Yii 2 User Permission using matchCallback

As a web software developer I sometimes need to implement some kind of user permissions in the web applications that I build. The Yii 2 framework which I currently use has a built in system for doing just this however for applications that need a more lightweight user permission system the Yii 2 framework has introduced a method which was not available in the Yii 1 framework that can be used to easily build lightweight user permissions and that method is “matchCallback”.

Both Yii 1 and Yii 2 have a user permissions system named RBAC. In Yii 1 RBAC is implemented by writing code to define the user permissions, this code then populates the database tables with the user permissions. The user permissions are then applied to controller methods via more code known as access rules.

User permissions can also have what is known as a “bizRule”, a “bizRule” is an additional piece of code executed with the user permission that needs to evaluate to true in order for the user permission to be true. This can be used to implement checks to see if the record being displayed on the page is owned by the user trying to access the page as well as various other checks. The “bizRule” code is stored in the database along with the user permission.

One of the differences between the Yii 2 implementation of RBAC and the Yii 1 version is that the Yii 2 “bizRule” code is stored in code files and not the database. This makes more sense to me as the “bizRule” code is kept alongside the other code in the frameworks, models, controllers, views etc.

Infact it makes so much sense that during the later stages of using the Yii 1 framework I actually just stored class / function references in the “bizRule” code and wrote my real “bizRule” alongside the rest of framework code. Essentially implementing my own version of what Yii 2 covers as standard.

As mentioned above Yii 2 now implements a method called “matchCallback”. This means for web applications requiring simple user permissions RBAC is not needed as the “matchCallback” can be used to define the “bizRule” directly in the access rules …

So as shown above for web applications only requiring simple user permissions, the access rules are all that are needed.

Technical questions on interviews? High standards?

So I have been to a number of interviews now where I have had to answer technical questions and do technical tests. The technical questions are of a high standard and can go deep into the principles of object orientated programming. What baffles me is when I ask to look at some of these companies codebases the codebase is a mess, even the interviewers have admitted that their own codebase is a mess occasionally.

I am talking functions with over a hundred lines of code in them, huge code files, code copied from one place to another with just a couple of minor changes, no consistency in naming convensions, if “classes” where used no real thought about true object orientation was attempted and the class was used just as a place to put some code, basically not even an average coding standard level but a below average coding standard level.

Now the company may state they have high standards during the interview process to weed out the candidates who do not do well in the tests. However this makes no sense for a couple of reasons …

  1. True candidates who do well on the tests will not want to work on such a codebase. Even if the candidate who did well on the tests did want to work with such a codebase how can the candidate who did well on the tests adapt to such a codebase? All the candidates who did well on the tests can do with such a codebase is to follow what is already there for the most part.
  2. Companies with such a codebase do not want candidates who do well on the tests, the companies may claim they do but when it comes down to it the candidates suggestions for improving the codebase, the candidate will not be taken seriously. Generally with codebases like these a complete re-write of the entire codebase will be required. Companies with codebases like the above suggested do not care whether someone can code the system in a more efficient and effective way, they just want someone who can work with the codebase they currently have, thus adding to the mess.

So why the technical questions and tests in the interview? Who knows? I most certainly do not. None of the principles asked during the interview is applied to the companies codebase so why do candidates need to go through these tests and demonstrate such principles.

The best interview I ever had consisted of having a small conversation about myself and the company followed by a small task. The small task I had to complete was to demonstrate how I would fix a certain bug with one of the features within their current system. No tricks, no catches. I just had to explain how I would fix a fairly ordinary bug that has cropped up in the current system.

I was shown a screen with the bug on it and handed the codebase. I could determine the starting point to look for the bug via the URL of the screen with the bug on it. After starting at the above point and digging deeper into a couple more files I found the best place to implement the fix and determined what the fix would be.

It would be great if all interviews where like the one described above. The task has got to be something small that demonstrates the programmer can dig into the codebase and fix a small problem.

