DravenCMS User

Authentication, authorization, user administration, groups, and ACL persistence for DravenCMS applications.

Features

• Nette Security authenticator and authorizator.
• User identities separated by storage namespace.
• Users, companies, groups, ACL resources, and ACL operations.
• Group-based permission assignment.
• Password hashing and reset records.
• Administration forms and grids.
• Presenter traits and the IsAllowed PHP attribute.
• Latte isAllowed() function and user-name formatting.

Installation

composer require dravencms/user

The package loader registers security services, admin presenters, components, translations, fixtures, and Doctrine mappings. Apply the package schema before enabling authentication.

The package depends on a CAPTCHA implementation for public authentication forms and on templated email for password resets. Configure both before exposing sign-up or reset endpoints.

Securing Presenter Actions

Use the IsAllowed attribute on presenter actions and signal handlers processed by DravenCMS secured presenters:

use Dravencms\User\Attributes\IsAllowed;

#[IsAllowed('article', 'edit')]
public function actionEdit(?int $id = null): void
{
}

The request receives HTTP 403 when the authenticated user does not have the required resource/operation pair.

In Latte templates, conditionally render controls with the registered function:

<a n:if="isAllowed('article', 'edit')" n:href="Article:edit">Edit</a>

Use Nette\Security\User::isAllowed() directly inside components and services that already receive the current security user.

Presenter Traits

• TUserPresenter exposes the current DravenCMS user entity, login state, and security namespace.
• TSecuredPresenter enforces login, initializes default user data, updates activity, and evaluates IsAllowed attributes.

Applications normally inherit these through DravenCMS frontend/admin base presenters rather than composing them repeatedly.

Fixtures and Default Credentials

The bundled fixtures create the Administrator group and a development account using admin@example.com / adminExample in both Front and Admin namespaces.

These credentials are public and must never remain usable in a deployed application. Replace or disable the fixture account immediately, or provide project-specific user fixtures before production deployment.

License

This package is licensed under the LGPL-3.0 license.