CoolCMS API

ApiRbacConfig
in package

FinalYes

RBAC gate modes for the Api layer, as two independent switches.

Values come from parameters.apiRbac.{mode,internalMode} in config/Shared/api.neon.

Both accept the same values:

  • off: the gate does not run at all (no extra queries, no log lines).
  • log: the gate evaluates and writes API_RBAC ... to the auth channel, but denies nothing.
  • enforce: a denial returns HTTP 403 (external) or Result::failure(PERMISSION_DENIED) (internal).

The switches are separate so that measuring the internal path cannot downgrade the external one back to log, and so that either side can be rolled back alone. An internal denial breaks the public website, an external one affects API clients only.

IMPORTANT: $mode does not control admin or front end, because startup() does not run on the internal path. $internalMode controls exactly those, which is why its default is off. IMPORTANT: both are compile-time parameters; after changing either, clear temp/cache, otherwise the old value stays in effect.

Table of Contents

Constants

MODE_ENFORCE  : string = 'enforce'
MODE_LOG  : string = 'log'
MODE_OFF  : string = 'off'
MODES  : array<string|int, mixed> = [self::MODE_OFF, self::MODE_LOG, self::MODE_ENF...

Properties

$internalMode  : string
Gate mode for the internal (bridge) path in `internalAction*()`.
$mode  : string

Methods

__construct()  : mixed
isEnforce()  : bool
isInternalEnforce()  : bool
isInternalLog()  : bool
isInternalOff()  : bool
isLog()  : bool
isOff()  : bool
sanitize()  : string

Constants

MODES

private array<string|int, mixed> MODES = [self::MODE_OFF, self::MODE_LOG, self::MODE_ENFORCE]

Properties

$internalMode read-only

Gate mode for the internal (bridge) path in `internalAction*()`.

public string $internalMode

Methods

__construct()

public __construct([string $mode = self::MODE_LOG ][, string $internalMode = self::MODE_OFF ]) : mixed
Parameters
$mode : string = self::MODE_LOG
$internalMode : string = self::MODE_OFF

isInternalEnforce()

public isInternalEnforce() : bool
Return values
bool

isInternalLog()

public isInternalLog() : bool
Return values
bool

isInternalOff()

public isInternalOff() : bool
Return values
bool

sanitize()

private static sanitize(string $value, string $fallback, string $label) : string
Parameters
$value : string
$fallback : string
$label : string
Return values
string
On this page

Search results