Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/guide/admin/jwtspa.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

> available since LUYA admin module version 2.2

The LUYA admin provides a basic JWT generator including an out of the box authentication system which can proxy requests trough LUYA admin API User and those permission system.
The LUYA admin provides a basic JWT generator including an out-of-the-box authentication system which can proxy requests through LUYA admin API User and those permission system.

## Prerequisite

Expand All @@ -12,7 +12,7 @@ The LUYA admin provides a basic JWT generator including an out of the box authen

## How it works

As all LUYA admin APIs requerd an authentication are proxied trough LUYA API Users. The life cycle of the JWT request is described as followed (assuming JWT configuration in the module is done accordingly):
As all LUYA admin APIs requerd an authentication are proxied through LUYA API Users. The life cycle of the JWT request is described as followed (assuming JWT configuration in the module is done accordingly):

Get the token:

Expand Down Expand Up @@ -71,7 +71,7 @@ class User extends \luya\admin\ngrest\base\NgRestModel implements luya\admin\bas
return 'api-user';
}

// ....... other ngrest models specific content ........... //
// ....... other NgRest models specific content ........... //

/* JwtIdentityInterface */

Expand All @@ -88,7 +88,7 @@ class User extends \luya\admin\ngrest\base\NgRestModel implements luya\admin\bas
}
```

An NgRest API with additional login, signup and me actions.
A NgRest API with additional login, signup and me actions.

```php
/**
Expand Down Expand Up @@ -167,7 +167,7 @@ If a successfull JWT authentication is made the <class name="luya\admin\componen

## CORS Preflight Request

When working with cross domain requests, each XHR request to the API will make an *option request* or also known as *preflight request*. The <class name="luya\admin\ngrest\base\Api" /> controllers provide an out of the box solution which works for common CRUD operations (add, view, list, edit, delete). This can be enabled by setting <class name="luya\admin\Module" prop="cors" /> to true. For further CORS config options use <class name="luya\traits\ApplicationTrait" prop="corsConfig" />.
When working with cross domain requests, each XHR request to the API will make an *option request* or also known as *preflight request*. The <class name="luya\admin\ngrest\base\Api" /> controllers provide an out-of-the-box solution which works for common CRUD operations (add, view, list, edit, delete). This can be enabled by setting <class name="luya\admin\Module" prop="cors" /> to true. For further CORS config options use <class name="luya\traits\ApplicationTrait" prop="corsConfig" />.

When working with custom actions you might need to configure the option request for the given method. Therefore you need to configure the API with the following setup: create an URL rule for options request, define the option and make sure the option is available without authentication (its common that option request won't have authentication headers).

Expand Down Expand Up @@ -219,7 +219,7 @@ A few principals regarding permissions:
+ Unless an action is masked as <class name="luya\traits\RestBehaviorsTrait" prop="authOptional" /> **every action requires authentication**.
+ If the group of the defined <class name="luya\admin\components\Jwt" prop="apiUserEmail" /> API user has **no permissions**, only your custom actions are accessible.
+ When accessing NgRest API actions like update, create, list or view (detail) and permission is granted the actions are logged with the configured API User.
+ As permission is proxied trough API Users, a valid API User token could access those informations as well.
+ As permission is proxied through API Users, a valid API User token could access those informations as well.

## User Based CheckAccess

Expand Down
16 changes: 8 additions & 8 deletions docs/guide/admin/permission.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
# Permissions & Menu

LUYA provides an out of the box permission system. Menu entries are bound to the permission system but you can also define custom permissions. In order to update permissions run the `./vendor/bin/luya import` command which will restore all permissions in the database that you can allocate them to a user group.
LUYA provides an out-of-the-box permission system. Menu entries are bound to the permission system but you can also define custom permissions. In order to update permissions run the `./vendor/bin/luya import` command which will restore all permissions in the database that you can allocate them to a user group.

Permissions are commonly part of the <class name="luya\admin\base\Module" method="getMenu" /> method but can also be defined in <class name="luya\admin\base\Module" method="extendPermissionApis" /> or <class name="luya\admin\base\Module" method="extendPermissionRoutes" />.

