# Accessing controller authorization through template View

**URL:** <https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692>\
**Category:** Need Help\
**Created:** [April 21, 2020, 10:34am UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692 "2020-04-21T10:34:22Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 21, 2020, 10:34am UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/1 "2020-04-21T10:34:22Z")

</div>

I would like to only display the edit action of an article if the user is authorized. I tried to access the controller authorization in the template file like this:

_\templates\Articles\index.php_

```
<td class="actions">
                       ..
                        <?= $this->controller->Authorization->authorize($article) ? $this->Html->link(__('Edit'), ['action' => 'edit', $article->id]) : '' ; ?> 
.. </td>

```

resulting in MissingHelper error. What do I need to understand to create a proper way of accessing the authorization function within a template/View?

---

<div class="post-metadata">

**Author:** ![ilyav](https://avatars.discourse-cdn.com/v4/letter/i/c4cdca/32.png) [@ilyav](https://discourse.cakephp.org/u/ilyav)\
**Post date:** [April 21, 2020, 10:41am UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/2 "2020-04-21T10:41:35Z")

</div>

Maybe help.

```auto
<?php if ($this->Authorize->verify($current_user, 'Articles, 'index')): ?>
    <?= $this->Html->link(__('Edit'), ['action' => 'edit', $article->id]) ?>
<?php endif ?>

```

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 21, 2020, 11:29am UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/3 "2020-04-21T11:29:48Z")

</div>

That results in the same MissingHelper error.

I tried both variations with syntax errors  
` <?php $this->Authorize->verify($current_user, 'Articles', 'index') ? echo $this->Html->link(__('Edit'), ['action' => 'edit', $article->id]) : '' ;?>`  
error echo unexpected.

```
<?php if($this->Authorize->verify($current_user, 'Articles', 'index')) 
						{ echo $this->Html->link(__('Edit'), ['action' => 'edit', $article->id])} ;?> 

```

error ‘{’ unexpected, expecting ‘;’ or ‘,’

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 21, 2020, 2:18pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/4 "2020-04-21T14:18:27Z")

</div>

Did you load the Authorize helper? Is there even such a thing? Why did you think that this would work?

For my application, I built a little [Authorize helper](https://github.com/Zuluru/Zuluru3/blob/master/src/View/Helper/AuthorizeHelper.php). With that loaded, I can call `$this->Authorize->can(...)` in my views to check permissions on individual actions. I have at times had to work around limitations in the plugin, and am therefore currently using a modified fork of it, so I can’t guarantee that this will work for you out of the box, but it should be close enough to give the general idea.

---

<div class="post-metadata">

**Author:** ![allankh](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@allankh](https://discourse.cakephp.org/u/allankh)\
**Post date:** [April 21, 2020, 4:20pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/5 "2020-04-21T16:20:55Z")

</div>

As @Zuluru noted, at the very top of your template file, load the Authorization helper:

`$this->loadHelper('Authentication.Identity');`

You can then:

```
<?php if ($this->Identity->isLoggedIn()): ?>
<!-- do the things for logged in folk -->
<?php endif ?>
```

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 21, 2020, 4:23pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/6 "2020-04-21T16:23:44Z")

</div>

Authentication and authorization are different. Authentication helper can get you details about who is logged in. Checking whether they have permission to do a particular thing is authorization, which doesn’t appear to have a stock helper.

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 21, 2020, 5:05pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/7 "2020-04-21T17:05:44Z")

</div>

The Identity that is stored in the session for the Authenticated user gains an additional interface when Authorization is used also.

If all that is set up properly you can do the policy checks directly from the Identity object too.

```auto
if ($identity->can('edit', $article)){
   echo $this->Html->link(__('Edit'), ['action' => 'edit', $article->id]);
}

```

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 21, 2020, 5:40pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/8 "2020-04-21T17:40:14Z")

</div>

Wonder if that was added after I adopted the plugin.

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 21, 2020, 6:21pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/9 "2020-04-21T18:21:13Z")

</div>

Don’t know. [This now starts](https://book.cakephp.org/authorization/2/en/checking-authorization.html#checking-authorization) with a discussion of the Identity.

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 21, 2020, 8:20pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/10 "2020-04-21T20:20:30Z")

</div>

> [@Zuluru](#):
>
> Did you load the Authorize helper? Is there even such a thing? Why did you think that this would work?

I “got inspired” by `$this->Authorization->authorize($article);` in the ArticleController.php since it works there, without explicit loading a corresponding helper.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 21, 2020, 8:53pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/11 "2020-04-21T20:53:32Z")

</div>

That’s because controllers don’t use helpers, they use components. You presumably have loaded the authorization component.

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 21, 2020, 9:18pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/12 "2020-04-21T21:18:16Z")

</div>

the can(…) function is unknown. From the documentation I am not sure if I have to change the UserEntity.php, since I use `$id = $this->request->getAttribute('identity');` instead of` user_id`  
I added `use Authorization\Identity;` to the Application.php since

"_If your application uses the [cakephp/authentication](https://github.com/cakephp/authentication) plugin then the `Authorization\Identity` class will be used. This class implements the Authentication\IdentityInterface` in addition to the Authorization\IdentityInterface_ . "

This seems redundant though, as it states it already will be used automatically?  
I followed the authorization tutorial so it is loaded in my Apllication.php and its middleware function. Although I miss the `ResponseInterface $response` in the public function getAuthorizationService().

