KMP PHP API Reference

Determines authorization for viewing activity-specific authorization lists and statistics, implementing dual access control with member self-service capabilities and administrative oversight.

Authorization Logic:

1. Self-Service Access: Members can view their own authorizations within activity context
2. Administrative Access: Users with appropriate permissions can view all activity authorizations
3. Permission Validation: Delegates to permission-based policy evaluation for administrative access

Activity-Focused Viewing:

• Provides activity-centric view of authorization data for administrative management
• Supports activity-specific reporting and oversight workflows
• Enables activity administrators to monitor participation and approval status

Permission-Based Access: For administrative operations, typically requires permissions such as:

• "Activities.viewActivityAuthorizations": Authority to view activity-specific authorization lists
• "Activities.manage": General authorization management and oversight capabilities
• Activity-specific permissions: Based on the activity's permission requirements
• Branch-scoped permissions: Organizational boundaries for activity authorization visibility

Usage Examples:

// Activity administrator viewing authorization status
if ($this->Authorization->can($user, 'activityAuthorizations', $authorization)) {
    $activityAuthorizations = $this->getActivityAuthorizationsQuery($activityId);
}

// Activity-specific reporting and analytics
$this->Authorization->authorize($authorization, 'activityAuthorizations');

Integration Points:

• Activity management interfaces for authorization oversight
• Administrative reporting dashboards with activity-focused data
• Approval workflow management for activity-specific processes
• Activity statistics and participation tracking

Security Considerations:

• Activity authorization data may reveal organizational structure and member qualifications
• Administrative access requires proper permission validation and audit trail
• Integration with activity-specific permission requirements for granular access control

Determines authorization for creating new authorization requests, implementing dual access control with member self-service capabilities and administrative override authority.

Authorization Logic:

1. Self-Service Access: Members can request authorizations for themselves
2. Administrative Access: Users with appropriate permissions can request on behalf of others
3. Permission Validation: Delegates to permission-based policy evaluation for administrative operations

Ownership-Based Access:

• Direct access when entity->member_id matches requesting user's ID
• Enables self-service authorization request workflows
• Supports member autonomy in authorization management

Permission-Based Access: For administrative operations, typically requires permissions such as:

• "Activities.request": Authority to request authorizations for other members
• "Activities.manage": General authorization management capabilities
• Branch-scoped permissions: Organizational boundaries for authorization requests

Usage Examples:

// Member requesting own authorization
$authorization = $this->Authorizations->newEntity(['member_id' => $currentUser->id]);
$this->Authorization->authorize($authorization, 'add'); // Returns true for own request

// Administrative authorization request
$authorization = $this->Authorizations->newEntity(['member_id' => $targetMember->id]);
$this->Authorization->authorize($authorization, 'add'); // Requires permission validation

Security Considerations:

• Self-service access maintains member autonomy while ensuring proper identity verification
• Administrative access requires appropriate permission validation through RBAC system
• Integration with warrant system for temporal validation of administrative authority

Determines authorization for viewing member authorization lists and details, implementing dual access control with member self-service visibility and administrative oversight capabilities.

Authorization Logic:

1. Self-Service Access: Members can view their own authorization records and history
2. Administrative Access: Users with appropriate permissions can view authorizations for other members
3. Permission Validation: Delegates to permission-based policy evaluation for administrative viewing

Ownership-Based Access:

• Direct access when entity->member_id matches requesting user's ID
• Enables member privacy and control over their authorization information
• Supports self-service authorization status checking and renewal planning

Permission-Based Access: For administrative operations, typically requires permissions such as:

• "Activities.viewMemberAuthorizations": Authority to view member authorization records
• "Activities.manage": General authorization management and oversight capabilities
• "Reports.activities": Reporting and analysis access for authorization data
• Branch-scoped permissions: Organizational boundaries for member authorization visibility

Privacy and Security:

• Member authorization data includes sensitive information about qualifications and status
• Administrative access requires proper permission validation and audit trail
• Integration with branch scoping for organizational privacy boundaries

Usage Examples:

// Member viewing own authorizations
$this->Authorization->authorize($authorization, 'memberAuthorizations'); // Returns true for own records

// Administrative authorization review
if ($this->Authorization->can($user, 'memberAuthorizations', $authorization)) {
    $authorizationsList = $this->getMemberAuthorizationsQuery($memberId);
}

Integration Points:

• Member profile interfaces for self-service authorization management
• Administrative reporting and oversight dashboards
• Authorization workflow interfaces for approval and renewal processes

Determines authorization for renewing existing authorizations, implementing dual access control with member self-service renewal capabilities and administrative renewal authority.

