RBAC always return the exception - php

Question

this is the entry for auth_itemi'm trying to use rbac in yii2-basic framework.
code is as follow:
config/web.php:
'authManager' => [
'class' => 'yii\rbac\DbManager',
],
controller:
public function actionCreate()
{
if(Yii::$app->user->can('countries/create')){
$chk = 'Can Do';
}else{
$chk = 'Can Not Do';
}
echo $chk;exit();
}

Answer 1

Make sure to check that all the points below are working as expected.
The information comes from the Yii2 guide pages and it is explained in more detail there.
Configure the application to use RBAC with the data stored on the database.
'authManager' => [
'class' => 'yii\rbac\DbManager',
],
Add and assign roles and permissions to the database.
One way, probably the simplest, is to use a console controller, but then you have to deal with permissions on user creation and update somewhere else in your code.
<?php
namespace app\commands;
use Yii;
use yii\console\Controller;
class RbacController extends Controller
{
public function actionInit()
{
$auth = Yii::$app->authManager;
$auth->removeAll();
// add "create country" permission better remove '/'
$createCountry = $auth->createPermission('createCountry');
$createCountry->description = 'Create a new country';
$auth->add($createCountry);
// add "admin" role and give this role the "createCountry" permission
$adminRole = $auth->createRole('admin');
$auth->add($adminRole);
$auth->addChild($adminRole, $createCountry);
// Assign roles to user by id, make sure this is the user that you
// are using when testing
$auth->assign($adminRole, 1);
}
}
Add some logs in your controller to check what is not working as expected.
public function actionCreate()
{
// Logs just to find what is wrong, remove them later
if (($user = Yii::$app->user->identity) === null) {
Yii::debug('No user logged in, the problem is there', __METHOD__);
} else {
Yii::debug("User $user->id logged in", __METHOD__);
if (!Yii::$app->user->can('createCountry') {
Yii::debug('User cannot create country', __METHOD__);
if (!Yii::$app->user->can('admin') {
Yii::debug('User does not have admin role', __METHOD__);
} else {
Yii::debug('Admin role does not have createCountry child', __METHOD__);
}
} else {
Yii::debug('User can create country, ALL DONE!', __METHOD__);
}
}
// Remove above this line after finding the problem
// You would keep the logic below this line after finding the problem
if(!Yii::$app->user->can('createCountry')) {
throw new ForbiddenHttpException('You are not allowed to do that');
}
// No 'else' after throwing, more readable code
// Your logic goes here, the user can create countries
}

Answer 2

I'm not sure, but I think:
Your code is almost ok
Missing addChild($adminRole, $createCountry);
The permission is checked against the table auth_item_child.
Parent Child
admin 'createCountry'
admin 'deleteCountry'
guest 'indexCountry'
....
Then you can
if(Yii::$app->user->can('createCountry')){