Permissions and Roles

Latch provides fine-grained access control through permissions and roles.

A permission has a unique string name and a default integer value. For example, the built-in Edit App permission can default to 0.

A role has a unique string name and can specify a custom value for each permission. For example, the built-in Administrator role grants administrative access.

Roles can also have custom tags. Tags are useful as boolean capabilities: a role either has the tag or it does not. Numeric permissions are better when you need thresholds or levels.

Latch includes the following role tag out of the box:

• can_register: A role with this tag can be selected during registration.

Evaluation

Use these helpers to evaluate access.

Latch\Session\is_role("Administrator")

Returns whether the current session is logged in as an Administrator.

Latch\Session\has_permission("Edit App")

Returns whether the current session has Edit App greater than or equal to 1.

Administrators return true for permission checks.

You can provide a second argument, $threshold, to change the minimum value:

Latch\Session\has_permission("My Permission", 100)

This returns true when the current session has My Permission greater than or equal to 100.

Latch\Session\has_permission_from_tags($tags)

Accepts an array of Tagify-style tag objects, such as the return value from get_tags(). Each tag value is treated as either a role name or a permission name.

If the tag list is empty, access is granted. This is how public read/write forms are represented.

$_SESSION["latch"]->db->has_tag("role", $role_id_or_name, "can_register")

Returns whether the given role has a tag called can_register.

Form Permissions

Form read and write permissions are stored as tag lists in form metadata.

Read permissions determine who can view existing submissions. Write permissions determine who can submit the form.

When no read or write permissions are set, Latch treats that permission list as unrestricted.