How to correctly verify access and authorization?

Hello. I've encryption algo to create custom user string for user session cookie. It's very simple, and the cookie string has the format: ID.USERHASH.

And I've code such this for do my task.

// smth..

class AuthAccess
 {
    private $config;

    public function __construct($config)
    {
        $this->config = $config;
    }

    private function getAuthCookie()
    {
        return $this->cookies->get("USER_COOKIE");
    }

    private function createToken($userId) {
        // Encode token
        $data = $userId.$this->config->secret;

        $user = Users::findFirstById($userId);

        if ($user) {
            $hash   = hash_hmac("sha256", $data, $user->secretString);

            $user_token = $userId.".".$hash;
            $user_level = $user->level;
        }

        return [
            "token" => $user_token,
            "level" => $user_level,
        ];
    }

    public function checkAccess()
    {
        $token = $this->getAuthCookie();

        // hash.user_id
        if (!empty($token) && $token != "") {
            $split_token = explode(".", $token);

            $userId = $split_token[0];
            $hash  = $split_token[1];

            // Is the cookie valid?
            if ($expr >= $this->getTime()) {
                $rightToken = $this->createToken($userId);

                if ($token === $rightToken["token"]) {
                    return $rightToken["level"];
                }
            }
        }

        return false;
    }

    // ACL Checls, etc.
}

But how can I do this right with such checks, acl and etc.? Make it so that you can avoid duplication of code and dubious links. Use components or plugins?

Tell me, if I incorrectly described the problem, and I'll describe it more correctly. Thanks a lot!