MODPATH.'a2',      // Wouter's A2 module
MODPATH.'acl',      // Wouter's ACL module
MODPATH.'auth-a2-acl-demo',      // Nano's demo
MODPATH.'auth',      // Kohana Authentication

<?php
 
/*
 * The Authentication library to use
 * Make sure that the library supports:
 * 1) A get_user method that returns FALSE when no user is logged in
 *      and a user object that implements Acl_Role_Interface when a user is logged in
 * 2) A static instance method to instantiate a Authentication object
 *
 * array(CLASS_NAME,array $arguments)
 */
$config['a1'] = array('AUTH'); // For Kohana's AUTH, simply use array('AUTH');
 
/*
 * The ACL Roles (String IDs are fine, use of ACL_Role_Interface objects also possible)
 * Use: ROLE => PARENT(S) (make sure parent is defined as role itself before you use it as a parent)
 */
$config['roles'] = array
(
    'guest'  =>  NULL,
    'author' =>  'guest',
    'admin'  =>  'author' 
);
 
/*
 * The name of the guest role
 * Used when no user is logged in.
 */
$config['guest_role'] = 'guest';
 
/*
 * The ACL Resources (String IDs are fine, use of ACL_Resource_Interface objects also possible)
 * Use: ROLE => PARENT (make sure parent is defined as resource itself before you use it as a parent)
 */
$config['resources'] = array
(
    'blog'   =>  NULL
);
 
/*
 * The ACL Rules (Again, string IDs are fine, use of ACL_Role/Resource_Interface objects also possible)
 * Split in allow rules and deny rules, one sub-array per rule:
     array( ROLES, RESOURCES, PRIVILEGES, ASSERTION)
 *
 * Assertions are defined as follows :
          array(CLASS_NAME,$argument) // (only assertion objects that support (at most) 1 argument are supported
                                      //  if you need to give your assertion object several arguments, use an array)
 */
$config['rules'] = array
(
    'allow' => array
    (
        // guest can read blog
        array('guest','blog','read'),
 
        // authors can add blogs
        array('author','blog','add'),
 
        // authors can edit their own blogs (and only their own blogs)
        array('author','blog','edit',array('Acl_Assert_Argument',array('primary_key_value'=>'user_id'))),
        array('author','blog','delete',array('Acl_Assert_Argument',array('primary_key_value'=>'user_id'))),
 
        // administrators can do everything
        array('admin','blog','delete'),
        array('admin','blog','edit'),
    ),
    'deny' => array
    (
          // no deny rules in this example
    )
);

<?php
 
class User_Model extends Auth_User_Model implements Acl_Role_Interface {
 
    public function get_role_id()
    {
        $roles = array();
        foreach ($this->roles as $role)
        {
            $roles[] = $role->name;
        }
        return $roles;
    }
 
    /**
     * Validates and optionally saves a new user record from an array.
     *
     * @param  array    values to check
     * @param  boolean  save the record when validation succeeds
     * @return boolean
     */
    public function validate(array & $array, $save = FALSE)
    {
        $array = Validation::factory($array)
            ->pre_filter('trim')
            ->add_rules('username', 'required', 'length[4,32]', 'chars[a-zA-Z0-9_.]', array($this, 'username_available'))
            ->add_rules('password', 'length[5,42]')
            ->add_rules('password_confirm', 'matches[password]')
            ->add_rules('email', 'length[7,127]');
            /* I didn't get how to validate the roles from the dropdown box to real roles */
            //->add_rules('roles','length[3,20]');
            //->add_rules('roles','User_Model::matches[2,3]');
            //->add_rules('role','matches[user,admin]');
 
        if ( ! $this->loaded)
        {
            // This user is new, the password must be provided
            $array->add_rules('password', 'required');
        }
 
        return ORM::validate($array, $save);
    }
 
    // A validation rule - $value should match one of the values in $args
    public static function matches($value,$args)
    {
        return in_array($value,$args);
    }
 