So in conclusion I believe that interviews should be tailored to represent the actual companny. If your company does not need candidates who do well on interview tests then the interview should not be tailored that way. If your company is adament that candidates who do well on interview tests are needed then the companies current practices and codebase should reflect the level of tests they are giving to candidates at the interview.

Please also note that in a lot of the tests companies give to candidates the questions seem more geared to how much you can remember from a standard “programmers handbook” than actual real world scenarios that might actually happen. That is why the above approach involving fixing a bug is a better approach in my opinion.

Neptune – web based lead management / tracking tool – going free

Neptune is going free. I spent sometime not long ago implementing the subscription billing system into Neptune. Now I have spent some time to enable Neptune to have a plan that can be signed up to free of charge …

www.neptuneleadtracker.com

You can sign up and use Neptune for free now.

Trying to run Neptune like a business and only have paid plans took the fun out of the Neptune project. With the business aspects of Neptune out of the way Neptune can now be treated like the side project that it really is.

Czech character code converter

During the last contract I worked on a number of tasks required the use of converting blocks of text to there respective Czech character codes. I decided to build a Czech character code converter tool to help with this task.

I have put the Czech character code converter online as a free tool that can be used by anyone needing to convert text with Czech characters within it to there respective character codes. The tool can be found at …

http://www.czechcharactercodeconverter.com

Let me know if you used this tool for your project and what you think of it.

Fire those who are not excelling

So I read a lot of content on the web in my spare time and the title of this topic is a phrase I hear quite a lot on the web and I would just like to give my opinions on the above phrase and why this is not a good idea.

Ok so what is meant by “excelling”, well the definition of “excelling” is as follows …

shine, be very good, be excellent, be brilliant, be outstanding, be skilful, be talented, be proficient, be expert, be pre-eminent, reign supreme, wear the crown, stand out, be the best, be unrivalled, be unparalleled, be unequalled, be without equal, be second to none, be unsurpassed, surpass, outdo, outshine, outclass, outstrip, beat, beat hollow, top, cap, transcend, be better than, be superior to, go one better than, better, pass, eclipse, overshadow, put in the shade, put to shame

Firstly I can see in the list “be very good” so if I want to not get fired I have to “be very good”. My critique on this is “be very good” by whose and what standard? There is no standard on what is meant by “be very good”. Now you might say “well a standard can be defined and we can use that standard to measure the employee against”.

Yes this is what any reasonable person might think however I generally find that the people who are using and passing the phrase “Fire those who are not excelling” do not actually do this in practice. The “be very good” in practice merely becomes to “be very good” in the bosses or managers opinion. So to be fired for not excelling is to be fired based on the opinion of some boss or manager and very rarely is there any real evidence or standard to back this up.

The second word that stands out in the list is “go one better than”. Ok so to not get fired I have to “go one better than”. Now who do I have to go one better than? With time to think you may say the competition, however in practice with the people who have this sort of mindset the competition is not some far away company but your actual coworkers. This creates a climate of one-up-man-ship, if employee A is expected to “go one better than” employee B and employee B is expected to “go one better than” employee A how can that ever be resolved? It creates a climate of unhealthy and somewhat vicious competition among co-workers with each employee seeking to gain the better position from which they can rule.

Which brings me to the third word that stands out in the list … “beat”. Now what I am about to say is merely a matter of opinion and whether you see the connection or not is entirely up to you. Would it not make sense that an employee that is trying his hardest to “be very good” and “go one better than” his coworkers, in a climate of hostile competition and one-up-man-ship is actually trying to “beat” his coworkers. Yes in this instance I do not mean “beat” in friendly terms either I mean physical violence. Is this not the underlying desire this employee has? Is it too far a stretch of the imagination to see the connection? Is it too far a stretch that the person who desires to “go one better than” is quick to resort to fisty cuffs to enable them to actually do that?

One opinion could be that the coworker beat somebody up or punched someone because he was under a lot of stress at the time due to the climate of the workplace. One opinion could be that the desire was there already and the coworker who plays the game of one-up-man-ship was predetermined to be physically violent anyway.

So in my opinion if a company was to “Fire those who are not excelling” what does that leave the company with? A bunch of employees who are physically violent at heart and have no desire to see the company succeed but merely wish to “one up” their coworkers.

