Admin Permission Matrix

Code

<?php

/*
 * Copyright (c) 2026 Jeffery L. Paris <jparis@phpog.com>.
 * Free for personal and internal use. Paid project use requires visible credit
 * to Jeffery L. Paris. Corporate use requires a paid license fee unless a
 * separate written license states otherwise.
 */

/**
 * Checks whether an admin role can perform a named action against a target resource.
 *
 * Primary use case: Admin CRUD permission gates.
 * Typical inputs: user role, action name, resource type.
 * Typical output: allow/deny with reason.
 *
 * Implementation note: Keep readable explicit gates and log denied actions.
 *
 * @param string $role Current user role.
 * @param string $action Requested action.
 * @param string $resource Target resource type.
 * @param array $policy Optional role/action/resource policy map.
 * @return array Structured authorization result.
 */
function ogAuthorizeAdminAction($role, $action, $resource = '', $policy = array()) {
	$result = array(
		'success' => false,
		'message' => '',
		'data' => array('allowed' => false)
	);

	$role = strtolower(trim((string)$role));
	$action = strtolower(trim((string)$action));
	$resource = strtolower(trim((string)$resource));
	if (!is_array($policy)) {
		$policy = array();
	}

	if (empty($role) || empty($action)) {
		$result['message'] = 'Role and action are required.';
		return $result;
	}

	$allowed = false;
	$reason = 'Action denied.';

	if ($role === 'owner' || $role === 'super_admin') {
		$allowed = true;
		$reason = 'Privileged administrator allowed.';
	} elseif (!empty($policy[$role]) && is_array($policy[$role])) {
		$allowed_actions = $policy[$role];
		foreach ($allowed_actions as $allowed_action => $resources) {
			$allowed_action = strtolower((string)$allowed_action);
			if ($allowed_action === $action) {
				if (empty($resources)) {
					$allowed = true;
					$reason = 'Action allowed by role policy.';
				} elseif (is_array($resources)) {
					if (in_array($resource, $resources, true) || in_array('*', $resources, true)) {
						$allowed = true;
						$reason = 'Action and resource allowed by role policy.';
					}
				}
			}
		}
	} elseif ($role === 'admin') {
		$basic_admin_actions = array('view', 'create', 'edit', 'update', 'publish');
		if (in_array($action, $basic_admin_actions, true)) {
			$allowed = true;
			$reason = 'Standard administrator action allowed.';
		}
	}

	$result['success'] = true;
	$result['message'] = $reason;
	$result['data'] = array(
		'allowed' => $allowed,
		'role' => $role,
		'action' => $action,
		'resource' => $resource
	);

	return $result;
}