RBAC Architecture in CMS Development

This CMS system built on ThinkPHP 3.2.3 implements Role-Based Access Control (RBAC) for managing user permissions across various modules including content, products, users, roles, and system settings.

RBAC Core Concepts

RBAC operates on the principle that users are assigned to roles, and roles are granted permissions to access specific system nodes (modules, controllers, and actions). This creates a flexible permission system where:

• Users can belong to multiple roles
• Roles can access multiple nodes
• Multiple roles can access the same node

Database Schema Requiremetns

The RBAC implementation requires five database tables:

-- User table (custom implementation)
CREATE TABLE `system_user` (
  `uid` int(10) unsigned NOT NULL AUTO_INCREMENT,
  `uname` char(20) NOT NULL DEFAULT '',
  `upass` char(32) NOT NULL DEFAULT '',
  `last_login` int(10) unsigned NOT NULL,
  `login_ip` varchar(30) NOT NULL,
  `is_locked` tinyint(1) unsigned NOT NULL DEFAULT '0',
  PRIMARY KEY (`uid`),
  UNIQUE KEY `uname` (`uname`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

-- System tables (provided by ThinkPHP RBAC)
-- Role table (rbac_role)
-- User-role mapping table (rbac_user_role)
-- Node table (rbac_node)
-- Role-node permission table (rbac_access)

Configuration Setup

The RBAC module requires specific configuration in the application config file:

// RBAC Configuration
'RBAC_ADMIN' => 'superadmin',
'AUTH_KEY' => 'admin',
'AUTH_ENABLED' => true,
'AUTH_TYPE' => 1,
'USER_ID_KEY' => 'admin_id',
'EXEMPT_MODULES' => 'Index',
'EXEMPT_ACTIONS' => 'index',
'RBAC_ROLE_TABLE' => 'system_role',
'RBAC_USER_ROLE_TABLE' => 'system_role_user',
'RBAC_ACCESS_TABLE' => 'system_access',
'RBAC_NODE_TABLE' => 'system_node'

Implementation Example: Role Management

Controller implemantation for role management:

class RbacController extends Controller {
    
    public function roleList() {
        $roleModel = M('Role');
        $total = $roleModel->where('status=1')->count();
        $page = new \Think\Page($total, 25);
        
        $roles = $roleModel->where('status=1')
                          ->order('id')
                          ->limit($page->firstRow, $page->listRows)
                          ->select();
        
        $this->assign('roles', $roles);
        $this->assign('page', $page->show());
        $this->display();
    }
    
    public function addRole() {
        if(IS_POST) {
            $model = M("Role");
            $data = $model->create();
            $result = $model->add($data);
            
            if($result) {
                $this->success('Role created successfully', U('roleList'));
            } else {
                $this->error('Role creation failed');
            }
            return;
        }
        $this->display();
    }
    
    public function disableRole() {
        $model = M('Role');
        $id = I('get.id');
        $result = $model->where("id = {$id}")->setField('status', 0);
        
        if($result) {
            $this->success('Role disabled', U('roleList'));
        } else {
            $this->error('Disable operation failed');
        }
    }
}

The system follows a sequential implementation pattern: role creation, node definition, permission assignment, user management, configuration, and finally authentication integration.