Class yii\filters\AccessRule

List of action IDs that this rule applies to. The comparison is case-sensitive. If not set or empty, it means this rule applies to all actions.

Whether this is an 'allow' rule or 'deny' rule.

List of the controller IDs that this rule applies to.

The comparison uses yii\base\Controller::$uniqueId, so each controller ID is prefixed with the module ID (if any). For a product controller in the application, you would specify this property like ['product'] and if that controller is located in a shop module, this would be ['shop/product'].

The comparison is case-sensitive.

If not set or empty, it means this rule applies to all controllers.

Since version 2.0.12 controller IDs can be specified as wildcards, e.g. module/*.

A callback that will be called if this rule determines the access to the current action should be denied. If not set, the behavior will be determined by yii\filters\AccessControl.

The signature of the callback should be as follows:

function ($rule, $action)

where $rule is this rule, and $action is the current action object.

List of user IP addresses that this rule applies to. An IP address can contain the wildcard * at the end so that it matches IP addresses with the same prefix. For example, '192.168.*' matches all IP addresses in the segment '192.168.'. If not set or empty, it means this rule applies to all IP addresses.

See also yii\web\Request::$userIP.

A callback that will be called to determine if the rule should be applied. The signature of the callback should be as follows:

function ($rule, $action)

where $rule is this rule, and $action is the current action object. The callback should return a boolean value indicating whether this rule should be applied.

Parameters to pass to the yii\web\User::can() function for evaluating user permissions in $roles.

If this is an array, it will be passed directly to yii\web\User::can(). For example for passing an ID from the current request, you may use the following:

['postId' => Yii::$app->request->get('id')]

You may also specify a closure that returns an array. This can be used to evaluate the array values only if they are needed, for example when a model needs to be loaded like in the following code:

'rules' => [
    [
        'allow' => true,
        'actions' => ['update'],
        'roles' => ['updatePost'],
        'roleParams' => function($rule) {
            return ['post' => Post::findOne(Yii::$app->request->get('id'))];
        },
    ],
],

A reference to the yii\filters\AccessRule instance will be passed to the closure as the first parameter.

See also $roles.

List of roles that this rule applies to (requires properly configured User component). Two special roles are recognized, and they are checked via yii\web\User::$isGuest:

• ?: matches a guest user (not authenticated yet)
• @: matches an authenticated user

If you are using RBAC (Role-Based Access Control), you may also specify role or permission names. In this case, yii\web\User::can() will be called to check access.

If this property is not set or empty, it means this rule applies to all roles.

See also $roleParams.

List of request methods (e.g. GET, POST) that this rule applies to. If not set or empty, it means this rule applies to all request methods.

See also yii\web\Request::$method.