Handle permissions from login action with Session - session

Question

I'm building a cakePHP application where students can just manage their own data(like a profile).
My idea to deny the access to other students to the 'view' action is this:
(students_controller.php)
function view($id = null) {
//We check the permissions so a student cannot browse other student's pages
$studentid=$this->Student->field('id',array('user_id'=>$this->Session->read('Auth.User.id')));
if (!$id) {
$this->Session->setFlash(__('Invalid student', true));
$this->redirect(array('action' => 'add'));
}
if ($this->Auth->user('id') <> ($this->data['Student']['user_id'])){
$this->Session->setFlash(__('You are not authorized to access this page,not allowed', true));
$this->redirect(array('controller' => 'users','action' => 'logout'));
}
$this->set('student', $this->Student->read(null, $id));
}
The problem comes (I guess) because in my login action I have this code:
(users_controller.php)
function login() {
$studentid= $this->User->Student->field('id',array('user_id'=>$this->Session->read('Auth.User.id')));
$studentformactivated=$this->User->Student->field('form_activated',array('user_id'=>$this->Session->read('Auth.User.id')));
if ($this->Session->read('Auth.User') ) {
if($this->Session->read('Auth.User.group_id') == '1')
$this->redirect(array('controller'=>'specializations', 'action' => 'index'));
else if ($this->Session->read('Auth.User.group_id') == '2')
$this->redirect(array('controller'=>'specializations', 'action' => 'index'));
else if ($this->Session->read('Auth.User.group_id') == '3')
if ($studentformactivated == '1')
$this->redirect(array('controller'=>'students', 'action' => 'view',$studentid));
else
$this->redirect(array('controller'=>'students', 'action' => 'add'));
$this->Session->setFlash('You are logged in!');
$this->redirect('/', null, false);
}
}
So, everytime a student logs in is redirected to the 'view' action (if the 'add' action was done), and in the view action we are taking information from the session, and it seems while doing login action we cannot take this information ( the sql log says SELECT Student.id FROM students AS Student WHERE user_id IS NULL LIMIT 1, so it's not getting user_id).
Now , the questions:
First of all, I would like to know what do you think about this way of managing the permission control, because it's the first time I do it and maybe there are other simpler ways to do it.
Am I right supposing that I cannot take information from the User Session just after login action?
Would it be a good solution to do in the view function something like :
if (user_is_logged_in){
if ($this->Auth->user('id') <> ($this->data['Student']['user_id'])){
$this->Session->setFlash(__('You are not authorized to access this page,not allowed', true));
$this->redirect(array('controller' => 'users','action' => 'logout'));
}
}
It's the only thing I see to solve it. But I tried with ($this->Session->check('Auth.User')) for the (user_is_logged_in) condition and it didn't work...
Thank you in advance!
ALf.
-----------------------------------------EDIT-------------------------------
After discussing it, the solution seems to be adding the code to the AppController beforeFilter. It's not redirecting well still, maybe it is because of the arguments passed? I ran out of ideas...
function beforeFilter($id = null) {
//Configure AuthComponent
$this->Auth->authorize = 'actions';
$this->Auth->loginAction = array('controller' => 'users', 'action' => 'login');
$this->Auth->logoutRedirect = array('controller' => 'users', 'action' => 'login');
$this->Auth->loginRedirect = array('controller' => 'students', 'action' => 'add');
$this->Auth->actionPath = 'controllers/';
$this->Auth->allowedActions = array('display');
if( $this->Auth->User('id') != $id ) // bad, redirect them to safe page
$this->redirect(array('controller' => 'users','action' => 'logout'));
}

Answer 1

Assuming the profile is the the Student model, why can't you just do this?
class StudentsController extends Model {
function view( $id = null ) {
if( $this->Auth->User('id') != $id ) // bad, redirect them to safe page
$this->redirect( '/badaccess/denied' );
}
}
Since $id is the id of the student profile, just check it against the id of the logged in user.

Answer 2

not sure if this will help, but i'm currently working on a system that required extra info be available at login. in my case it was from the same users table (just extra fields) but may work with other tables/models. i would assume you would have to put a var $uses = array('User, 'Student'); at the top to do this.
in the users controller i have the following:
function login(){
...
$this->Session->write('Auth.User.type', $this->User->field('type'));
$this->Session->write('Auth.User.isapproved',
$this->User->field('isapproved'));
...
}
obviously, you'd have to change these to something like
$this->Session->write('Auth.User.student_id',
$this->User->Student->field('id',array('user_id'=>$this->User->field('id')));
or something along those lines
then you should be able to access it by if( $this->Auth->User('student_id') != $id ), similar to the answer above.
not sure if this will work or not as i'm currently looking up suggestions to my own problem when i stumbled on this, so i don't have time to try to see if i've done it right :)