So $id is the attribute identity now. What type of object is this?

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 21, 2020, 9:21pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/13 "2020-04-21T21:21:30Z")

</div>

> [@Zuluru](#):
>
> That’s because controllers don’t use helpers, they use components.

That’s why I tried refering to the controller:  
`$this->controller->`  
But there I guess the View object (?) of $this in the template doesn’t have this reference.

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 21, 2020, 9:46pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/14 "2020-04-21T21:46:08Z")

</div>

Yeah, separation of concerns. You should never (read: _extremely_ rarely) need to access the controller from a view/template or a model.

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 21, 2020, 10:02pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/15 "2020-04-21T22:02:39Z")

</div>

> [@HypJ3U50N](#):
>
> the can(…) function is unknown. From the documentation I am not sure if I have to change the UserEntity.php, since I use `$id = $this->request->getAttribute('identity');` instead of ` user_id`

I’m not sure of the ‘main line’ procedure here.

In my application I wanted a more feature rich `Identity` than the one created by Authentication/Authorization so I had to write code to insure my substitute object implemented the two required interfaces.

It is the `Authorization\IdentityInterface` the provides the `can()` method. So, it sounds like your object isn’t properly implementing that.

Since I manually built my object to have the required features I’m not clear on what solution to suggest in your out-of-the-box case.

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 22, 2020, 12:35pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/16 "2020-04-22T12:35:36Z")

</div>

EDIT: I may have overlooked or the error has changed, but can() seems not to be the problem, but the $article?:

> Call to a member function can() on null

OP (how to spoiler this text?):  
I don’t know what could be wrong with my setup. I checked with the [files of lukec8](https://discourse.cakephp.org/t/authorization-tutorial-result-should-final-state-still-include-policy-errors/7664/12) and it seems OK (the same components setup and some differences in ArticlePolicy and ArticleController though).

So I guess I have to dig a little deeper. What object is the $id below? And to make sure, $this is a View? Is there a console where I can test with gettype()? Then I may find out where $id is missing the link with IdentityInterface.

`$id = $this->request->getAttribute('identity');`

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [April 22, 2020, 2:20pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/17 "2020-04-22T14:20:35Z")

</div>

How are you calling `can`?

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 22, 2020, 3:23pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/18 "2020-04-22T15:23:58Z")

</div>

> [@HypJ3U50N](#):
>
> Is there a console where I can test with gettype()?

In a controller, this will output Important details of your class:

```auto
        echo '<pre>';
        $identity = $this->request->getAttribute('identity');

        echo 'My Identity class' . PHP_EOL;
        echo get_class($identity) . PHP_EOL . PHP_EOL;

        echo 'Parents of my class' . PHP_EOL;
        echo var_export(class_parents($identity)) . PHP_EOL. PHP_EOL;

        echo 'My class implements theses required interfaces' . PHP_EOL;
        echo var_export(class_implements($identity)) . PHP_EOL . PHP_EOL;
        echo '</pre>';

```

This is what I get.

```auto
My Identity class
App\Model\Entity\UserIdentity

Parents of my class
array (
  'Authentication\\Identity' => 'Authentication\\Identity',
)

My class implements theses required interfaces
array (
  'ArrayAccess' => 'ArrayAccess',
  'Authentication\\IdentityInterface' => 'Authentication\\IdentityInterface',
  'Authorization\\IdentityInterface' => 'Authorization\\IdentityInterface',
)

```

As I said earlier, my Identity object is different (UserIdentity) but it extends Identity and implements all the required interfaces.

If yours implements those interfaces, you are on the right path.

[Here are some other php introspection tools](https://www.php.net/manual/en/ref.classobj.php) that may come in handy when debugging.

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 22, 2020, 5:17pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/19 "2020-04-22T17:17:58Z")

</div>

> [@Zuluru](#):
>
> How are you calling `can`?

As dreamingmind suggested:

> [@dreamingmind](#):
>
> if ($identity-\>can(‘edit’, $article)){ echo $this-\>Html-\>link(\_\_(‘Edit’), [‘action’ =\> ‘edit’, $article-\>id]); }

in `<?php foreach ($articles as $article): ?> <tr>.. <td class="actions">...` of edit.php (Article template)  
and initiating $identity in the top of that template:  
` $id = $this->request->getAttribute('identity');`

---

<div class="post-metadata">

**Author:** ![HypJ3U50N](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/hypj3u50n/32/1803_2.png) [@HypJ3U50N](https://discourse.cakephp.org/u/HypJ3U50N)\
**Post date:** [April 22, 2020, 5:24pm UTC](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692/20 "2020-04-22T17:24:26Z")

</div>

It gives me the following error:

[**Warning** (2)](javascript:void(0);): get\_class() expects parameter 1 to be object, null given

But you say this should be in a controller, while I want to implement this in a View template. Or should your code work the same nevertheless?

[Next page](https://discourse.cakephp.org/t/accessing-controller-authorization-through-template-view/7692.md?page=2)