OOP PHP项目函数授权实现：角色与权限设计方法咨询

Hey Edgar, great question—implementing role-based access control (RBAC) in an OOP PHP project is totally manageable, and I’ll walk you through the best practices tailored for PHP + MySQL. Let’s break this down step by step so you can implement it cleanly and flexibly.

First, you need a flexible database structure to map users, roles, and their permissions. We’ll use many-to-many relationships since a user can have multiple roles, and a role can have multiple permissions. Here’s the schema:

-- Users table (stores basic user info)
CREATE TABLE users (
    id INT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) UNIQUE NOT NULL,
    email VARCHAR(100) UNIQUE NOT NULL,
    password VARCHAR(255) NOT NULL, -- Always use password_hash() to store hashes
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

-- Roles table (defines role types like admin/editor/viewer)
CREATE TABLE roles (
    id INT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(50) UNIQUE NOT NULL,
    description TEXT
);

-- Permissions table (defines granular actions like read_posts/edit_users)
CREATE TABLE permissions (
    id INT PRIMARY KEY AUTO_INCREMENT,
    name VARCHAR(50) UNIQUE NOT NULL,
    description TEXT
);

-- User-Role join table (links users to their roles)
CREATE TABLE user_roles (
    user_id INT,
    role_id INT,
    PRIMARY KEY (user_id, role_id),
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE
);

-- Role-Permission join table (links roles to their permissions)
CREATE TABLE role_permissions (
    role_id INT,
    permission_id INT,
    PRIMARY KEY (role_id, permission_id),
    FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE,
    FOREIGN KEY (permission_id) REFERENCES permissions(id) ON DELETE CASCADE
);

This setup lets you easily adjust roles or permissions without modifying user data—perfect for scaling later.

Now let’s translate this schema into clean OOP classes to encapsulate authorization logic.

User Class #

Handles user-specific authorization checks by aggregating permissions from all assigned roles:

class User {
    private int $id;
    private string $username;
    private array $roles; // Array of Role objects

    public function __construct(int $id, string $username, array $roles) {
        $this->id = $id;
        $this->username = $username;
        $this->roles = $roles;
    }

    // Get all unique permissions across the user's roles
    public function getPermissions(): array {
        $permissions = [];
        foreach ($this->roles as $role) {
            $permissions = array_merge($permissions, $role->getPermissions());
        }
        return array_unique($permissions);
    }

    // Check if user has a specific permission
    public function hasPermission(string $permissionName): bool {
        return in_array($permissionName, $this->getPermissions());
    }

    // Check if user belongs to a specific role
    public function hasRole(string $roleName): bool {
        foreach ($this->roles as $role) {
            if ($role->getName() === $roleName) {
                return true;
            }
        }
        return false;
    }

    // Getters
    public function getId(): int { return $this->id; }
    public function getUsername(): string { return $this->username; }
}

Role Class #

Encapsulates role data and its associated permissions:

class Role {
    private int $id;
    private string $name;
    private array $permissions; // Array of Permission objects

    public function __construct(int $id, string $name, array $permissions) {
        $this->id = $id;
        $this->name = $name;
        $this->permissions = $permissions;
    }

    public function getName(): string { return $this->name; }

    // Return permission names as an array for easy checking
    public function getPermissions(): array {
        return array_map(fn($permission) => $permission->getName(), $this->permissions);
    }
}

Permission Class #

Simple class to represent individual permissions:

class Permission {
    private int $id;
    private string $name;

    public function __construct(int $id, string $name) {
        $this->id = $id;
        $this->name = $name;
    }

    public function getName(): string { return $this->name; }
}

Auth Class #

Handles loading user data from the database and provides helper methods for authorization checks:

class Auth {
    private PDO $db;

    public function __construct(PDO $db) {
        $this->db = $db;
    }

    // Load a full User object with roles and permissions
    public function loadUserById(int $userId): ?User {
        $stmt = $this->db->prepare("SELECT id, username FROM users WHERE id = ?");
        $stmt->execute([$userId]);
        $userData = $stmt->fetch(PDO::FETCH_ASSOC);
        
        if (!$userData) return null;

        $roles = $this->loadUserRoles($userId);
        return new User($userData['id'], $userData['username'], $roles);
    }

