O Guia Definitivo do Yii 1.1

a permission that is atomic. For example, we can have a system with administrator role
which consists of post management task and user management task. The user
management task may consist of create user, update user and delete user operations. For
more flexibility, Yii also allows a role to consist of other roles or operations, a task to
consist of other tasks, and an operation to consist of other operations.
An authorization item is uniquely identified by its name.
An authorization item may be associated with a business rule. A business rule is a piece of
PHP code that will be executed when performing access checking with respect to the item.
Only when the execution returns true, will the user be considered to have the permission
represented by the item. For example, when defining an operation updatePost, we would
like to add a business rule that checks if the user ID is the same as the post's author ID so
that only the author himself can have the permission to update a post.
Using authorization items, we can build up an authorization hierarchy. An item A is a parent
of another item Bin the hierarchy if A consists of B (or say A inherits the permission(s)
represented by B). An item can have multiple child items, and it can also have multiple
parent items. Therefore, an authorization hierarchy is a partial-order graph rather than a
tree. In this hierarchy, role items sit on top levels, operation items on bottom levels, while
task items in between.
Once we have an authorization hierarchy, we can assign roles in this hierarchy to
application users. A user, once assigned with a role, will have the permissions represented
by the role. For example, if we assign the administrator role to a user, he will have the
administrator permissions which include post management and user management (and
the corresponding operations such as create user).
Now the fun part starts. In a controller action, we want to check if the current user can
delete the specified post. Using the RBAC hierarchy and assignment, this can be done
easily as follows:
if(Yii::app()->user->checkAccess('deletePost'))
{
// delete the post
}
Configuring Authorization Manager
Before we set off to define an authorization hierarchy and perform access checking, we
need to configure the authManager application component. Yii provides two types of
authorization managers: CPhpAuthManager and CDbAuthManager. The former uses a
PHP script file to store authorization data, while the latter stores authorization data in
database. When we configure the authManager application component, we need to
specify which component class to use and what are the initial property values for the
component. For example,