since the "member" role is examined
104104
before the "guest" role, the example code would print "allowed".
105105

106-
> #### LIFO Order for role queries
107-
>
108-
> When specifying multiple parents for a role, keep in mind that the last parent listed is the first
109-
> one searched for rules applicable to an authorization query.
106+
107+
### LIFO/FILO order for Role parents
108+
109+
When specifying multiple parents for a role the last parent listed is the first
110+
one searched for rules applicable to an authorization query. This Last-In-First-Out
111+
(aka First-In-Last-Out) strategy is represented with this example.
112+
Here the `first` role is the highest order:
113+
114+
```
115+
$acl->addRole(new Role('first'), ['last', 'third', 'second']);
116+
```
117+
118+
Less-permissioned roles will be first in the parents array. For instance, where a`guest`
119+
role is unauthenticated, a `user` role is authenticated, and an `admin` role has the highest
120+
permissions, adding the `admin` role is as follows:
121+
122+
```
123+
$acl->addRole(new Role('admin'), ['guest', 'user']);
124+
```
125+
110126

111127
## Creating the Access Control List
112128

0 commit comments

Comments
 (0)