Finish Authorization chapter.

Author: markstory

src/Controller/AppController.php

@@ -40,16 +40,30 @@ class AppController extends Controller
     public function initialize()
     {
         parent::initialize();
-
         $this->loadComponent('RequestHandler');
         $this->loadComponent('Flash');
 
-        /*
-         * Enable the following components for recommended CakePHP security settings.
-         * see https://book.cakephp.org/3.0/en/controllers/components/security.html
-         */
-        //$this->loadComponent('Security');
-        //$this->loadComponent('Csrf');
+        $this->loadComponent('Auth', [
+            'authorize'=> 'Controller',
+            'authenticate' => [
+                'Form' => [
+                    'fields' => [
+                        'username' => 'email',
+                        'password' => 'password'
+                    ]
+                ]
+            ],
+            'loginAction' => [
+                'controller' => 'Users',
+                'action' => 'login'
+            ],
+             // If unauthorized, return them to page they were just on
+            'unauthorizedRedirect' => $this->referer()
+        ]);
+
+        // Allow the display action so our PagesController
+        // continues to work. Also enable the read only actions.
+        $this->Auth->allow(['display', 'view', 'index']);
     }
 
     /**
@@ -69,4 +83,10 @@ public function beforeRender(Event $event)
             $this->set('_serialize', true);
         }
     }
+
+    public function isAuthorized($user)
+    {
+        // By default deny access.
+        return false;
+    }
 }

src/Controller/ArticlesController.php

@@ -14,6 +14,8 @@ public function initialize()
 
         $this->loadComponent('Flash'); // Include the FlashComponent
         $this->loadComponent('Paginator'); // Include the FlashComponent
+
+        $this->Auth->allow(['tags']);
     }
 
     public function index()
@@ -33,18 +35,16 @@ public function add()
         $article = $this->Articles->newEntity();
         if ($this->request->is('post')) {
             $article = $this->Articles->patchEntity($article, $this->request->getData());
+
+            // Added: Set the user_id from the session.
+            $article->user_id = $this->Auth->user('id');
+
             if ($this->Articles->save($article)) {
                 $this->Flash->success(__('Your article has been saved.'));
                 return $this->redirect(['action' => 'index']);
             }
             $this->Flash->error(__('Unable to add your article.'));
         }
-        // Get a list of tags.
-        $tags = $this->Articles->Tags->find('list');
-
-        // Set tags to the view context
-        $this->set('tags', $tags);
-
         $this->set('article', $article);
     }
 
@@ -54,8 +54,12 @@ public function edit($slug)
             ->findBySlug($slug)
             ->contain('Tags') // load associated Tags
             ->firstOrFail();
+
         if ($this->request->is(['post', 'put'])) {
-            $this->Articles->patchEntity($article, $this->request->getData());
+            $this->Articles->patchEntity($article, $this->request->getData(), [
+                // Added: Disable modification of user_id.
+                'accessibleFields' => ['user_id' => false]
+            ]);
             if ($this->Articles->save($article)) {
                 $this->Flash->success(__('Your article has been updated.'));
                 return $this->redirect(['action' => 'index']);
@@ -66,9 +70,8 @@ public function edit($slug)
         // Get a list of tags.
         $tags = $this->Articles->Tags->find('list');
 
-        // Set tags to the view context
+        // Set article & tags to the view context
         $this->set('tags', $tags);
-
         $this->set('article', $article);
     }
 
@@ -100,4 +103,24 @@ public function tags()
             'tags' => $tags
         ]);
     }
+
+    public function isAuthorized($user)
+    {
+        $action = $this->request->getParam('action');
+        // The add and tags actions are always allowed to logged in users.
+        if (in_array($action, ['add', 'tags'])) {
+            return true;
+        }
+
+        // All other actions require a slug.
+        $slug = $this->request->getParam('pass.0');
+        if (!$slug) {
+            return false;
+        }
+
+        // Check that the article belongs to the current user.
+        $article = $this->Articles->findBySlug($slug)->first();
+
+        return $article->user_id === $user['id'];
+    }
 }

src/Controller/UsersController.php

@@ -12,6 +12,11 @@
  */
 class UsersController extends AppController
 {
+    public function initialize()
+    {
+        parent::initialize();
+        $this->Auth->allow(['logout', 'add']);
+    }
 
     /**
      * Index method
@@ -26,6 +31,24 @@ public function index()
         $this->set('_serialize', ['users']);
     }
 
+    public function login()
+    {
+        if ($this->request->is('post')) {
+            $user = $this->Auth->identify();
+            if ($user) {
+                $this->Auth->setUser($user);
+                return $this->redirect($this->Auth->redirectUrl());
+            }
+            $this->Flash->error('Your username or password is incorrect.');
+        }
+    }
+
+    public function logout()
+    {
+        $this->Flash->success('You are now logged out.');
+        return $this->redirect($this->Auth->logout());
+    }
+
     /**
      * View method
      *

src/Template/Articles/add.ctp

@@ -3,8 +3,6 @@
 <h1>Add Article</h1>
 <?php
     echo $this->Form->create($article);
-    // Hard code the user for now.
-    echo $this->Form->control('user_id', ['type' => 'hidden', 'value' => 1]);
     echo $this->Form->control('title');
     echo $this->Form->control('body', ['rows' => '3']);
     echo $this->Form->control('tag_string', ['type' => 'text']);

src/Template/Articles/edit.ctp

@@ -3,7 +3,6 @@
 <h1>Edit Article</h1>
 <?php
     echo $this->Form->create($article);
-    echo $this->Form->control('user_id', ['type' => 'hidden']);
     echo $this->Form->control('title');
     echo $this->Form->control('body', ['rows' => '3']);
     echo $this->Form->control('tag_string', ['type' => 'text']);

src/Template/Users/login.ctp

@@ -0,0 +1,6 @@
+<h1>Login</h1>
+<?= $this->Form->create() ?>
+<?= $this->Form->control('email') ?>
+<?= $this->Form->control('password') ?>
+<?= $this->Form->button('Login') ?>
+<?= $this->Form->end() ?>