public function getRules()
    {
        return [
            [
                'allow' => true,
                'actions' => [], // apply to all actions by default
                'roles' => ['@'],
                'matchCallback' => function ($rule, $action) {
                    // see if a controller property has been defined to disabled the permission checks
                    if ($action->controller->disablePermissionCheck) {
                        return true;
                    }
                    // get the route based on the current $action object
                    $route = implode('/', [$action->controller->module->id, $action->controller->id, $action->id]);
                    
                    UserOnline::refreshUser($this->user->identity, $route);
                    
                    // check the access inside auth->matchRoute and return true/false.
                    return Yii::$app->auth->matchRoute($this->user->id, $route);
                },
            ],
        ];
    }