CakePHP 3 - Authorization for pages on PagesController - php

Question

My admin hub page is currently situated in the PagesController (called admin). However, both non-logged in users as well as non-admin users are able to access this hub page, even if they can't access all the links from that hub.
Edit: I just realised that it's probably not working because "admin" isn't a function in the PagesController, but rather falls under "display".
My AppController is as follows:
public function initialize()
{
parent::initialize();
$this->loadComponent('RequestHandler');
$this->loadComponent('Flash');
$this->loadComponent('Auth',[
'authorize' => 'Controller',
]);
$this->Auth->allow(['display']);
}
public function beforeFilter(Event $event)
{
$this->Auth->deny(['admin']);
}
My PagesController is as follows:
public function initialize()
{
parent::initialize();
$this->Auth->deny(['admin']);
}
public function isAuthorized($user)
{
if (in_array($this->request->action,['admin'])) {
return (bool)($user['role_id'] === 1); //where role_id = 1 refers to an admin
}
return parent::isAuthorized($user);
}

Answer 1

The Auth->deny() function is to prevent unauthoried users from accessing actions. On the other hand the Auth->allow() function is to give the public access to specific(or all) actions.
Please read the documentation here: https://book.cakephp.org/3.0/en/controllers/components/authentication.html#making-actions-require-authorization
For the Auth component to work as you need it read the following: assuming you have a different admin users database table and you would like to ask visitors for credentials to access the restricted page, you can do the following:
in the AppController, when users visit the restricted page, or in your case when users access the PagesController, load the Auth component and ensure the admin users table is either defined in the Auth component or Cakephp conventions were followed when you named the table.
In AppController
public function initialize()
{
parent::initialize();
if ($this->request->params["controller"] == 'Pages') {
$this->loadComponent('Auth', [
'loginAction' => [
'controller' => 'Access',
'action' => 'admin_login',
'plugin' => 'Access'
],
'loginRedirect' => [
'controller' => 'Access',
'action' => 'admin_index',
'plugin' => 'Access'
],
'authenticate' => [
'Form' => [
'userModel' => 'your-admin-database-table'
]
]
]);
}
}
In PagesController then you need the following:
public function initialize()
{
parent::initialize();
}
loginAction - is used for admin login.
loginRedirect - is where to land the admin users after logging in.
authenticate - is used to define the form details such as database name and fields.
A very detailed documentation can be found here: https://book.cakephp.org/3.0/en/controllers/components/authentication.html
Edit: Please note that the code has not been tested

Answer 2

You're checking against the action, not the prefix. Documentation suggests that what you want is
if ($this->request->getParam('prefix') === 'admin')