Overview

TinyAuthBackend gives you a database-backed admin UI for permissions and roles in CakePHP. It is a companion to the TinyAuth plugin and replaces the native INI file approach with editable database tables.

The current branch targets CakePHP 5. Composer declares the supported PHP and framework ranges.

What you get

• A self-contained admin UI mounted at /admin/auth.
• Drop-in adapters (DbAllowAdapter, DbAclAdapter) that let TinyAuth read allow and acl rules from the database instead of INI files.
• Optional resources, abilities, scopes, and role hierarchy for entity-level authorization.
• TinyAuthPolicy and TinyAuthResolver for integration with the cakephp/authorization plugin.

Four usage strategies

The package supports four practical usage strategies, arranged as a ladder you can climb as your project's needs grow:

1. Adapter-only TinyAuth, keep classic TinyAuth allow + acl behavior, but store those rules in the database instead of INI files.
2. Full TinyAuthBackend, use the admin UI plus resources, scopes, role hierarchy, and TinyAuthPolicy / TinyAuthService for entity authorization.
3. Backend UI + native CakePHP auth, keep CakePHP Authentication / Authorization as your runtime layer and use this package mainly as a DB-backed permission management UI.
4. External role source, drive role aliases from a JWT claim, an LDAP group, an SSO gateway, or any other source outside the plugin, while keeping ACL / resource assignments in the backend.

See the Strategies overview for a comparison and pick the one that fits your app.

The admin URL

The plugin mounts under:

/admin/auth

Common sections:

URL	Purpose
/admin/auth/allow	Public action management
/admin/auth/acl	Controller/action ACL matrix
/admin/auth/roles	Roles and hierarchy
/admin/auth/resources	Resource abilities
/admin/auth/scopes	Field-based scopes
/admin/auth/sync/controllers	Scan controllers/actions into the database
/admin/auth/sync/resources	Scan entities/resources into the database

Access is fail-closed

The admin UI can change authorization rules. The plugin rejects every admin request with 403 until you configure an explicit gate. See Admin Access.

Next steps

• Installation: install the plugin and run the migrations.
• Getting started: open the local UI and create a role.
• Admin Access, configure who may manage /admin/auth.
• Strategies, choose how deeply you integrate the backend.
• Permissions, roles, public actions, ACL, resources, and scopes.