{"record":{"id":"c2eac33acb8a5e53","repo":"phalcon/cphalcon","slug":"authenticated-user-does-not-implement-phalcon-acl","errorCode":null,"errorMessage":"Authenticated user does not implement 'Phalcon\\Acl\\RoleAwareInterface'","messagePattern":"Authenticated user does not implement 'Phalcon\\\\Acl\\\\RoleAwareInterface'","errorType":"exception","errorClass":"Phalcon\\Auth\\Exceptions\\DoesNotImplement","httpStatus":null,"severity":"error","filePath":"phalcon/Auth/Access/Acl.zep","lineNumber":133,"sourceCode":"\n    /**\n     * @throws Exception\n     */\n    protected function resolveRole(<Guard> guard) -> string\n    {\n        var user;\n\n        let user = guard->user();\n\n        if (user === null) {\n            return this->guestRole;\n        }\n\n        if (user instanceof RoleAwareInterface) {\n            return user->getRoleName();\n        }\n\n        throw new DoesNotImplement(\n            \"Authenticated user\",\n            RoleAwareInterface::class\n        );\n    }\n}\n","sourceCodeStart":115,"sourceCodeEnd":139,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Auth/Access/Acl.zep#L115-L139","documentation":"To run an ACL check the Acl access gate needs the authenticated user's role, obtained by calling getRoleName() from Phalcon\\Acl\\RoleAwareInterface on the guard's user object (a null user maps to the configured guest role). If the returned user implements neither the interface nor null, the gate throws DoesNotImplement naming 'Authenticated user' and the interface.","triggerScenarios":"The auth guard returns a logged-in user object that is not an instance of Phalcon\\Acl\\RoleAwareInterface — e.g. an entity from a custom user provider, a stdClass/array-based user, or a third-party identity class — on the first access check.","commonSituations":"Plugging an existing user model into the new Auth component without adding the interface; a guard whose user() returns a DTO; partially migrated codebases where only some user classes were adapted.","solutions":["Implement the interface on your user class: `public function getRoleName(): string { return $this->role; }`","Make sure the guard actually returns that class (and null when unauthenticated, which resolves to guestRole)","If you cannot change the model, wrap the user in a small RoleAware decorator before it reaches the guard"],"exampleFix":"// before\nclass User extends Model {}\n// after\nclass User extends Model implements \\Phalcon\\Acl\\RoleAwareInterface\n{\n    public function getRoleName(): string\n    {\n        return $this->role; // e.g. 'admins'\n    }\n}","handlingStrategy":"type-guard","validationCode":"if ($guard->user() !== null && !$guard->user() instanceof \\Phalcon\\Acl\\RoleAwareInterface) {\n    throw new InvalidArgumentException('User class must implement RoleAwareInterface to use the Acl gate');\n}","typeGuard":"function isRoleAwareUser(mixed $user): bool\n{\n    return $user === null || $user instanceof \\Phalcon\\Acl\\RoleAwareInterface;\n}","tryCatchPattern":"try {\n    $allowed = $access->isAllowed($guard, $actionName, $context);\n} catch (\\Phalcon\\Auth\\Exceptions\\DoesNotImplement $e) {\n    $logger->error('Auth user model lacks RoleAwareInterface: ' . $e->getMessage());\n    throw $e;\n}","preventionTips":["Implement Phalcon\\Acl\\RoleAwareInterface::getRoleName() on every user class the guard can return","Add a boot-time assertion that the configured user model implements the interface","Keep guards returning null when unauthenticated so the guestRole path is used"],"tags":["auth","acl","interface","user-model"],"backgroundTag":"interface-not-implemented","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}