php - Authorize users based on roles in CakePHP 3 -

i authorize users based on few roles. visitors should able reach method show. wrote in appcontroller:

public function beforefilter(event $event) {     $this->auth->allow(['show']); } 

it works.

in initialize() method of appcontroller i've got also:

$this->loadcomponent('auth', [     'authorize' => 'controller' ]); 

i allow logged users role "user" reach "index", , "add" methods, wrote in appcontroller:

public function isauthorized($user) { if (isset($user['role']) && $user['role'] === 'admin') { return true; } if (isset($user['role']) && $user['role'] === 'user') { $this->auth->allow(['index', 'logout', 'add']); }  return false; } 

admin can reach methods expected. user logged role "user" can't reach "index" or "add" method. how can fix this?

instead of using logic add additional auth allows, use logic determine if they're in action they're allowed, checking action, , return true if they're authorized.

public function isauthorized($user) {      // admin allowed anywhere     if (isset($user['role']) && $user['role'] === 'admin') {         return true;     }      // 'user' allowed in specific actions     if (isset($user['role']) && $user['role'] === 'user') {          $allowedactions = ['index', 'logout', 'add'];         if(in_array($this->request->action, $allowedactions)) {             return true;         }      }     return false; } 

(obviously code shortened liking, shows concept)