// 获取yii的权限管理对象
$auth = Yii::$app->authManager;
// 添加 "createPost" 权限
$createPost = $auth->createPermission('createPost');
$createPost->description = 'Create a post';
$auth->add($createPost);
// 添加 "updatePost" 权限
$updatePost = $auth->createPermission('updatePost');
$updatePost->description = 'Update post';
$auth->add($updatePost);
// 添加"author"角色，并赋予"createPost"权限
$author = $auth->createRole('author');
$auth->add($author);
$auth->addChild($author, $createPost);
// 添加"admin"角色，并赋予"updatePost"权限
// 同时让"author"角色继承"admin"
$admin = $auth->createRole('admin');
$auth->add($admin);
$auth->addChild($admin, $updatePost);
$auth->addChild($admin, $author);
// 把特定的角色赋给用户
$auth->assign($author, 2);
$auth->assign($admin, 1);

if (\Yii::$app->user->can('updatePost', ['post' => $post])) {
    // update post
}

create table `auth_rule`
(
   `name`                 varchar(64) not null,
   `data`                 blob,
   `created_at`           integer,
   `updated_at`           integer,
    primary key (`name`)
) engine InnoDB;
create table `auth_item`
(
   `name`                 varchar(64) not null,
   `type`                 smallint not null,
   `description`          text,
   `rule_name`            varchar(64),
   `data`                 blob,
   `created_at`           integer,
   `updated_at`           integer,
   primary key (`name`),
   foreign key (`rule_name`) references `auth_rule` (`name`) on delete set null on update cascade,
   key `type` (`type`)
) engine InnoDB;
create table `auth_item_child`
(
   `parent`               varchar(64) not null,
   `child`                varchar(64) not null,
   primary key (`parent`, `child`),
   foreign key (`parent`) references `auth_item` (`name`) on delete cascade on update cascade,
   foreign key (`child`) references `auth_item` (`name`) on delete cascade on update cascade
) engine InnoDB;
create table `auth_assignment`
(
   `item_name`            varchar(64) not null,
   `user_id`              varchar(64) not null,
   `created_at`           integer,
   primary key (`item_name`, `user_id`),
   foreign key (`item_name`) references `auth_item` (`name`) on delete cascade on update cascade
) engine InnoDB;

├── Assignment.php  // 对应auth_assignment表，描述用户与角色的关系
├── BaseManager.php  // 忽略
├── CheckAccessInterface.php // 权限校验接口
├── DbManager.php  // 基于数据库实现的权限校验类
├── Item.php  // Role和Permission的基类
├── ManagerInterface.php // 忽略
├── Permission.php // 权限类
├── PhpManager.php // 忽略
├── Role.php // 角色类
├── Rule.php // 规则类

  /**
   * Performs access check for the specified user.
   * This method is internally called by [[checkAccess()]].
   * @param string|int $user the user ID. This should can be either an integer or a string representing
   * the unique identifier of a user. See [[\yii\web\User::id]].
   * @param string $itemName the name of the operation that need access check
   * @param array $params name-value pairs that would be passed to rules associated
   * with the tasks and roles assigned to the user. A param with name 'user' is added to this array,
   * which holds the value of `$userId`.
   * @param Assignment[] $assignments the assignments to the specified user
   * @return bool whether the operations can be performed by the user.
   */
  protected function checkAccessRecursive($user, $itemName, $params, $assignments)
  {
// 参数分析：user是用户类，itemName是具体要查询的权限名（或者角色名）,ssignments是用户的角色集
      // 获取这个itemName对应的数据，可能是role，也可能是permission
      if (($item = $this->getItem($itemName)) === null) {
          return false;
      }
      Yii::trace($item instanceof Role ? "Checking role: $itemName" : "Checking permission: $itemName", __METHOD__);
// 暂时先忽略对rule的考虑
      if (!$this->executeRule($user, $item, $params)) {
          return false;
      }
// 角色名是否在用户的assignment里面，或者在系统的默认角色列表里面
      if (isset($assignments[$itemName]) || in_array($itemName, $this->defaultRoles)) {
          return true;
      }
// 构造查询函数对象
      $query = new Query;
      $parents = $query->select(['parent'])
          ->from($this->itemChildTable)
          ->where(['child' => $itemName])
          ->column($this->db);
// 递归查询
      foreach ($parents as $parent) {
          if ($this->checkAccessRecursive($user, $parent, $params, $assignments)) {
              return true;
          }
      }
      return false;
  }

if (\Yii::$app->user->can('updatePost', ['post' => $post])) {
    // update post
}

$auth = Yii::$app->authManager;
// add the rule
$rule = new \app\rbac\AuthorRule;
$auth->add($rule);
// add the "updateOwnPost" permission and associate the rule with it.
$updateOwnPost = $auth->createPermission('updateOwnPost');
$updateOwnPost->description = 'Update own post';
$updateOwnPost->ruleName = $rule->name;
$auth->add($updateOwnPost);
// "updateOwnPost" will be used from "updatePost"
$auth->addChild($updateOwnPost, $updatePost);
// allow "author" to update their own posts
$auth->addChild($author, $updateOwnPost);