} // End User Model

<?php
 
class Blog_Model extends ORM implements Acl_Resource_Interface {
     // Relationships     protected $has_one = array('user');
     public function get_resource_id()     {
         return 'blog';
     }
     public function validate(array & $array, $save = FALSE)     {
         $array = Validation::factory($array)
                  ->pre_filter('trim')
                  ->add_rules('text','required');
 
        return parent::validate($array, $save);
    }
 
} // End Blog Model

<?php
 
class Authdemo_Controller extends Controller {
    private $_name;     
    public function __construct()     {
        parent::__construct();
        new Profiler;
        $this->a2 = A2::instance('auth-a2-acl-demo');
        $this->a1 = $this->a2->a1;
        $this->_name = Router::$controller;
        echo '<div style="position:absolute;top:0px;right:0px;background-color:#f0f0f0;font-weight:bold;padding:5px;">',html::anchor($this->_name.'/','index'),'-',html::anchor($this->_name.'/db','DB'),'</div>';
    }
 
    public function index()
    {
        $blogs = ORM::factory('blog')->find_all();
 
        // show user info
        echo $this->_user_info();
 
        // show blogs
        echo '<hr />';
        $user = $this->a2->get_user();
        if(count($blogs) === 0)
        {
            echo 'No blogs yet';
        }
        else
        {
            foreach($blogs as $blog)
            {
                echo $blog->text . ' by ' . $blog->user->username;
                $e = "";
                $d = "";
                if ($user) {
                    $e = ($this->a2->allowed($blog,'edit'))? html::anchor($this->_name.'/edit/'.$blog->id,'Edit') : "";
                    $d = ($this->a2->allowed($blog,'delete'))? ' - '.html::anchor($this->_name.'/delete/'.$blog->id,'Delete') : "";
                }
                echo $e,$d,'<hr />';
            }
        }
        if ($user){
          echo html::anchor($this->_name.'/add','Add');
        }
    }
 
    private function _user_info()
    {
        if (($user = $this->a2->get_user()))
        {
            $s =  '<b><i>'.$user->username.' </i></b> ' . html::anchor($this->_name.'/logout','Logout');
        }
        else
        {
            $s = '<b>Guest</b> ' . html::anchor($this->_name.'/login','Login') . ' - ' . html::anchor($this->_name.'/create','Create account');
        }
 
        return '<div style="width:100%;padding:5px;background-color:#AFB6FF;">' . $s . '</div>';
    }
 
    public function create()
    {
        if ($this->a2->logged_in()) //cannot create new accounts when a user is logged in
        {
            $this->index();
        }
 
        // Create a new user
        $user = ORM::factory('user');
        $post = $_POST;
 
        // Do not auto-save, we need to add the roles properly
        if ($user->validate($post))
        {
            // Saving login role and the one coming from dropdown menu
            $user->roles = array(1, $post->role);
            $user->save();
            // user  created, show login form
            $this->login();
        }
        else
        {
           $errors = $post->errors();
           if (count($errors) > 0) {
                echo 'Validation errors were found';
                foreach ($errors as $key => $val)
                {
                echo $key.' failed rule '.$val;
                }
           }
            //show form
            echo form::open();
            echo 'username:' . form::input('username');
            echo 'password:' . form::password('password');
            echo 'password confirm:' . form::password('password_confirm');
            echo 'email:' . form::input('email');
            echo 'role:' . form::dropdown('role',array('3'=>'author','2'=>'admin'));
            echo form::submit(array('value'=>'create'));
            echo form::close();
        }
 
        echo Kohana::debug($post->as_array(),$user->as_array());
    }
 
    public function login()
    {
        if($this->a2->logged_in()) //cannot create new accounts when a user is logged in
        {
            return $this->index();
        }   
 
        $post = Validation::factory($_POST)
            ->pre_filter('trim')
            ->add_rules('username', 'required', 'length[4,127]')
            ->add_rules('password', 'required');
 
        if($post->validate())
        {
            if($this->a1->login($post['username'],$post['password'], isset($_POST['remember']) ? (bool) $_POST['remember'] : FALSE))
            {
                url::redirect( $this->_name.'/index' );
            }
        }
 
        //show form
        echo form::open();
        echo 'username:' . form::input('username');
        echo 'password:' . form::password('password');
        echo 'remember me:' . form::checkbox('remember',TRUE);
        echo form::submit(array('value'=>'login'));
        echo form::close();
    }
 
    public function logout()
    {
        $this->a1->logout();
        return $this->index();
    }
 
    public function add()
    {
        if(!$this->a2->allowed('blog','add'))
        {
            echo '<b>You are not allowed to add blogs</b>';
            return $this->index();
        }
 
        $blog = ORM::factory('blog');
        $this->_editor($blog);
    }
 
    public function edit($blog_id = "")
    {
        $blog = ORM::factory('blog',$blog_id);
 