In order to make wording clear in this guide section:

+ Authentication: This means you have to provide an access token, bearer auth header or session based authentication mechanism in order to access the given resource.
+ Permission: This means an API or WEB-Route is stored in the LUYA ADMIN permission system and can be associated to given groups which can be then associated to users (both users and API users). For example, users can be edited, added and deleted.
+ Permission: This means an API or WEB route is stored in the LUYA ADMIN permission system and can be associated to given groups which can be then associated to users (both users and API users). For example, users can be edited, added and deleted.
+ User vs API User: API Users are not able to login in the admin UI, while Users do. There are also other limitations, like API Users can not access actions without permission entries, if disabled (which is by default)
+ REST/API vs WEB: A REST/API Controller will return JSON or XML formatted content and authentication must be done via token, while a web controller returns HTML (scalar values) and authentication is done trough session cookie.
+ REST/API vs WEB: A REST/API Controller will return JSON or XML formatted content and authentication must be done via token, while a web controller returns HTML (scalar values) and authentication is done through session cookie.
+ Permission Routes: Permission entry for <class name="luya\admin\base\RestController" /> and <class name="luya\admin\base\Controller" />.
+ Permission APIs: Permission entry for <class name="luya\admin\base\RestActiveController" />

Expand All @@ -25,7 +25,7 @@ Each admin module does have a <class name="luya\admin\base\Module" method="getMe
+ ➀ nodeRoute: Top level node which directly redirects to a custom module route.
+ ➁ group: The group name of items.
+ ➂ itemRoute: An item inside a group to a custom route.
+ ➂ itemApi: An item inside a group to an NgRest API.
+ ➂ itemApi: An item inside a group to a NgRest API.

```php
public function getMenu()
Expand All @@ -47,7 +47,7 @@ Please have a look at the <class name="luya\admin\components\AdminMenuBuilder" /

## Route and API permissions without menu

You can also setup permissions which are not regulated trough <class name="luya\admin\base\Module" method="getMenu" />, therefore configure the <class name="luya\admin\base\Module" /> class and override the following methods:
You can also setup permissions which are not regulated through <class name="luya\admin\base\Module" method="getMenu" />, therefore configure the <class name="luya\admin\base\Module" /> class and override the following methods:

```php
public function extendPermissionApis()
Expand Down Expand Up @@ -76,9 +76,9 @@ The above *module/controller/action* route is now protected by admin UI authoriz

There are different controllers which can be extended, but they have different permission systems. Some use `routes` and others take `apis` as permission level.

+ <class name="luya\admin\base\Controller" />: This is a WEB controller and permission is handled trough `routes`. Those controllers usually return HTML content and not REST responses (like JSON).
+ <class name="luya\admin\base\RestController" />: The RestController can take `routes` as permission, route validation can be done trough <class name="luya\admin\base\RestController" method="checkRouteAccess" />. The controller requies response of array data (JSON response).
+ <class name="luya\admin\base\RestActiveController" />: The modelClass based ActiveController which implements basic REST behaviors like create,update,view and delete based on a given model. The permission is authorized trough `apis` and the implementation of <class name="luya\admin\base\RestActiveController" method="checkAccess" />.
+ <class name="luya\admin\base\Controller" />: This is a WEB controller and permission is handled through `routes`. Those controllers usually return HTML content and not REST responses (like JSON).
+ <class name="luya\admin\base\RestController" />: The RestController can take `routes` as permission, route validation can be done through <class name="luya\admin\base\RestController" method="checkRouteAccess" />. The controller requies response of array data (JSON response).
+ <class name="luya\admin\base\RestActiveController" />: The modelClass-based ActiveController which implements basic REST behaviors like create, update, view and delete based on a given model. The permission is authorized through `apis` and the implementation of <class name="luya\admin\base\RestActiveController" method="checkAccess" />.

## Custom Actions in REST/API Controllers

Expand Down
4 changes: 2 additions & 2 deletions docs/guide/app/console.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,9 +100,9 @@ Now you could run the sync command like all other commands with `./vendor/bin/lu

### Views and UrlManger

Its very often case where you like to render a view and send a mail inside a console command, like batch processing some data (newsletter for example). Therefore your views use the <class name="luya\helpers\Url" /> class in order to generate urls.
It's very often case where you like to render a view and send a mail inside a console command, like batch processing some data (newsletter for example). Therefore your views use the <class name="luya\helpers\Url" /> class in order to generate urls.

As the console command does not know your web server URL and there is no parameter of your web server url, therefore LUYA has a special configuration property called <class name="luya\traits\ApplicationTrait" prop="consoleHostInfo" />.
As the console command does not know your web server URL and there is no parameter of your web server URL, therefore LUYA has a special configuration property called <class name="luya\traits\ApplicationTrait" prop="consoleHostInfo" />.

