src/Lib/AuthActions.php
public function isAuthorized($user, $plugin, $controller, $action) {
		$isAuthorized = false;

		if ($plugin) {
			$plugin = Inflector::camelize($plugin);
		}

		if ($this->isPublicAction($plugin, $controller, $action)) {
			$isAuthorized = true;
		} elseif (isset($user['role']) && !empty($controller) && !empty($action)) {
			if ($this->_options['camelizedControllerNames']) {
				$controller = Inflector::camelize($controller);
			} else {
				$controller = Inflector::underscore($controller);
			}

			$key = $controller;
			if (!empty($plugin)) {
				$key = $plugin . '.' . $key;
			}

			if (isset($this->_rightsConfig[$key]['*']) && $this->_rightsConfig[$key]['*'] == '*') {
				$isAuthorized = true;
			} elseif (isset($this->_rightsConfig[$key]['*'])
			&& in_array($user['role'], $this->_rightsConfig[$key]['*'])) {
				$isAuthorized = true;
			} elseif (isset($this->_rightsConfig[$key][$action])
				&& in_array($user['role'], $this->_rightsConfig[$key][$action])) {

				$isAuthorized = true;
			}
		}
		return $isAuthorized;
	}
public function isAuthorized($user, $plugin, $controller, $action) {
		$isAuthorized = false;

		if ($plugin) {
			$plugin = Inflector::camelize($plugin);
		}

		if ($this->isPublicAction($plugin, $controller, $action)) {
			$isAuthorized = true;
		} elseif (isset($user['role']) && !empty($controller) && !empty($action)) {
			if ($this->_options['camelizedControllerNames']) {
				$controller = Inflector::camelize($controller);
			} else {
				$controller = Inflector::underscore($controller);
			}

			$key = $controller;
			if (!empty($plugin)) {
				$key = $plugin . '.' . $key;
			}

			if (isset($this->_rightsConfig[$key]['*']) && $this->_rightsConfig[$key]['*'] == '*') {
				$isAuthorized = true;
			} elseif (isset($this->_rightsConfig[$key]['*'])
			&& in_array($user['role'], $this->_rightsConfig[$key]['*'])) {
				$isAuthorized = true;
			} elseif (isset($this->_rightsConfig[$key][$action])
				&& in_array($user['role'], $this->_rightsConfig[$key][$action])) {

				$isAuthorized = true;
			}
		}
		return $isAuthorized;
	}
Checks whether the user has access to certain controller action

@param array $user user to check
@param string $plugin plugin name or null
@param string $controller controller name
@param string $action action
@return bool