    // Load roles for a user
    private function loadUserRoles(int $userId): array {
        $stmt = $this->db->prepare("
            SELECT r.id, r.name 
            FROM roles r
            JOIN user_roles ur ON r.id = ur.role_id
            WHERE ur.user_id = ?
        ");
        $stmt->execute([$userId]);
        $roleDataList = $stmt->fetchAll(PDO::FETCH_ASSOC);

        $roles = [];
        foreach ($roleDataList as $roleData) {
            $permissions = $this->loadRolePermissions($roleData['id']);
            $roles[] = new Role($roleData['id'], $roleData['name'], $permissions);
        }
        return $roles;
    }

    // Load permissions for a role
    private function loadRolePermissions(int $roleId): array {
        $stmt = $this->db->prepare("
            SELECT p.id, p.name 
            FROM permissions p
            JOIN role_permissions rp ON p.id = rp.permission_id
            WHERE rp.role_id = ?
        ");
        $stmt->execute([$roleId]);
        $permissionDataList = $stmt->fetchAll(PDO::FETCH_ASSOC);

        $permissions = [];
        foreach ($permissionDataList as $permissionData) {
            $permissions[] = new Permission($permissionData['id'], $permissionData['name']);
        }
        return $permissions;
    }

    // Check if current logged-in user has a permission
    public function hasPermission(string $permissionName): bool {
        if (!isset($_SESSION['user_id'])) return false;
        
        $user = $this->loadUserById($_SESSION['user_id']);
        return $user ? $user->hasPermission($permissionName) : false;
    }
}

Now you can use these classes to restrict access to functions or routes. For example, in a post edit controller:

// Initialize PDO connection
$db = new PDO('mysql:host=localhost;dbname=your_db;charset=utf8', 'db_user', 'db_pass');
$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

$auth = new Auth($db);

// Check if user can edit posts
if (!$auth->hasPermission('edit_posts')) {
    http_response_code(403);
    include 'views/403.php';
    exit;
}

// Proceed with edit post logic
// ...

For reusable checks, create a helper file like auth_guard.php:

session_start();

$db = new PDO('mysql:host=localhost;dbname=your_db;charset=utf8', 'db_user', 'db_pass');
$auth = new Auth($db);

function requirePermission(string $permission) {
    global $auth;
    if (!$auth->hasPermission($permission)) {
        header("Location: login.php");
        exit;
    }
}

Then include it at the top of restricted pages:

require 'auth_guard.php';
requirePermission('delete_users');

// Page content here

To restrict access to files (like private documents or uploads), never store them in your web root—users could bypass PHP checks by accessing the direct URL. Instead:

1. Store files in a directory outside your web root (e.g., /var/www/private_files/)
2. Use a PHP proxy script to serve files after checking permissions:

session_start();

// Initialize Auth
$db = new PDO('mysql:host=localhost;dbname=your_db;charset=utf8', 'db_user', 'db_pass');
$auth = new Auth($db);

// Check permission
if (!$auth->hasPermission('read_private_files')) {
    http_response_code(403);
    echo "Access denied";
    exit;
}

// Sanitize filename to prevent path traversal attacks
$filename = basename($_GET['file']);
$filePath = '/var/www/private_files/' . $filename;

if (!file_exists($filePath)) {
    http_response_code(404);
    echo "File not found";
    exit;
}

// Serve the file
$mime = mime_content_type($filePath);
header("Content-Type: $mime");
header("Content-Length: " . filesize($filePath));
readfile($filePath);
exit;

Users access files via this script: http://yourdomain.com/serve_file.php?file=report.pdf

• Cache Permissions: Store a user’s permission list in the session or Redis to avoid repeated database queries. Update the cache when the user’s roles/permissions change.
• Use Enums (PHP 8.1+): Define permissions as enums to avoid typos:

  enum Permission: string {
      case ReadPosts = 'read_posts';
      case EditPosts = 'edit_posts';
  }
  // Usage: $auth->hasPermission(Permission::EditPosts->value)
  

• Fine-Grained Access: For actions like "edit own posts", add additional checks (e.g., verify the user is the post’s author alongside the permission check).

内容的提问来源于stack exchange，提问作者Edgar Inga