title: How can I implement an Access Control List in my Web MVC application?
body: <p><strong>First question</strong></p>
  <p>Please, could you explain me how simpliest ACL could be implemented in MVC.</p>
  <p>Here is the first approach of using Acl in Controller...</p>
  <pre><code>&lt;?php
  class MyController extends Controller {
  
    public function myMethod() {        
      //It is just abstract code
      $acl = new Acl();
      $acl-&gt;setController('MyController');
      $acl-&gt;setMethod('myMethod');
      $acl-&gt;getRole();
      if (!$acl-&gt;allowed()) die(&quot;You're not allowed to do it!&quot;);
      ...    
    }
  
  }
  ?&gt;
  </code></pre>
  <p>It is very bad approach, and it's minus is that we have to add Acl piece of code into each controller's method, but we don't need any additional dependencies!</p>
  <p>Next approach is to make all controller's methods <code>private</code> and add ACL code into controller's <code>__call</code> method.</p>
  <pre><code>&lt;?php
  class MyController extends Controller {
  
    private function myMethod() {
      ...
    }
  
    public function __call($name, $params) {
      //It is just abstract code
      $acl = new Acl();
      $acl-&gt;setController(__CLASS__);
      $acl-&gt;setMethod($name);
      $acl-&gt;getRole();
      if (!$acl-&gt;allowed()) die(&quot;You're not allowed to do it!&quot;);
      ...   
    }
  
  }
  ?&gt;
  </code></pre>
  <p>It is better than previous code, but main minuses are...</p>
  <ul>
  <li>All controller's methods should be private</li>
  <li>We have to add ACL code into each controller's __call method.</li>
  </ul>
  <p>The next approach is to put Acl code into parent Controller, but we still need to keep all child controller's methods private.</p>
  <p>What is the solution? And what is the best practice?
  Where should I call Acl functions to decide allow or disallow method to be executed.</p>
  <p><strong>Second question</strong></p>
  <p>Second question is about getting role using Acl. Let's imagine that we have guests, users and user's friends. User have restricted access to viewing his profile that only friends can view it. All guests can't view this user's profile. So, here is the logic..</p>
  <ul>
  <li>we have to ensure that method being called is profile</li>
  <li>we have to detect owner of this profile</li>
  <li>we have to detect is viewer is owner of this profile or no</li>
  <li>we have to read restriction rules about this profile</li>
  <li>we have to decide execute or not execute profile method</li>
  </ul>
  <p>The main question is about detecting owner of profile. We can detect who is owner of profile only executing model's method $model-&gt;getOwner(), but Acl do not have access to model. How can we implement this?</p>