R – Zend Framework: How to display multiple actions, each requiring different authorizations levels, on a single page

zend-framework

Imagine I have 4 database tables, and an interface that presents forms for the management of the data in each of these tables on a single webpage (using the accordion design pattern to show only one form at a time). Each form is displayed with a list of rows in the table, allowing the user to insert a new row or select a row to edit or delete. AJAX is then used to send the request to the server.

A different set of forms must be displayed to different users, based on the application ACL.

My question is: In terms of controllers, actions, views, and layouts, what is the best architecture for this interface?

For example, so far I have a controller with add, edit and delete actions for each table. There is an indexAction for each, but it's an empty function. I've also extended Zend_Form for each table. To display the forms, I then in the IndexController pass the Forms to it's view, and echo each form. Javascript then takes care of populating the form and sending requests to the appropraite add/edit/delete action of the appropriate controller. This however doesn't allow for ACL to control the display or not of Forms to different users.

Would it be better to have the indexAction instantiate the form, and then use something like $this->render(); to render each view within the view of the indexAction of the IndexController? Would ACL then prevent certain views from being rendered?

Cheers.

Best Answer

There are a couple of places you could run your checks against your ACL:

  1. Where you have your loop (or hardcoded block) to load each form.
  2. In the constructor of each of the Form Objects, perhaps throwing a custom exception, which can be caught and appropriately handled.
  3. From the constructor of an extension of Zend_Form from which all your custom Form objects are extended (probably the best method, as it helps reduce code duplication).

Keep in mind, that if you are using ZF to perform an AJAXy solution for your updating, your controller needs to run the ACL check in it's init() method as well, preventing unauthorized changes to your DB.

Hope that helps.

Related Topic