title: cakephp3 restrict controller use depending on user type
body: <p>I am using cakephp3. I have a simple web application that has users. I have two user types, Admin and Standard. I want to limit Standard user to only view and index data. Whereas Admin type user should be able to add, edit, delete, view and index user data.</p>
  
  <p>Basically, I want to globally restrict standard users, so that they cannot access the add, edit and delete methods of the controller.</p>
  
  <p>So can anyone help me achieve it?</p>
  
  <hr>
  
  <p>Below is /src/Controller/UsersController.php</p>
  
  <pre><code>            &lt;?php
              namespace App\Controller;
  
              use App\Controller\AppController;
  
              /**
               * Users Controller
               *
               * @property \App\Model\Table\UsersTable $Users
               */
              class UsersController extends AppController
              {
  
                  /**
                   * Index method
                   *
                   * @return void
                   */
                  public function index()
                  {
                      $this-&gt;paginate = [
                          'contain' =&gt; ['Countries', 'Cities', 'UserGroups', 'UserLevels']
                      ];
                      $this-&gt;set('users', $this-&gt;paginate($this-&gt;Users));
                      $this-&gt;set('_serialize', ['users']);
                  }
  
                  public function dashboard()
                  {
  
                  }
                  /**
                   * View method
                   *
                   * @param string|null $id User id.
                   * @return void
                   * @throws \Cake\Network\Exception\NotFoundException When record not found.
                   */
                  public function view($id = null)
                  {
                      $user = $this-&gt;Users-&gt;get($id, [
                          'contain' =&gt; ['Countries', 'Cities', 'UserGroups', 'UserLevels', 'Alerts', 'DeviceLogs', 'Devices']
                      ]);
                      $this-&gt;set('user', $user);
                      $this-&gt;set('_serialize', ['user']);
                  }
  
                  /**
                   * Add method
                   *
                   * @return void Redirects on successful add, renders view otherwise.
                   */
                  public function add()
                  {
                      $user = $this-&gt;Users-&gt;newEntity();
                      if ($this-&gt;request-&gt;is('post')) {
                          $user = $this-&gt;Users-&gt;patchEntity($user, $this-&gt;request-&gt;data);
                          if ($this-&gt;Users-&gt;save($user)) {
                              $this-&gt;Flash-&gt;success(__('The user has been saved.'));
                              return $this-&gt;redirect(['action' =&gt; 'index']);
                          } else {
                              $this-&gt;Flash-&gt;error(__('The user could not be saved. Please, try again.'));
                          }
                      }
                      $countries = $this-&gt;Users-&gt;Countries-&gt;find('list', ['limit' =&gt; 200]);
                      $cities = $this-&gt;Users-&gt;Cities-&gt;find('list', ['limit' =&gt; 200]);
                      $userGroups = $this-&gt;Users-&gt;UserGroups-&gt;find('list', ['limit' =&gt; 200]);
                      $userLevels = $this-&gt;Users-&gt;UserLevels-&gt;find('list', ['limit' =&gt; 200]);
                      $this-&gt;set(compact('user', 'countries', 'cities', 'userGroups', 'userLevels'));
                      $this-&gt;set('_serialize', ['user']);
                  }
  
                  /**
                   * Edit method
                   *
                   * @param string|null $id User id.
                   * @return void Redirects on successful edit, renders view otherwise.
                   * @throws \Cake\Network\Exception\NotFoundException When record not found.
                   */
                  public function edit($id = null)
                  {
                      $user = $this-&gt;Users-&gt;get($id, [
                          'contain' =&gt; []
                      ]);
                      if ($this-&gt;request-&gt;is(['patch', 'post', 'put'])) {
                          $user = $this-&gt;Users-&gt;patchEntity($user, $this-&gt;request-&gt;data);
                          if ($this-&gt;Users-&gt;save($user)) {
                              $this-&gt;Flash-&gt;success(__('The user has been saved.'));
                              return $this-&gt;redirect(['action' =&gt; 'index']);
                          } else {
                              $this-&gt;Flash-&gt;error(__('The user could not be saved. Please, try again.'));
                          }
                      }
                      $countries = $this-&gt;Users-&gt;Countries-&gt;find('list', ['limit' =&gt; 200]);
                      $cities = $this-&gt;Users-&gt;Cities-&gt;find('list', ['limit' =&gt; 200]);
                      $userGroups = $this-&gt;Users-&gt;UserGroups-&gt;find('list', ['limit' =&gt; 200]);
                      $userLevels = $this-&gt;Users-&gt;UserLevels-&gt;find('list', ['limit' =&gt; 200]);
                      $this-&gt;set(compact('user', 'countries', 'cities', 'userGroups', 'userLevels'));
                      $this-&gt;set('_serialize', ['user']);
                  }
  
