title: Doubts about Yii2 RBAC
body: <p>I've been developing web apps using Yii 1.1.14 so far, but now it's time for an upgrade.</p>
  
  <p>The company where I work has developed its own Access Control system, and I was really OK with it until I saw what it was really like... A combination of 8 tables in the database (not counting the users table), with a bunch of foreign keys.</p>
  
  <ul>
  <li>1 table for controllers</li>
  <li>1 table for the  actions</li>
  <li>1 table for the menu categories</li>
  <li>1 table for types of users</li>
  <li>And the other tables basically just connect 2 or 3 of those tables at a time.</li>
  </ul>
  
  <p>It works well, but in my point of view it's highly time consuming to maintain all those tables, and at some point, when your application goes online, if it hits a certain amount of users it could get really slow. specially because 2 of those tables have the user's table primary key as foreign key.</p>
  
  <p>So I've decided that, when I start developing on Yii 2, I'm going to start using RBAC, so I started looking for tutorials online... Only finding many different versions of the same code with author's role, and permissions for create or update posts.</p>
  
  <p>I found a combination of 5 videos on Youtube, but they are about Yii 1 RBAC. They were helpful because I managed to understand most of RBAC's functionality, but I still have some doubts that I'll
  enumerate below. And keep in mind that for this Access Control system I'm using the <strong>DBManager</strong> class.</p>
  
  <p><strong><em>My Doubts</em></strong></p>
  
  <ol>
  <li><p>Yii 1's RBAC used to have 3 tables: <code>auth_assignment</code>, <code>auth_item</code> and <code>auth_item_child</code>. Now in Yii 2 RBAC, a new table appears that is called <code>auth_rule</code> and I still don't understand what that specific table is doing there, how to use it or how to populate it.</p></li>
  <li><p>I see that it's possible to restrict the user's access to some actions by using the controller's behavior method, and assigning access to some actions depending on the user's role, but when it comes to this I have to split my question into 2:</p>
  
  <p>2.1. <strong>First:</strong> If you can just restrict the access to actions by setting it up in the behaviors method, then what's the use of saving permissions to the <code>auth_item</code> table?</p>
  
  <p>2.2. <strong>Second:</strong> If you DO decide to control access according to permissions, then how exactly do you do it, because I find myself writing the following type of code inside of every function and I don't think using RBAC is supposed to be this tedious. There has to be another way.</p>
  
  <pre><code>public function actionView($id)
  {
      if(Yii::$app-&gt;user-&gt;can('view-users')){
          return $this-&gt;render('view', [
              'model' =&gt; $this-&gt;findModel($id),
          ]);
      }else{
          #Redirect to a custom made action that will show a view 
          #with a custom error message
          $this-&gt;redirect(['//site/notauthorized']);
      }
  }
  </code></pre></li>
  <li><p>Because of the Access Control System that we use right now, when a user logs in, a complex query is executed that will end up returning an array that will be saved as a session variable, and will be used to create a menu with as many dropdownlists as menu categories, that the controllers that the user has access to belong to. How can this be done with RBAC?</p></li>
  </ol>