Handling session resources in MY_Controller with Codeigniter

Question

I've added a function that checks if the user is trying to use/access something which requires a session. I'd love to hear some criticisms of my choice of design.

class MY_Controller extends CI_Controller {
 function __construct() {
 parent::__construct();
 if(!$this->input->is_ajax_request()) {
 if(!$this->session->userdata('is_logged_in')) {
 $this->load->view('header_public_view');
 if($this->login_required())
 //do something, redirect etc..
 }
 else {
 $this->load->model('user_model');
 $data['user'] = $this->user_model->get_user($this->session->userdata('userid'));
 $this->load->view('header_user_view', $data);
 }
 }
 }
 function login_required() {
 if($this->uri->total_segments() > 3)
 $request = $this->uri->segment(3);
 else
 $request = $this->uri->segment(2);
 foreach(unserialize(SESSION_RESOURCES) as $required) {
 if($request == $required)
 return true;
 }
 }
}

Answer 1

You don't really need to check for is_logged_in. If you destroy/build the session data correctly all you should care about is "Does a user id exist in the session?", then you can let your main controller handle the rest.

class MY_Controller extends CI_Controller{
 //here we just build some constants to check against values
 //in the permissions array
 const PERM_READ = "read";
 const PERM_EDIT = "update";
 const PERM_DELETE = "delete";
 //here we let the main controller take care of our auth/permissions/roles etc
 //first check if a user id exists in the session
 //if so assign a user, group, permissions and check for authentication where
 //you need it ( ie: child controllers)
 protected $_user, $_group, $_permissions = array();
 public function __construct(){
 parent::__construct();
 //check for a user id in the session
 $this->user = ( $this->session->userdata('uid') )
 ? User::find_by_id( $this->session->userdata('uid') )
 : NULL;
 //if user exists assign permissions and group
 if ($this->user !== NULL) {
 $this->_assign_group();
 $this->_assign_permissions();
 $this->_check_for_banned_users();
 }
 }
 protected function _assign_group() {
 return $this->group = $this->user->group->name;
 }
 // {["read", "update", "delete"]}
 protected function _assign_permissions() {
 return $this->permissions = json_decode($this->user->permissions);
 }
 protected function _check_for_banned_users() {
 if ($this->group === 'banned') {
 show_error('You have been banned from this website!');
 return;
 }
 }
 protected function _can_read(){
 return (bool) ( in_array( self::PERM_READ, $this->permissions) );
 }
 public function _can_edit(){
 return (bool) ( in_array( self::PERM_EDIT, $this->permissions) );
 }
 public function _can_delete(){
 return (bool) ( in_array( self::PERM_DELETE, $this->permissions) );
 }
} 

This might give you some idea, as your user table won't look like that, I'm sure.

Now, you have control over any child classes.

class some_child extends MY_Controller{
 public function __construct(){
 parent::__construct();
 }
 public function show_something(){
 if($this->is_ajax_request()){
 if($this->user && $this->_can_read()){
 //yes a user exists and is logged in,
 //yes he has permission to read from this section
 $this->load->view('some_view');
 }
 }
 else
 show_404();
 }
}

Just be careful to destroy your session properly.

function logout(){
 $this->session->set_userdata(array(
 'uid' => 0,
 //any others you created upon user login
 ));
 return (bool) $this->session->sess_destroy();
}