PHP Authorization

How it works

This pure helper receives a trusted actor identity and a server-loaded loan record. Its deliberately narrow rule permits only the owner to view the loan. A real application may have additional staff roles, library boundaries and audit requirements. Do not accept the trusted actor ID or owner ID directly from a request and then congratulate the comparison for succeeding.

Run it locally

Run this complete source locally with PHP 8.2 or newer. Save it using the filename shown and run the command below. PHP is not currently available in Bhylu’s browser playground. Apache and MySQL are not needed for an ordinary CLI example.

php -l authorization.php
php authorization.php

Download this source as a local PHP lab file. Keep lab files separate from the Bhylu project and production data.

Example

<?php
declare(strict_types=1);

function mayViewLoan(int $trustedActorId, array $serverLoan): bool {
    return $trustedActorId === $serverLoan["owner_id"];
}
$loan = ["id"=>51,"owner_id"=>8];
echo mayViewLoan(8,$loan) ? "Owner allowed\n" : "Denied\n";
echo mayViewLoan(9,$loan) ? "Allowed\n" : "Other actor denied\n";

Expected result

Owner allowed
Other actor denied

The second actor is denied despite the record existing. The result only demonstrates the stated ownership rule; it is not an account system or proof that the caller supplied a trustworthy identity. Enforce the check before returning private fields or applying a change, and include negative tests for each protected operation.