mevdschee / php-crud-api

Single file PHP script that adds a REST API to a SQL database

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Global 'operations' authorization

garrettcam opened this issue · comments

I currently have the following to allow only some operations, it is table independent.

'authorization.tableHandler' => function ($operation, $tableName) {
    return in_array($operation, ['list', 'read']);
},

As I only want to control global 'operations' would another level of authorization handler be logical? eg something like this to prevent deletion

'authorization.operationHandler' => function ($operation) {
    return $operation != 'delete';
},

The CRUD operation works on the tables. Inside the authorization.tableHandler,
returning false if $operation == 'delete' seems to do what you need.

'authorization.tableHandler' => function ($operation, $tableName) {
 if($operation == 'delete') return false;
 return in_array($operation, ['list', 'read']);
 }, 

Yes, great advice here: use the tableHandler and ignore the tableName argument.