acl
The m_acl model gives access the id of the currently logged in user, and provides a mechanism to do basic access control checks.
The following m_acl model properties are available in templates:
| Property | Description |
|---|---|
| user | Returns the current user id. If not logged in, this returns undefined. |
| is_admin | Check if the current user is alllowed to access the admin. Internally, this checks the use, mod_admin_config ACL. |
| use, admin, view, delete, update, insert, link | These properties are shortcuts to check if the current user is allowed to do some action. |
| is_allowed | Perform custom ACL checks which are different from the ones mentioned. |
| authenticated | Used before the other ACL checks to check if a typical user is allowed to perform some actions. Example: m.acl.authenticated.insert.article If a user is logged on the that user's permissions are used. |
| auth_service | Service used to authenticate the user. |
| auth_service_uid | Service user identification used to authenticate the user. |
This example prints a greeting to the currently logged in user, if logged in:
{% if m.acl.user %}
Hello, {{ m.rsc[m.acl.user].title }}!
{% else %}
Not logged in yet
{% endif %}
This example checks if the user can access the admin pages:
{% if m.acl.is_admin %} You are an admin {% endif %}
This example performs a custom check:
{% if m.acl.is_allowed.use.mod_admin_config %}
User has rights to edit the admin config
{% endif %}
And to check if a resource is editable:
{% if m.acl.is_allowed.update[id] %}
User can edit the resource with id {{ id }}
{% endif %}
A short hand for the above is (assuming id is an integer):
{% if id.is_editable %}
User can edit the resource with id {{ id }}
{% endif %}
Available Model API Paths
| Method | Path pattern | Description |
|---|---|---|
get | /user/... | Return the current ACL user id from the request context. |
get | `/auth_service | Service used to authenticate the user. |
get | `/auth_service_uid | Service user identification used to authenticate the user. |
get | /sudo_user/... | Return the current sudo user id from the request context. |
get | /is_admin/... | Return whether the current user has admin rights. |
get | /is_admin_editable/... | Return whether admin users are editable in the current ACL setup. |
get | /is_read_only/... | Return whether the current ACL mode is read-only. |
get | /is_allowed/link/+subject/+predicate/+object/... | Check ACL permission for creating/using a link triple (+subject, +predicate, +object). |
get | /is_allowed/+action/+object/... | Check ACL permission for action +action on object +object. |
get | /authenticated/+action/+object/... | Check permission as an authenticated user under default ACL assumptions. |
get | /authenticated/is_allowed/+action/+object/... | Alias of the authenticated permission check for action +action on +object. |
get | /anonymous/+action/+object/... | Check permission as an anonymous user under default ACL assumptions. |
get | /anonymous/is_allowed/+action/+object/... | Alias of the anonymous permission check for action +action on +object. |
get | /link/+subject/+predicate/+object/... | Legacy shortcut for link permission check (same as /is_allowed/link/...). |
get | /+action/+object/... | Shorthand permission check for action +action on +object (same logic as /is_allowed/...). |
/+name marks a variable path segment. A trailing /... means extra path segments are accepted for further lookups.