title: Cakephp 3 - How to retrieve current logged user in a 'Table' class during validation process?
body: <p>I'am using CakePhp3 for my website and I have to inject some custom validation logic based on the current user Id when I'am creating or modifying an entity.</p>
  
  <p>The basic case is "Is the user allow to change this field to this new value" ? If' not, I want to raise a validation error (or an unauthorized exception).</p>
  
  <p>In cakephp, for what I'am understanding, most of the application and businness rules must be placed on Models or 'ModelsTable'of the ORM. But, in this classes, the AuthComponent or the current session is not available.</p>
  
  <p>I don't want to call manually a method on the entity from the controller each time I need to check. I would like to use a validator, something like :</p>
  
  <pre><code>$validator-&gt;add('protected_data', 'valid', [
              'rule' =&gt; 'canChangeProtectedData',
              'message' =&gt; __('You're not able to change this data !'),
              'provider' =&gt; 'table',
          ]);
  </code></pre>
  
  <p>Method on ModelTable :</p>
  
  <pre><code>public function canChangeProtectedData($value, array $context)
  {
      \Cake\Log\Log::debug("canChangeProtectedData");
      // Find logged user, look at the new value, check if he is authorized to do that, return true/false
      return false;
  }
  </code></pre>
  
  <p>I cakephp &lt; 3, the AuthComponent have a static method 'AuthComponent::user()' that is not available anymore. So, how Can I do that in CakePhp 3 ? </p>
  
  <p>Thank you for any response.</p>
  
  <p>EDIT - Adding more details </p>
  
  <p>So here are more details. In case of an REST API. I have an edit function of an entity. The "Article" Entity. </p>
  
  <p>This Article has an owner with a foreign key on the column named "user_id" (nothing special here). My users are organized in groups with a leader on the group. Leaders of groups can change article's owner but "basics" users can't do it (but they can edit their own articles). Admin users can edit everything.
  So the edit method must be available for any authenticated user, but changing the "user_id" of the entity must be allowed and checked depending the case (if I'am admin yes, if I'am leader yes only if the new Id is one of my group and if I'am basic user no).</p>
  
  <p>I can do this check on the controller but if I want this rule to be checked everywhere in my code where an Article is modified (in another method than the "Edit" of ArticlesController). So for me the Model seems the good place to put it no?</p>