This value will be used when defined as base URL for the urlManager.

Expand Down
2 changes: 1 addition & 1 deletion docs/guide/app/filters.md
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ Where **139** could be the image `id` from your database source ActiveRecord. If
<?php endforeach; ?>
```

or you can use the filter name directly which is not recommend as if the filter name change you have to search and replace trough the whole project for the deprecated names.
or you can use the filter name directly which is not recommend as if the filter name change you have to search and replace through the whole project for the deprecated names.

```php
<?php foreach($newsData as $item): ?>
Expand Down
4 changes: 2 additions & 2 deletions docs/guide/app/language.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Languages

LUYA provides a powerful multi language support as we have focused on multi-lingual website very strong during the concept and development phase. In order to understand how to configure your site to fit your needs read the section below.
LUYA provides a powerful multi-language support as we have focused on multi-lingual website very strong during the concept and development phase. In order to understand how to configure your site to fit your needs read the section below.

Keep in mind that the `language` property of your application is the main setting for the Yii translation system.

Expand Down Expand Up @@ -41,7 +41,7 @@ There are two ways to retrieve the current active language:

> Instead of using the locales system, we recommend you to make usage of the PHP intl extension, which is commonly available. Therefore e.g. you use `Yii::$app->formatter->asDatetime($time, 'MMMM yyyy')` instead of `strftime("%B %Y", $date);`. Take a look at the formating syntax here https://unicode-org.github.io/icu/userguide/format_parse/datetime

As the composition component can override the <class name="yii\base\Application" prop="language" /> which is the base property for all translations within a Yii system you can define localisations for each language. Localisation are usually set trough setlocale() this is what LUYA does in the <class name="luya\traits\ApplicationTrait" />. You can define a localisation file for each language with the <class name="luya\traits\ApplicationTrait" prop="locales" /> property, for example when language `de` is given it should take the `de_CH.utf8` locale file:
As the composition component can override the <class name="yii\base\Application" prop="language" /> which is the base property for all translations within a Yii system you can define localisations for each language. Localisation are usually set through `setLocale()` this is what LUYA does in the <class name="luya\traits\ApplicationTrait" />. You can define a localisation file for each language with the <class name="luya\traits\ApplicationTrait" prop="locales" /> property, for example when language `de` is given it should take the `de_CH.utf8` locale file:

```php
'locales' => [
Expand Down
2 changes: 1 addition & 1 deletion docs/guide/app/mail.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ LUYA comes with a <class name="luya\components\Mail" /> component that uses PHPM

> Often there are different configuration needed which are depending on your hosting provider. Please have a closer look to <class name="luya\components\Mail" /> to understand how and what can be configured to match the requirements of your email hosting provider.

In order to test your configurations you can run the console command `health/mailer`. The command will try to connect to your mail server trough your provided credentials. By default the mailer component requires a SMTP Server and is not using PHPs mail function.
In order to test your configurations you can run the console command `health/mailer`. The command will try to connect to your mail server through your provided credentials. By default the mailer component requires a SMTP Server and is not using PHPs mail function.

```sh
./vendor/bin/luya health/mailer
Expand Down
2 changes: 1 addition & 1 deletion docs/guide/app/openapi.md
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,7 @@ The first example will map `POST api-admin-timestamp` to the index action, the s

## OpenAPI Client

In order to consume the OpenAPI trough OpenAPI Client you have to turn off <class name="luya\admin\Module" prop="jsonCruft" /> behavior in the <class name="luya\Config" /> for the Admin Module:
In order to consume the OpenAPI through OpenAPI Client you have to turn off <class name="luya\admin\Module" prop="jsonCruft" /> behavior in the <class name="luya\Config" /> for the Admin Module:

```php
'admin' => [
Expand Down
4 changes: 2 additions & 2 deletions docs/guide/app/queue.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ Since LUYA Admin version 2.0, the ([Yii Queue](https://github.com/yiisoft/yii2-q

The component is configured as `adminqueue` based on the Database `yii\queue\db\Queue` integration.

The admin module has a default integration for scheduling jobs when working with selects (dropdowns) and checkbox, so you are able to schedule those changes out of the box! See Checkbox (ToggleStatus) <class name="luya\admin\ngrest\plugins\ToggleStatus" prop="scheduling" /> and Select <class name="luya\admin\ngrest\plugins\Select" prop="scheduling" />.
The admin module has a default integration for scheduling jobs when working with selects (dropdowns) and checkbox, so you are able to schedule those changes out-of-the-box! See Checkbox (ToggleStatus) <class name="luya\admin\ngrest\plugins\ToggleStatus" prop="scheduling" /> and Select <class name="luya\admin\ngrest\plugins\Select" prop="scheduling" />.

## Configure to run

Expand All @@ -30,7 +30,7 @@ The fake cron job will run each 25 minutes whether users request the websites in
]
```

