Phalcon REST - Restrict Access On Resources

phalcon-rest-restrict-access-on-resources.php

<?php

$api->resource(Resource::crud('/users', 'User')

    // Here we restrict access to all endpoints
    // on this Resource. The `User` role is not allowed
    // to access all endpoints by default.
    ->deny(AclRoles::UNAUTHORIZED, AclRoles::USER)
    
    // Because access can be overridden,
    // we specifically allow access for
    // the `User` role on this endpoint.
    ->endpoint(Endpoint::get('/me', 'me')
        ->allow(AclRoles::USER)
        // .. more endpoint setup
    )
    
    // When a user has already been authenticated, it doesn't
    // make sense to let them gain access on this endpoint.
    ->endpoint(Endpoint::post('/authenticate', 'authenticate')
        ->allow(AclRoles::UNAUTHORIZED)
        ->deny(AclRoles::AUTHORIZED)
        // .. more endpoint setup
    )
    
    // .. more resource setup
);