Native CakePHP Auth Strategy

Use this mode if you want CakePHP Authentication / Authorization to stay in charge at runtime and you do not want TinyAuth to handle request authorization.

Important constraint

This package still depends on dereuromark/cakephp-tinyauth at install time. That does not mean you must use TinyAuth as your runtime auth layer.

You can instead use TinyAuthBackend mainly for:

• role management
• resource/ability editing
• scope management
• a permission administration UI

and consume that data from your own CakePHP Authorization policies/services.

Practical split

• Authentication: cakephp/authentication
• Authorization: cakephp/authorization
• Permission storage / admin UI: TinyAuthBackend

Recommended usage

The simplest path is to let TinyAuthPolicy handle every entity you want the backend to govern, via the plugin-provided TinyAuthResolver:

// Application::getAuthorizationService()
use Authorization\AuthorizationService;
use TinyAuthBackend\Policy\TinyAuthResolver;

$resolver = new TinyAuthResolver([
    \App\Model\Entity\Article::class,
    \App\Model\Entity\Project::class,
]);

return new AuthorizationService($resolver);

See Authorization Integration for the full wiring guide.

If you need custom logic on top of the base policy, extend TinyAuthPolicy and override the specific hook — the parent signature matches CakePHP Authorization's calling convention:

use Authorization\IdentityInterface;
use Cake\Datasource\EntityInterface;
use TinyAuthBackend\Policy\TinyAuthPolicy;

class ArticlePolicy extends TinyAuthPolicy
{
    public function canEdit(?IdentityInterface $identity, EntityInterface $entity): bool
    {
        // Custom gate goes here; fall through to the TinyAuth rules.
        return parent::canEdit($identity, $entity);
    }
}

Or call the service directly from your own policy:

use TinyAuthBackend\Service\TinyAuthService;

$service = new TinyAuthService();
$allowed = $service->canAccessResource($user, $article, 'edit');

What to avoid in this mode

If you are not using TinyAuth at runtime, do not wire up:

• DbAllowAdapter
• DbAclAdapter

Those adapters are specifically for TinyAuth's controller/action flow.

Suggested feature set

'TinyAuthBackend' => [
    'features' => [
        'allow' => false,
        'acl' => false,
        'roles' => true,
        'resources' => true,
        'scopes' => true,
    ],
],