Some thoughts about logics about aacl

[banks]

I made AACL to be flexible so that you can protect controller actions or models. I never for a second actually though you should do both!

For any page that relates to CRUD for a model, it makes no sense to define resources for both the controller action and the model!

So in you basic crud controllers they shouldn't be resources or at least the actions that directly correspond to model crud shouldn't.

The point of AACL is to provide tools to set up your app in a way where all rules can be auto discovered. You still have to choose which actions/model permissions need to be defined to fit the needs of your application.

Most ACLs either work on models OR controllers which is very limiting so AACL is different. With flexibility comes responsibility though: you have to make the rules make sense for your app rather than just make everything possible have a permission and then worry about it being unclear.

[ckald]

Thanks, you're right. I was just thinking to much about automatic extending of my system by modules (you need only to unzip module and check an option in admin area).