        // NOTE the use of the actual blog object in the allowed method call!
        if(!$this->a2->allowed($blog,'edit'))
        {
            echo '<b>You are not allowed to edit this blog</b>';
            return $this->index();
        }
 
        $this->_editor($blog);
    }
 
    private function _editor($blog)
    {
        if($blog->validate($_POST))
        {
            $blog->user_id = (empty($blog->user_id))? $this->a2->get_user()->id : $blog->user_id;
            $blog->save();
            return $this->index();
        }
 
        //show form
        echo form::open();
        echo 'text:' . form::textarea('text',$blog->text);
        echo form::submit(array('value'=>'post'));
        echo form::close();
    }
 
    public function delete($blog_id = "")
    {
        $blog = ORM::factory('blog',$blog_id);
 
        // NOTE the use of the actual blog object in the allowed method call!
        if(!$this->a2->allowed($blog,'delete'))
        {
            echo '<b>You are not allowed to delete this blog</b>';
        }
        else
        {
            $blog->delete();
        }
 
        $this->index();
    }
 
    public function db()
    {
        echo '<b>Mysql DB structure</b><hr />';
 
        echo "&lt;pre>
        CREATE TABLE IF NOT EXISTS `roles` (
          `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
          `name` varchar(32) NOT NULL,
          `description` varchar(255) NOT NULL,
          PRIMARY KEY  (`id`),
          UNIQUE KEY `uniq_name` (`name`)
        ) ENGINE=InnoDB  DEFAULT CHARSET=utf8;
 
        INSERT INTO `roles` (`id`, `name`, `description`) VALUES(1, 'login', 'Login privileges, granted after account confirmation');
        INSERT INTO `roles` (`id`, `name`, `description`) VALUES(2, 'admin', 'Administrative user, has access to everything.');
        INSERT INTO `roles` (`id`, `name`, `description`) VALUES(3, 'author', 'Can create posts. Delete and edit own posts.');
 
        CREATE TABLE IF NOT EXISTS `roles_users` (
          `user_id` int(10) UNSIGNED NOT NULL,
          `role_id` int(10) UNSIGNED NOT NULL,
          PRIMARY KEY  (`user_id`,`role_id`),
          KEY `fk_role_id` (`role_id`)
        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
        CREATE TABLE IF NOT EXISTS `users` (
          `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
          `email` varchar(127) NOT NULL,
          `username` varchar(32) NOT NULL DEFAULT '',
          `password` char(50) NOT NULL,
          `logins` int(10) UNSIGNED NOT NULL DEFAULT '0',
          `last_login` int(10) UNSIGNED,
          PRIMARY KEY  (`id`),
          UNIQUE KEY `uniq_username` (`username`),
          UNIQUE KEY `uniq_email` (`email`)
        ) ENGINE=InnoDB  DEFAULT CHARSET=utf8;
 
        CREATE TABLE IF NOT EXISTS `user_tokens` (
          `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
          `user_id` int(11) UNSIGNED NOT NULL,
          `user_agent` varchar(40) NOT NULL,
          `token` varchar(32) NOT NULL,
          `created` int(10) UNSIGNED NOT NULL,
          `expires` int(10) UNSIGNED NOT NULL,
          PRIMARY KEY  (`id`),
          UNIQUE KEY `uniq_token` (`token`),
          KEY `fk_user_id` (`user_id`)
        ) ENGINE=InnoDB  DEFAULT CHARSET=utf8;
 
        ALTER TABLE `roles_users`
          ADD CONSTRAINT `roles_users_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE,
          ADD CONSTRAINT `roles_users_ibfk_2` FOREIGN KEY (`role_id`) REFERENCES `roles` (`id`) ON DELETE CASCADE;
 
        ALTER TABLE `user_tokens`
          ADD CONSTRAINT `user_tokens_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE;
 
        CREATE TABLE IF NOT EXISTS `blogs` (
          `id` int(12) unsigned NOT NULL auto_increment,
          `user_id` int(12) unsigned NOT NULL,
          `text` text NOT NULL,
          PRIMARY KEY  (`id`),
          KEY `user_id` (`user_id`)
        ) ENGINE=InnoDB  DEFAULT CHARSET=utf8;
 
        ALTER TABLE `blogs`
          ADD CONSTRAINT `blogs_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE;
        &lt;/pre>";
    }
 
}