Authorization Logic:

1. Self-Service Renewal: Members can renew their own authorizations
2. Administrative Renewal: Users with appropriate permissions can renew authorizations for others
3. Permission Validation: Delegates to permission-based policy evaluation for administrative operations

Ownership-Based Access:

• Direct access when entity->member_id matches requesting user's ID
• Enables self-service authorization renewal workflows
• Supports member autonomy in maintaining current authorizations

Permission-Based Access: For administrative operations, typically requires permissions such as:

• "Activities.renew": Authority to renew authorizations for other members
• "Activities.manage": General authorization management capabilities
• Activity-specific permissions: Based on the authorization's activity requirements

Renewal Context:

• Renewal requests typically maintain existing approval chains and requirements
• May have different approval requirements than initial authorization requests
• Supports continuous authorization maintenance for ongoing activities

Usage Examples:

// Member renewing own authorization
$this->Authorization->authorize($authorization, 'renew'); // Returns true for own authorization

// Administrative renewal for expired authorizations
if ($this->Authorization->can($user, 'renew', $authorization)) {
    $authorizationManager->renew($authorization->id, $user->id);
}

Security Considerations:

• Self-service renewal maintains member control over their authorization lifecycle
• Administrative renewal requires appropriate permission validation and audit trail
• Integration with temporal validation for authorization expiration and renewal timing

Determines authorization for retracting pending authorization requests, implementing ownership-based access control to allow members to cancel their own pending requests.

Authorization Logic:

1. Self-Service Retraction: Members can retract their own pending authorization requests
2. Status Validation: Retraction only allowed for pending authorizations
3. Ownership Requirement: Only the requesting member can retract

Ownership-Based Access:

• Direct access when entity->member_id matches requesting user's ID
• Enables member autonomy in managing authorization workflow
• No administrative override - retraction is member-only action

Use Cases:

• Request sent to wrong approver
• Request no longer needed
• Stalled request with no response
• Incorrect activity requested

Usage Examples:

// Member retracting own pending authorization
$this->Authorization->authorize($authorization, 'retract'); // Returns true for own request

// Controller validation
if ($this->Authorization->can($user, 'retract', $authorization)) {
    $authorizationManager->retract($authorization->id, $user->id);
}

Security Considerations:

• Retraction is strictly owner-only operation
• Maintains member privacy and control over authorization requests
• Does not require administrative permission validation
• Only applicable to pending requests, not approved authorizations

Determines authorization for revoking member activity authorizations, providing access control for administrative revocation operations and authorization lifecycle management.

Authorization Logic:

• Delegates to permission-based policy evaluation through BasePolicy
• Requires appropriate administrative permissions for revocation authority
• Integrates with Activities plugin permission policy framework
• Supports warrant-based temporal validation for administrative roles

Permission Requirements: Typically requires permissions such as:

• "Activities.revoke": Direct authorization revocation authority
• "Activities.manage": General authorization management capabilities
• Activity-specific permissions: Based on the authorization's activity requirements

Usage Examples:

// Controller authorization for revocation interface
$this->Authorization->authorize($authorization, 'revoke');

// Service-level authorization check
if ($this->Authorization->can($user, 'revoke', $authorization)) {
    $authorizationManager->revoke($authorization->id, $user->id, $reason);
}

Security Considerations:

• Revocation is typically restricted to administrative users with appropriate authority
• Integration with audit trail system for accountability and compliance
• Warrant validation ensures temporal authority for revocation operations