                  /**
                   * Delete method
                   *
                   * @param string|null $id User id.
                   * @return \Cake\Network\Response|null Redirects to index.
                   * @throws \Cake\Network\Exception\NotFoundException When record not found.
                   */
                  public function delete($id = null)
                  {
                      $this-&gt;request-&gt;allowMethod(['post', 'delete']);
                      $user = $this-&gt;Users-&gt;get($id);
                      if ($this-&gt;Users-&gt;delete($user)) {
                          $this-&gt;Flash-&gt;success(__('The user has been deleted.'));
                      } else {
                          $this-&gt;Flash-&gt;error(__('The user could not be deleted. Please, try again.'));
                      }
                      return $this-&gt;redirect(['action' =&gt; 'index']);
                  }
  
                  public function login()
                  {
                      if ($this-&gt;request-&gt;is('post')) {
                          $user = $this-&gt;Auth-&gt;identify();
                          if ($user) {
                              $this-&gt;Auth-&gt;setUser($user);
                              return $this-&gt;redirect($this-&gt;Auth-&gt;redirectUrl());
              }
                          $this-&gt;Flash-&gt;error('Your username or password is incorrect.');
                      }
                  }
  
                  public function logout()
                  {
                      $this-&gt;Flash-&gt;success('You are now logged out.');
                      return $this-&gt;redirect($this-&gt;Auth-&gt;logout());
                  }
  
                  public function resetPassword() {
  
                  }
  
                  public function changepassword() {
  
                  }
  
              }
  
              Below is AppController.php
  
              &lt;?php
  
              namespace App\Controller;
  
              use Cake\Controller\Controller;
              use Cake\Event\Event;
  
              class AppController extends Controller
              {
                  use \Crud\Controller\ControllerTrait;
  
                  public $components = [
                      'RequestHandler',
                      'Crud.Crud' =&gt; [
                          'actions' =&gt; [
                              'Crud.Index',
                              'Crud.View',
                              'Crud.Add',
                              'Crud.Edit',
                              'Crud.Delete'
                          ],
                          'listeners' =&gt; [
                              'Crud.Api',
                              'Crud.ApiPagination',
                              'Crud.ApiQueryLog'
                          ]
                      ]
                  ];
                  /**
                   * Initialization hook method.
                   *
                   * Use this method to add common initialization code like loading components.
                   *
                   * e.g. `$this-&gt;loadComponent('Security');`
                   *
                   * @return void
                   */
                  public function initialize()
                  {
                      parent::initialize();
  
                      $this-&gt;loadComponent('RequestHandler');
                      $this-&gt;loadComponent('Flash');
                      $this-&gt;loadComponent('Auth', [
                          'authenticate' =&gt; [
                              'Form' =&gt; [
                                  'fields' =&gt; [
                                      'username' =&gt; 'email',
                                      'password' =&gt; 'password'
                                  ]
                              ]
                          ],
                          'loginAction' =&gt; [
                              'controller' =&gt; 'Users',
                              'action' =&gt; 'login'
                          ],
                          // default is referer and in case of no referer loginRedirect (after login)
                          'loginRedirect' =&gt; [
                              'controller' =&gt; 'Users',
                              'action' =&gt; 'dashboard'
                          ],
                          'logoutRedirect' =&gt; '/',
                          'authError' =&gt; "Y"
                      ]);
  
                      // Allow the display action so our pages controller
                      // continues to work.
                      $this-&gt;Auth-&gt;allow(['resetPassword','add','changePassword','display']);
                  }
                  /**
                   * Before render callback.
                   *
                   * @param \Cake\Event\Event $event The beforeRender event.
                   * @return void
                   */
                  public function beforeRender(Event $event)
                  {
                      if (!array_key_exists('_serialize', $this-&gt;viewVars) &amp;&amp;
                          in_array($this-&gt;response-&gt;type(), ['application/json', 'application/xml'])
                      ) {
                          $this-&gt;set('_serialize', true);
                      }
                  }
              }
  </code></pre>
  
  <p>Regards,</p>