ACL Permissions

ACL Configuration

<!-- app/code/Vendor/Module/etc/acl.xml -->
<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
    <acl>
        <resources>
            <resource id="Magento_Backend::admin">
                <!-- Backend module resources -->
                <resource id="Magento_Backend::stores">
                    <resource id="Magento_Backend::stores_settings">
                        <resource id="Magento_Config::config"/>
                    </resource>
                </resource>

                <!-- Sales module resources -->
                <resource id="Magento_Sales::sales">
                    <resource id="Magento_Sales::orders"/>
                    <resource id="Magento_Sales::invoices"/>
                    <resource id="Magento_Sales::shipments"/>
                    <resource id="Magento_Sales::creditmemos"/>
                </resource>

                <!-- Custom module resources -->
                <resource id="Vendor_Module::module">
                    <resource id="Vendor_Module::items">
                        <resource id="Vendor_Module::items_view"/>
                        <resource id="Vendor_Module::items_edit"/>
                        <resource id="Vendor_Module::items_delete"/>
                    </resource>
                    <resource id="Vendor_Module::settings"/>
                </resource>
            </resource>
        </resources>
    </acl>
</config>

Resource Hierarchy

Magento_Backend::admin
├── Magento_Backend::stores
│   └── Magento_Backend::stores_settings
│       └── Magento_Config::config
├── Magento_Sales::sales
│   ├── Magento_Sales::orders
│   ├── Magento_Sales::invoices
│   └── Magento_Sales::shipments
└── Vendor_Module::module
    ├── Vendor_Module::items
    │   ├── Vendor_Module::items_view
    │   ├── Vendor_Module::items_edit
    │   └── Vendor_Module::items_delete
    └── Vendor_Module::settings

Admin Role Model

namespace Magento\Authorization\Model\Role;

class Role extends \Magento\Framework\Model\AbstractModel
{
    public function getName(): string
    {
        return $this->getData('role_name');
    }

    public function getRoleType(): string
    {
        return $this->getData('role_type');
    }

    public function getPermissions(): array
    {
        return $this->getData('permissions');
    }
}

Creating Roles

namespace Vendor\Module\Service;

class RoleManager
{
    public function __construct(
        private \Magento\Authorization\Model\RoleFactory $roleFactory,
        private \Magento\Authorization\Model\RulesFactory $rulesFactory
    ) {}

    public function createRole(string $name, array $permissions): void
    {
        $role = $this->roleFactory->create();
        $role->setName($name);
        $role->setRoleType('A'); // A = Admin
        $role->save();

        // Set permissions
        $rules = $this->rulesFactory->create();
        $rules->setRoleId($role->getId());
        $rules->setPermission('allow');
        $rules->setResources($permissions);
        $rules->save();
    }
}

Check Permissions in Controller

namespace Vendor\Module\Controller\Adminhtml\Item;

class Edit extends \Magento\Backend\App\Action
{
    protected function _isAllowed(): bool
    {
        return $this->_authorization->isAllowed('Vendor_Module::items_edit');
    }
}

Check Permissions in Block

namespace Vendor\Module\Block\Adminhtml\Item;

class Edit extends \Magento\Backend\Block\Widget\Form\Container
{
    protected function _construct()
    {
        parent::_construct();

        $this->_objectId = 'id';
        $this->_blockGroup = 'Vendor_Module';
        $this->_controller = 'adminhtml_item';
        $this->_mode = 'edit';

        $this->_addButton('save_and_continue', [
            'class' => 'save',
            'label' => __('Save and Continue Edit'),
            'onclick' => 'setLocation(\'' . $this->_getSaveAndContinueUrl() . '\')',
        ]);
    }

    private function _getSaveAndContinueUrl(): string
    {
        return $this->getUrl('*/*/save', [
            'id' => $this->getRequest()->getParam('id'),
            '_current' => true,
        ]);
    }
}

Permission Check in Service

namespace Vendor\Module\Service;

class PermissionAwareService
{
    public function __construct(
        private \Magento\Framework\Authorization\AuthorizationInterface $authorization
    ) {}

    public function performAction(string $resource): void
    {
        if (!$this->authorization->isAllowed($resource)) {
            throw new \Magento\Framework\Exception\AuthorizationException(
                __('You do not have permission to perform this action.')
            );
        }

        // Perform action
    }
}

Grid ACL Resource

<!-- Grid data source with ACL -->
<dataSource name="custom_data_source">
    <dataProvider class="Magento\Ui\Model\DataProvider" name="custom_data_source">
        <aclResource>Vendor_Module::items_view</aclResource>
    </dataProvider>
</dataSource>

Column Visibility Based on ACL

// Conditionally show columns based on permissions
namespace Vendor\Module\Ui\Component\Column;

class SecureColumn extends \Magento\Ui\Component\Listing\Columns\Column
{
    public function __construct(
        \Magento\Framework\View\Element\UiComponent\ContextInterface $context,
        array $components = [],
        array $data = [],
        private \Magento\Framework\Authorization\AuthorizationInterface $authorization = null
    ) {
        parent::__construct($context, $components, $data);
    }

    public function isShown(): bool
    {
        return $this->authorization->isAllowed('Vendor_Module::items_view');
    }
}

Mass Action ACL

<!-- Mass action with ACL -->
<massaction name="listing_massaction">
    <action name="delete">
        <aclResource>Vendor_Module::items_delete</aclResource>
        <settings>
            <url path="vendor_module/item/massDelete"/>
        </settings>
    </action>
</massaction>