3.0.0-RC

A complete rewrite with a modern, normalized database schema and reactive UI.

Breaking Changes

• Database schema completely redesigned - Legacy tables acl_rules and allow_rules are dropped automatically by the migration
• No automatic data migration - Existing permissions must be re-configured via the new UI or re-imported from INI files
• Minimum PHP 8.2 required
• CakePHP 5.1 required

New Features

Normalized Database Schema

8 properly normalized tables replacing the previous 2-table structure:

Table	Purpose
tinyauth_roles	User roles with hierarchy support
tinyauth_controllers	Discovered controllers (plugin/prefix/name)
tinyauth_actions	Controller actions with public flag
tinyauth_acl_permissions	Role-to-action permission mappings
tinyauth_resources	Entity resources for resource-based auth
tinyauth_resource_abilities	Resource abilities (view, edit, delete, etc.)
tinyauth_scopes	Reusable permission conditions (e.g., "own records only")
tinyauth_resource_acl	Resource-to-role permission mappings with scope support

Modern Admin UI

• Tree+Matrix UI: Controller tree navigation with permission matrix view
• HTMX+Alpine.js: Reactive updates without page reloads
• Standalone Layout: Self-contained with Tailwind CSS, dark/light theme support
• Drag-and-drop: Role ordering with parent/child hierarchy

Role Hierarchy

• Define parent/child relationships between roles
• Higher roles inherit lower-role permissions
• Visual hierarchy management with drag-and-drop ordering

Resource-Based Permissions

• Entity-level authorization (not just controller actions)
• Define abilities per resource (view, edit, delete, publish, etc.)
• Scope support for conditional access (e.g., "own records", "same team")

Controller & Resource Sync

• Auto-discovery of controllers and actions from your application
• Auto-discovery of entity resources
• One-click sync to keep permissions in sync with code changes

Authorization Integration

• TinyAuthPolicy for seamless cakephp/authorization integration
• TinyAuthService for programmatic permission checks
• Scope-aware queries for filtered results

Services

• TinyAuthService - Central permission checking
• HierarchyService - Role hierarchy traversal
• ControllerSyncService - Controller/action discovery
• ResourceSyncService - Resource/ability discovery
• ImportExportService - JSON/CSV export and legacy INI import
• FeatureService - Enable/disable features
• RoleSourceService - Flexible role data sources

Screenshots

Migration Guide

1. Update composer

composer require dereuromark/cakephp-tinyauth-backend:^3.0

2. Run migrations

bin/cake migrations migrate -p TinyAuthBackend

This will:

• Drop legacy acl_rules and allow_rules tables
• Create the 8 new normalized tables

3. Initialize roles

bin/cake tiny_auth_backend init admin

Or configure in config/roles.php.

4. Re-import permissions (optional)

If you have existing INI files:

bin/cake tiny_auth_backend import allow
bin/cake tiny_auth_backend import acl

5. Sync controllers

Navigate to /admin/auth/sync/controllers and click "Sync All" to discover your application's controllers.

6. Configure permissions

Use the new admin UI at /admin/auth/ to set up your permission matrix.

Demo Application

See the full demo at: https://github.com/dereuromark/cakephp-tinyauth-demo

2.1.1

Fixes

• Fix PHP 8.4 property compatibility in ImportCommand and InitCommand (#11)

Full Changelog: 2.1.0...2.1.1

2.1.0

Improvements

• Removed deprecations

Full Changelog: 2.0.1...2.1.0

2.0.1

Fixes

• Fixed up files bundled in release using gitattributes file.

Full Changelog: 2.0.0...2.0.1

2.0.0

CakePHP 5 compatible release

Enjoy!

1.1.0

Improvements

Removed deprecations

1.0.0

Stable release

CakePHP 4.2+ and PHP 7.3+

1.0.0-beta

CakePHP 4 compatible beta release

First release for CakePHP 4 and TinyAuth 3.

0.1.1

Fixes

Adjustments for PHPStan level 8

0.1.0

Initial Release

This is the first extension for TinyAuth plugin 2.x release.
It brings a DB backend for both allow and ACL functionality.

For this just configure the adapters to DB instead of INI files.

It is a very basic backend and more a showcase and demo for the adapter functionality.
You are free to provide improvements and better GUI/usability as PRs ar alternative repositories/plugins.