Authorization with rbac yii - yii

Question

I am trying to understand authorization in rbac and getting confused a bit with a couple of things.
In the accessControl rules i am using roles as such:
return array(
array('allow', // allow all users to perform 'index' and 'view' actions
'actions'=>array('index', 'view'),
'roles'=>array('user'),
),
array('allow', // allow authenticated user to perform 'create' and 'update' actions
'actions'=>array('create','update'),
'roles'=>array('author'),
),
array('allow', // allow admin user to perform 'admin' and 'delete' actions
'actions'=>array('admin','delete'),
'roles'=>array('admin'),
),
array('deny', // deny all users
'users'=>array('*'),
),
);
I am also using the following setup :
$auth = Yii::app()->authManager;
$auth->createOperation('createPost', 'create a post');
$auth->createOperation('readPost', 'Read a post');
$auth->createOperation('updatePost', 'update a post');
$auth->createOperation('deletePost', 'delete a post');
$role = $auth->createRole('user');
$role->addChild('readPost');
$role = $auth->createRole('author');
$role->addChild('user');
$role->addChild('createPost');
$role = $auth->createRole('admin');
$role->addChild('author');
$role->addChild('updatePost');
$role->addChild('deletePost');
$auth->assign('user', 3);
$auth->assign('author', 2);
$auth->assign('admin', 1);
$auth->save();
There are 4 different operations with names (createPost, deletePost , readPost, udpatePost). However in the controller the action names are different such as actionIndex, actionView, actionCreate, actionDelete, actionUpdate and actionAdmin.
Questions:
How are operations being mapped to controller actions.
Should more operations be created such as IndexPost, ViewPost etc ..?
While using rbac, should we still keep the accesscontrol filter and rules as I have done here?
I am not sure if I am doing it right. Lots of confusion and lost. Please shed some light. Cheers.

Answer 1

They aren't being mapped, in each action you need to check this manually
if (Yii::app()->authManager->checkAccess('updatePost'))
thorow new HttpException(404);
Your can create IndexPost, ViewPost if some user can't see these actions.
In accessControl you can keep only check that user is logged, when it's needed.
For more information check this articles: Simple RBAC, Getting to Understand Hierarchical RBAC Scheme