Please note that none of the above is an excuse for employee who is genuinely not getting his / her workload done. Each employee should be productive but not in the way described above. Each employee should be responsible for his / her own productive effort but should not have the desire to create unhealthy competition among coworkers. If all an employee can do is compare himself to other coworkers and is viciously competitive with coworkers whilst showing no genuine productivity then maybe that is the employee who needs to be re-educated.

I think the main point I am trying to make is that there is difference between an employee who is genuinely productive and an employee who always seems to be trying to “excel” in a viciously competitive way that has nothing to do with his / her genuine productive output.

Please note that there is also a difference between an employee who actually has the desire to “beat”, “go one better than” etc and an employee who is merely peddling the latest buzzwords because he / she thought they sounded cool without actually having that desire at all.

So that concludes my opinion on what I think all of all this “excelling” non-sense.

What would I look for in hiring a developer?

What would I look for from a technical perspective when hiring a developer?

Below is a list of areas I would look into when hiring a developer …

Consistency of code
Is the consistency of the developers code consistent. There are many different ways of writing the same code in terms of code syntax but is the chosen way to write a piece of code consistent with a later way of writing the same piece of code. I am not talking about blocks of code here although it could apply to blocks of code as well but I am mainly talking about the small pieces of code for example arrays.

In PHP arrays can be written in the following 2 ways …

Or …

I would expect the developer to choose a way to write arrays and stick to the one way of writing arrays throughout the code. This also applies to using brackets within the code …

Or …

I would expect the developer to choose a way of writing brackets within the code and stick to that way of writing brackets. In the particular example above it would be except-able for the developer to change the style of writing the IF statement if the IF statement was no longer than 1 line of code for example …

The above is fine because there is a reason for it. That reason being the IF statement is no longer than 1 line of code. This reasoning can be applied consistently through all areas of the code. So when an IF statement is no longer than 1 line of code brackets are not needed. This is except-able if the reasoning is kept consistent throughout the code.

Consistency can be applied across many more areas including, naming conventions in code, code files and database, structure of the code, classes and extending classes, using code in view files or not using code in view files, tabbing / spacing of code.

So long as areas of code are kept consistent and the code is not mixing the above styles without reason then that would be except-able in my opinion.

Abstraction of code
Is the code appropriately abstracted? Is the code that is used in more than 1 place wrapped in classes / functions. If using a framework is the code in the controllers appropriately thin and the models and other classes doing most of the work.

When using a framework my controllers are quite small when compared to the level of functionality that is being executed. This is because my Models do most of the work and I make full use of the “beforeSave” and “afterFind” methods.

The controllers should control the flow whilst the details are kept tucked away in classes / functions.

Making the most of the tools / web frameworks
If using a web framework is the appropriate functionality being used? For example some of the latest frameworks have a feature called “scopes”. Are scopes being used where they should be or has the developer ignored scopes and written his own way of doing scopes?

If there is a legitimate reason for writing custom code to allow functionality similar to scopes then use it but if there is not a legitimate reason and the developer wrote his / her own way because he / she could not be bothered to read the scopes documentation then I would except the legitimate scopes to be used.

Same applies with “user authentication”. I have seen plenty of developers use their own way of “user authentication” including a full permissions system when the framework the developer used already had this feature built in.

When prompted as to the reason the developer created his / her own “user authentication” system the developer will state “the built in functionality is not fit for our requirements”, or “the custom user system that has been built is better and will allow us to do more complex user permissions” or some other general reason.

However upon further inspection it can be found that the frameworks built in functionality was fit for the requirements (plus more) and that the developer just could not be bothered to use the built in functionality.

So in conclusion if I was hiring for a developer the above areas are some criteria which I would make my decision on. The above areas are not set in stone and if some of the code was not in line with the above areas and there was a reason for it that would be except-able. If the there was no reason for it, it still may be except-able under the agreement that the areas are rectified. All in all the areas have to be taken on a case by case basis.

