Limit user access MVC
<p>This is more a theoretical question as to the best practice to only allow users to access certain controller actions within an MVC application.</p>

<p>I've got 2 types of users, "System Users" &amp; "Remote Users". Each should <strong>only</strong> have access to their own set of pages.</p>

<p>This is an inherited framework from a previous developer and the routes are automatically generated so there are no definitions set.</p>

<p>I've thought about creating a whitelist-type access instead of going the full ACL access method. Should I do it pre-router or per method?</p>

<p>Again, I've never had to do this before so what I've thought of doing is something like:</p>

<pre><code>$system_users = [
    '/path/to/page',
    '/path/to/page2',
    '/path/to/page3',
    '/path/to/page4',
    //....etc
];

$remote_users = [
    '/remote/page',
    '/remote/page2',
    //....etc
];
</code></pre>

<p>Then running a custom check before the <code>Router</code> (<em>only if the user(s) are logged in</em>), like:</p>

<pre><code>$user_type = '';
if(Session::get('remote.id') !== FALSE){
    $user_type = 'remote';
} else if(Session::get('system.id') !== FALSE) {
    $user_type = 'system';
}

// now run list
if(!empty($user_type)) {
    if(!in_array(REQUESTED_ROUTE, ${$user_type.'_users'})){
        // Access Denied
        redirect('/NOT_ALLOWED');
    }
    // otherwise carry on with routing.

}
</code></pre>

<p><sup><em>The above is pseudo code.</em></sup></p>

<p>What would be the best way to go about achieving this? Running it in a session? Pre Router? Any help would be appreciated.</p>