title: Yii2 - Override checkAccess in rest ActiveController
body: <pre><code>Product.supplierID = Supplier.supplierID
  ---------         ----------
  |Product|---------|Supplier|
  ---------         ----------
                         |
                         |  Supplier.supplierID = User.supplierID
                         |
                     ---------
                     |  User |
                     ---------
  </code></pre>
  
  <p>Using the above table structure, the application uses sub-classes of <code>ActiveController</code>, with overridden <code>prepareDataProvider</code> to limit the <code>index</code> list of each <code>Product</code> a logged in <code>User</code> can see to those with matching <code>supplierID</code> values. Something like this in the <code>actions()</code> method of <code>ProductController</code>.</p>
  
  <pre><code>$actions['index']['prepareDataProvider'] = function($action)
  {
      $query = Product::find();
      if (Yii::$app-&gt;user-&gt;can('supplier') &amp;&amp;
          Yii::$app-&gt;user-&gt;identity-&gt;supplierID) {
          $query-&gt;andWhere(['supplierID' =&gt; Yii::$app-&gt;user-&gt;identity-&gt;supplierID]);
      }
      return new ActiveDataProvider(['query' =&gt; $query]);
  };
  </code></pre>
  
  <p>This works fine, however I'm looking to use <code>checkAccess()</code> to limit <code>actionView()</code> for a single <code>Product</code>. </p>
  
  <p>At the moment, a logged in <code>User</code> can access a <code>Product</code> by changing the <code>productID</code> in the URL, whether or not the have the appropriate <code>supplierID</code>.</p>
  
  <p>It looks like I can't access the particular instance of <code>Product</code>, to check the <code>supplierID</code>, until <code>actionView()</code> has returned which is when I want the check to happen.</p>
  
  <p>Can I override <code>checkAccess()</code> to restrict access and throw the appropriate <code>ForbiddenHttpException</code>? </p>