Oihana PHP Arango

isAttributeAuthorized.php

Table of Contents

Functions

isAttributeAuthorized()  : bool
Decides whether a query attribute (a filter / facet / group key) is allowed for the current request, by inheriting the permission of the homonymous projection field.

Functions

isAttributeAuthorized()

Decides whether a query attribute (a filter / facet / group key) is allowed for the current request, by inheriting the permission of the homonymous projection field.

isAttributeAuthorized(string $key, array<string|int, mixed>|null $fields[, array<string|int, mixed> $init = [] ]) : bool

The whitelists that gate what can be queried (AQL::FILTERS, Arango::FACETS, Arango::GROUPABLE) are disjoint from the projection permission (Field::REQUIRES on $fields). Without this bridge, a field declared queryable but hidden from reading could still be filtered / faceted / grouped on, and the presence, the distribution or the order of the results would leak the hidden value (an oracle).

This helper closes that gap the same way SortTrait does for sorting: it looks the attribute up in the projection map $fields and, when that field carries a Field::REQUIRES subject, defers the decision to the shared isAuthorized() gate (backend-agnostic closure injected through $init[Arango::AUTHORIZER]). Devise: « what you cannot read, you cannot query on ».

Resolution rules (aligned on the field-level semantics):

  • $fields is not an array, or the attribute is absent / not an array definition → true (nothing to inherit, no gating).
  • The field definition carries no Field::REQUIRES → true (no gating).
  • Otherwise → the result of isAuthorized() (OR over the subjects list, fail-open when no authorizer is injected).
Parameters
$key : string

The public attribute key (already whitelisted by the surface).

$fields : array<string|int, mixed>|null

The model projection map ($this->fields), keyed by field name.

$init : array<string|int, mixed> = []

The request-level init array. Reads Arango::AUTHORIZER.

Tags
example 
$fields = [ 'name' => true , 'salary' => [ Field::REQUIRES => 'hr:read' ] ] ;
isAttributeAuthorized( 'name'   , $fields , $init ) ; // true  (ungated)
isAttributeAuthorized( 'salary' , $fields , [ Arango::AUTHORIZER => fn() => false ] ) ; // false
author

Marc Alcaraz (eKameleon)

since
1.0.0
Return values
bool —

true when the attribute may be queried, false when the inherited subject is refused.

On this page

Search results