src/Web/User.php
public function can($permissionName, $params = [], $allowCaching = true)
    {
        //Special permissions for logged in status handling
        if (in_array($permissionName, [static::PERMISSION_NOT_LOGGED_IN, static::PERMISSION_LOGGED_IN])) {
            $isGuest = $this->getIsGuest();
            if ($isGuest && static::PERMISSION_NOT_LOGGED_IN || !$isGuest && static::PERMISSION_LOGGED_IN) {
                return resolve(true);
            }
            return reject(new Error("Uses::can() - denied by logged in status"));
        }
        if ($allowCaching && empty($params) && isset($this->_access[$permissionName])) {
            return $this->_access[$permissionName]
                ? resolve(true)
                : reject(new Error("Uses::can() - denied"));
        }
        if (($accessChecker = $this->getAccessChecker()) === null) {
            return reject(new Error("Uses::can() - denied (no access checker)"));
        }
        return $accessChecker->checkAccess($this->getId(), $permissionName, $params)
            ->otherwise(function() {
                return false;
            })
            ->then(function($access) use ($allowCaching, $permissionName) {
                if ($allowCaching && empty($params)) {
                    $this->_access[$permissionName] = $access;
                }
                return $access ? resolve(true) : reject(new Error("Uses::can() - denied"));
            });
    }
public function can($permissionName, $params = [], $allowCaching = true)
    {
        //Special permissions for logged in status handling
        if (in_array($permissionName, [static::PERMISSION_NOT_LOGGED_IN, static::PERMISSION_LOGGED_IN])) {
            $isGuest = $this->getIsGuest();
            if ($isGuest && static::PERMISSION_NOT_LOGGED_IN || !$isGuest && static::PERMISSION_LOGGED_IN) {
                return resolve(true);
            }
            return reject(new Error("Uses::can() - denied by logged in status"));
        }
        if ($allowCaching && empty($params) && isset($this->_access[$permissionName])) {
            return $this->_access[$permissionName]
                ? resolve(true)
                : reject(new Error("Uses::can() - denied"));
        }
        if (($accessChecker = $this->getAccessChecker()) === null) {
            return reject(new Error("Uses::can() - denied (no access checker)"));
        }
        return $accessChecker->checkAccess($this->getId(), $permissionName, $params)
            ->otherwise(function() {
                return false;
            })
            ->then(function($access) use ($allowCaching, $permissionName) {
                if ($allowCaching && empty($params)) {
                    $this->_access[$permissionName] = $access;
                }
                return $access ? resolve(true) : reject(new Error("Uses::can() - denied"));
            });
    }
Checks if the user can perform the operation as specified by the given permission.

Note that you must configure "authManager" application component in order to use this method.
Otherwise it will always return false.

@param string $permissionName the name of the permission (e.g. "edit post") that needs access check.
@param array $params name-value pairs that would be passed to the rules associated
with the roles and permissions assigned to the user.
@param bool $allowCaching whether to allow caching the result of access check.
When this parameter is true (default), if the access check of an operation was performed
before, its result will be directly returned when calling this method to check the same
operation. If this parameter is false, this method will always call
[[\Reaction\Rbac\CheckAccessInterface::checkAccess()]] to obtain the up-to-date access result. Note that this
caching is effective only within the same request and only works when `$params = []`.
@return ExtendedPromiseInterface with bool whether the user can perform the operation as specified by the given permission.