Magento ACL recursive permissions?

Question

I have a module that adds a new menu in the backend. I have the acls defined and they work:

 <acl>
    <resources>
        <admin>
            <children>
                <module translate="title" module="module">
                    <title>module</title>
                    <sort_order>1000</sort_order>
                    <children>
                        <sub_a translate="title">
                            <title>sub 1</title>
                        </sub_a>
                        <sub_b>
                            <title>sub_b</title>
                        </sub_b>
                       ....
                    </children>
                </module>
            </children>
        </admin>
    </resources>
</acl>

This works. I also add custom menu options using PHP, depending on conditions (at the location of the dots). If I add acls for them too, this also works.

But I don't need all this acls! Is there a way to allow all the children of module? The XML should look something like this:

 <acl>
    <resources>
        <admin>
            <children>
                <module translate="title" module="module">
                    <title>module</title>
                    <sort_order>1000</sort_order>
                </module>
            </children>
        </admin>
    </resources>
</acl>

But all the children should be allowed!

So instead of many checkboxes for the permission configuration, I want a single checkbox.

If I use the second xml, only the topmost menu option is visible in the backend and the whole submenu is hidden.

How can I keep the submenu visible without creating a acl rule for every menu option?

Answer 1

If you look at how the admin menu is built in Mage_Adminhtml_Block_Page_Menu, you will notice, that the full menu path is only used as ACL resource, if the menu item does not have a resource specified:

protected function _buildMenuArray(Varien_Simplexml_Element $parent=null, $path='', $level=0)
{
    ...
    foreach ($parent->children() as $childName => $child) {
        ...
        $aclResource = 'admin/' . ($child->resource ? (string)$child->resource : $path . $childName);
        if (!$this->_checkAcl($aclResource) || !$this->_isEnabledModuleOutput($child)) {
            continue;
        }
        ...
    }
    ...
    return $parentArr;
}

So, you can create your menu like this:

<menu>
    <module>
        <children>
            <sub_a translate="title" module="module">
                <title>module</title>
                <action>...</action>
                <sort_order>1000</sort_order>
                <resource>module</resource>
            </sub_a>
            <sub_b translate="title" module="module">
                <title>module</title>
                <action>...</action>
                <sort_order>2000</sort_order>
                <resource>module</resource>
            </sub_a>
        </children>
    </module>
</menu>

Then use the ACL exactly as you described it.