Neptune – web based lead management / tracking tool – launch

Neptune has been launched and can be found online at the following website address …

www.neptuneleadtracker.com

Neptune has had a “soft” launch in that no huge marketing efforts have been done yet and there are still plenty of features to add to Neptune over the course of time. Marketing and feature development will be on-going.

Any updates to Neptune going forward will be posted at this blog as usual.

Neptune – web based lead management / tracking tool – email address conflict

Last week I spoke about the upgrade to Neptune in that Neptune now accommodates multiple users per account. Originally a Neptune user-account was the whole account. With the advent of the modifications last week a user-account now has a one to many relationship with an account thus allowing for multiple user-accounts under a single account.

Visit Neptune here …

www.neptuneleadtracker.com

I thought this was suitable for purpose until I started thinking into some of the scenarios that could crop up when Neptune finally goes live. If Neptune was left with this solution then the user-account could not be shared across different accounts. Lets say a person from Account A wants to add Jon Doe to his account and a person from Account B also wants to add Jon Doe to his account. This scenario would not be possible without Jon Doe having 2 different accounts with different emails addresses meaning Jon Doe would have to create another email address to have an account with Account B …

Account A
User-account A – Jon Doe

Account B
User-account B – Jon Doe

User-account A and user-account B both would have different email addresses. User-account A and user-account B are represented as 2 distinct user-accounts.

The above system could be improved upon so I set upon improving it. I came up with 2 solutions …

Solution 1

Keep the one to many data structure between the account and users and have it so “email addresses” do not have to be unique in the users table. The email addresses would then only have to be unique per account they are related to. I could then give each account a special login URL which is unique to the account in which the user-accounts can login with. This would result as follows …

Account A
User-account A – Jon Doe

Account B
User-account B – Jon Doe

Although it looks the same as before, user-account A can have the same email address as user-account B, in the old model this was not so and user-account A had to have a different email address to user-account B. User-account A and user-account B are still represented as distinct user-accounts though. The system would know which account the user was attempting to access via the special login URL given to each account and the system would only have to check the uniqueness of the email addresses for each given account.

Solution 2

Get rid of the one to many data structure and replace with a many to many data structure. This solution is the most taxing in terms of implementation as the code would have to be altered in the system to accommodate the many to many relationship which also means swapping a few other database columns round and getting rid of some as they would be no longer needed.

Luckily due to the way the system was abstracted in the code, it turned out that most of the changes could be accomplished by altering a few class methods. Essentially just changing the way those methods returned the data they where fetching from the database.

Using this solution the result now looks like the following …

Account A
User-account A – Jon Doe

Account B
User-account A – Jon Doe

In this solution both accounts share the same user-account. The user-account obviously uses the same email address as it is the same user-account across both accounts. If a fictitious Account C wants to add Jon Doe to their account the system would first check if the email address for Jon Doe exists, if it does then the system will link the Jon Doe user-account to Account C, if not, then the system will create a new user-account for Jon Doe and then link the newly created user-account to Account C.

When a user logs into the system using this solution and the user belongs to more than 1 account the system will present a list of accounts that the user-account belongs to in a selection list. The user can then choose which account to fully log into. If the user-account is only in 1 account then the user is taken straight to the account.

In the end Solution 2 was chosen in favor over Solution 1.

Neptune – web based lead management / tracking tool – multiple users

Neptune – Lead Tracker has been updated. The latest change to Neptune is the multi user capability. Originally Neptune had just 1 account per user. All users would login to the same account using the same username and password. There was no way to differentiate between users within an account.

The fundamental structure of the user accounts on Neptune within Neptune has changed. Now users create an account and an account can have multiple users within it. Each account has a Administration user which controls the creation, updating and deletion of users within the account.

Visit Neptune here …

www.neptuneleadtracker.com

Users are managed within the Administration screen only accessible to the Administration user …

Neptune user accounts page

This change to Neptune is part of a series of changes leading to a paid version of Neptune. It was decided to make Neptune a paid for product using a monthly subscription model.

This release is expected to go live with the new subscription payment integration within the next couple of weeks.