Access and login

Every route of a panel – pages, endpoint, file and export downloads – is protected by the filters of the panel. Who may enter is decided by the login, the login method, the second factor and the panel permission; what users see inside by the permissions of resources and pages.

permission()

By default every user who logged in can open a panel; what they see there depends on their permissions (resources and pages are denied by default). permission() closes the whole panel for users without the permission:

public function permission(): ?string
{
    return 'admin.access';
}

• Checked on every route of the panel, in the tenant of the user; others get a “no access” page (HTTP 403, audit event access.denied).
• The permission appears in the role editor under Areas. Give it to the roles of the back office, e.g. through their AD groups, and leave it out of the role of all employees.
• Typical: a back office panel with admin.access and a self service portal without a panel permission (or with portal.access for the role “Employees”).

authMethods()

public function authMethods(): ?array
{
    return ['sso:adfs'];   // single sign-on only
}

The login methods that give access to the panel: password and sso:<provider>; null (default) allows all. Users who logged in with another method are logged out and sent to the login. See Single sign-on.

requiresMfa()

public function requiresMfa(): bool { return true; }

Password logins need a second factor (TOTP) for this panel; default Config\Anvil::$mfaRequired. Single sign-on users get their second factor from the identity provider. See Two-factor authentication.

logoutUrl()

The URL of Log out in the user menu: /logout, or /sso/logout when single sign-on is configured (it also ends the session at the provider). Override it only to send users to a page of your own after logout.

filters()

The filters protecting every route of the panel, in this order:

Filter	Purpose
session	logged in (Shield); otherwise to the login
anvil-auth:<id>	login method allowed (authMethods()), second factor done (requiresMfa())
anvil-password:<id>	forced password change before anything else
anvil-handover	while a document is handed over for signing, the session only reaches the signing page
anvil-tenant	the active tenant (only with hasTenancy())
anvil-panel:<id>	the panel permission (permission())

Add own filters by extending the list, never by replacing it:

public function filters(): array
{
    return [...parent::filters(), 'ip-allowlist'];
}

Filters are CodeIgniter filters registered in Config\Filters. Leaving out one of Anvil’s filters removes its protection.

Inside the panel

After the filters, every page checks its own permission:

Content	Permission
Resource list, detail, create, edit	<slug>.view, <slug>.create, <slug>.update and policies
Pages	<panel>.page.<slug>
Dashboard	none (shows what the user may see)
Actions	their own permission, checked on every run

Users without permission don’t see the navigation entries and get a 403 page. See Authorization.