title: cakePHP- Role Authorization and Routing
body: <p>I am completely and utterly lost on how to do this. I have 3 different roles : Admin, Staff and Donors. My problem is that It really gets confusing(for me anyway) with permissions and as well as appropriate redirections, should an unauthorized user tries to access an action from the URL. </p>
  
  <p>In my UsersController I have the following actions </p>
  
  <ol>
  <li>admin_index </li>
  <li>admin_add</li>
  <li>admin_edit</li>
  <li>admin_view</li>
  <li>admin_delete</li>
  </ol>
  
  <p>non-prefixed actions</p>
  
  <ol>
  <li>login </li>
  <li>logout</li>
  <li>view</li>
  <li>add</li>
  <li>edit</li>
  </ol>
  
  <p>The admin should be allowed to access all admin-prefixed actions as well as login and logout, whilst the staff and donor 
  should only be able to access the latter 5. Also note that all users are using the same login form. </p>
  
  <p>In my AppControlles's component I have the following :</p>
  
  <pre><code> 'Auth' =&gt; array(
              'loginRedirect' =&gt; array(  
                  'controller' =&gt; 'donors',
                  'action' =&gt; 'index'
              ),
              'logoutRedirect' =&gt; array(  
                  'controller' =&gt; 'users',
                  'action' =&gt; 'login'
              ),
              'authorize' =&gt; array('Controller')
  )
  </code></pre>
  
  <p>However, In my login action I check for the user role to change the loginRedirect accordingly :</p>
  
  <pre><code>if($this-&gt;request-&gt;is('post')){
              if($this-&gt;Auth-&gt;login()){   
  
              switch($this-&gt;Auth-&gt;user('role')){
                  case 'admin':
                      $this-&gt;Auth-&gt;loginRedirect = array('controller'=&gt;'users','action'=&gt;'admin_index','prefix'=&gt;'admin','admin'=&gt;true);
                      break;
                  case 'donor':
                  ...
                  break; 
                  case .....
              }
           }
   }
  </code></pre>
  
  <p>Question 1
  Now, if a current user with  a role of donor is logged in, and tries to access <code>localhost/sitename/admin/users/add</code> he is redirected to <code>admin/donors</code> rather then just <code>/donors</code> . So how am I able to remove the admin prefix ? </p>
  
  <p>Question 2
  Also I do not fully understand hwo $this->Auth->allow(), works.. If In my donorsController I want to control the access to the controllers action according to roles, how can I do it? So for instance, If there is the 'delete' action in my donorsController, How will I be able to permit the staff user whilst denying the donor user to access the delete action. I believe the beforeFilter is the solution, but can't find how to do it! Any pointers ? 
  Thanks</p>