Admin Permission Matrix Check

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * Admin Permission Matrix Check.
 *
 * Purpose:
 * Checks whether an admin role is allowed to perform a controller action.
 *
 * @param string $role Current admin role.
 * @param string $controller Controller or module name.
 * @param string $action Requested action.
 * @param array $permission_matrix Role-based permission matrix.
 * @return array Permission result.
 */
function ogSnippetAdminPermissionMatrixCheck(string $role, string $controller, string $action, array $permission_matrix): array {
	$role = trim($role);
	$controller = trim($controller);
	$action = trim($action);

	if ($role === '' || $controller === '' || $action === '') {
		return array(
			'allowed' => false,
			'reason' => 'Role, controller, and action are required.'
		);
	}

	if (isset($permission_matrix[$role]) === false || is_array($permission_matrix[$role]) === false) {
		return array(
			'allowed' => false,
			'reason' => 'Role is not defined in the permission matrix.'
		);
	}

	if (isset($permission_matrix[$role][$controller]) === false || is_array($permission_matrix[$role][$controller]) === false) {
		return array(
			'allowed' => false,
			'reason' => 'Controller is not allowed for this role.'
		);
	}

	$allowed_actions = $permission_matrix[$role][$controller];

	if (in_array($action, $allowed_actions, true) === true) {
		return array(
			'allowed' => true,
			'reason' => 'Action is allowed.'
		);
	}

	return array(
		'allowed' => false,
		'reason' => 'Action is not allowed for this role.'
	);
}

$permission_matrix = array(
	'captain' => array(
		'items' => array('view', 'edit', 'publish'),
		'users' => array('view')
	),
	'crew' => array(
		'items' => array('view')
	)
);
$permission_result = ogSnippetAdminPermissionMatrixCheck('captain', 'items', 'publish', $permission_matrix);

if ($permission_result['allowed'] === true) {
	echo 'Firefly captain permission approved.';
} else {
	echo 'Firefly captain permission denied.';
}