The fake cronjob won't be executed on console (cli) commands. The information about last run timestamp is stored in <class name="luya\admin\models\Config" /> with identifier `luya\admin\models\Config::CONFIG_QUEUE_TIMESTAMP`.
The fake cronjob won't be executed on console (CLI) commands. The information about last run timestamp is stored in <class name="luya\admin\models\Config" /> with identifier `luya\admin\models\Config::CONFIG_QUEUE_TIMESTAMP`.

### Cronjob (admin/queue Command)

Expand Down
4 changes: 2 additions & 2 deletions docs/guide/app/security.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ We recommend to enable <class name="luya\admin\Module" prop="secureLogin" /> whi
]
```

Since admin version 3.0 it's also possible to setup 2FA login with OTP trough any authenticator app.
Since admin version 3.0 it's also possible to setup 2FA login with OTP through any authenticator app.

![LUYA 2FA](../img/2fa.png)

Expand Down Expand Up @@ -71,7 +71,7 @@ With enabling of <class name="luya\admin\Module" prop="emailVerification" /> the

## JSON response cruft prepend

A JSON vulnerability allows third party website to turn your JSON resource URL into JSONP request under some conditions. To encounter this, the server can prefix all JSON requests with following cruft `")]}',\n"`. This is auto enabled for all JSON responses which are provided by the admin module trough the APIs.
A JSON vulnerability allows third party website to turn your JSON resource URL into JSONP request under some conditions. To encounter this, the server can prefix all JSON requests with following cruft `")]}',\n"`. This is auto enabled for all JSON responses which are provided by the admin module through the APIs.

```php
'admin' => [
Expand Down
4 changes: 2 additions & 2 deletions docs/guide/app/speed.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ You should always enable caching in production! Caching stores data inside the r

> When using LUYA deployer, the runtime folder will be recreated for each deployment. You can also force recaching by click the reload button in the admin UI.

There are also a few other caching mechanism available and built in into Yii. See the [supported cache storage](https://www.yiiframework.com/doc-2.0/guide-caching-data.html#supported-cache-storage)
There are also a few other caching mechanism available and built into Yii. See the [supported cache storage](https://www.yiiframework.com/doc-2.0/guide-caching-data.html#supported-cache-storage)

## Page Caching

Expand Down Expand Up @@ -45,7 +45,7 @@ When dealing with large database tables in your application you should define da

> since Admin 3.9

The admin provides an out of the box table which can be taken to store the session inside the database, thereore just configured:
The admin provides an out-of-the-box table which can be taken to store the session inside the database, thereore just configured:

```php
$config->component('session', [
Expand Down
2 changes: 1 addition & 1 deletion docs/guide/cms/blocks.md
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ public function callbackHelloWorld($time)
}
```

The above callback requires the parameter `$time` and must be called trough an AJAX call inside of the JavaScript, to create the URL for this specific callback we are going to use `createAjaxLink()`:
The above callback requires the parameter `$time` and must be called through an AJAX call inside of the JavaScript, to create the URL for this specific callback we are going to use `createAjaxLink()`:

```php
$this->createAjaxLink('HellWorld', ['time' => time()]);
Expand Down
4 changes: 2 additions & 2 deletions docs/guide/cms/blocktypes.md
Original file line number Diff line number Diff line change
Expand Up @@ -216,7 +216,7 @@ The following Injectors are currently available:

### Injector API

Each injector object generate trough the <class name="luya\cms\base\InternalBaseBlock" method="injectors" /> method can be access trough the magical array access. Let's assume you are registering the TagInjector:
Each injector object generate through the <class name="luya\cms\base\InternalBaseBlock" method="injectors" /> method can be access through the magical array access. Let's assume you are registering the TagInjector:

```php
public function injectors()
Expand All @@ -225,7 +225,7 @@ public function injectors()
}
```

Now you are able to access the TagInjector object trough the `$this['tags']` ArrayAccess getter method.
Now you are able to access the TagInjector object through the `$this['tags']` ArrayAccess getter method.

## Custom Types

Expand Down
Loading