YII框架的权限管理是什么？YII框架如何实现细粒度控制？

accessRules()

public function accessRules()
{
    return [
        [
            'allow',
            'actions' => ['index', 'view'],
            'roles' => ['@'], // 登录用户
        ],
        [
            'allow',
            'actions' => ['create', 'update', 'delete'],
            'roles' => ['admin'], // 管理员
        ],
        [
            'deny',  // 拒绝所有
            'users' => ['*'],
        ],
    ];
}

authManager

post.create

post.update

post.delete

PostAuthorRule

class PostAuthorRule extends \yii\rbac\Rule
{
    public $name = 'isPostAuthor';

    /**
     * @param string|int $user_id The user ID.
     * @param \yii\rbac\Item $item The role or permission that this rule is associated with.
     * @param array $params Parameters passed to ManagerInterface::checkAccess().
     * @return bool a value indicating whether the rule permits the role or permission it is associated with.
     */
    public function execute($user_id, $item, $params)
    {
        if (!isset($params['post'])) {
            return false;
        }

        $post = $params['post'];
        return $post->createdBy == $user_id;
    }
}

updatePost

PostAuthorRule

$auth = Yii::$app->authManager;

$rule = new PostAuthorRule();
$auth->add($rule);

$updatePost = $auth->createPermission('updatePost');
$updatePost->description = 'Update a post';
$updatePost->ruleName = $rule->name;
$auth->add($updatePost);

updatePost

Yii::$app->user->can('updatePost', ['post' => $post])

beforeAction()

public function beforeAction($action)
{
    if (!parent::beforeAction($action)) {
        return false;
    }

    if (!Yii::$app->user->can($action->id, ['post' => $this->findModel(Yii::$app->request->get('id'))])) {
        if (Yii::$app->user->isGuest) {
            Yii::$app->user->loginRequired();
        } else {
            throw new \yii\web\ForbiddenHttpException('You are not allowed to perform this action.');
        }
        return false;
    }

    return true;
}

created_by

updated_by

if (!Yii.app.user.checkAccess('updatePost', {post: post})) {
    $('#update-button').prop('disabled', true);
}