| 1 |
|
<?php |
| 2 |
|
/** |
| 3 |
|
* Xyster Framework |
| 4 |
|
* |
| 5 |
|
* This source file is subject to the new BSD license that is bundled |
| 6 |
|
* with this package in the file LICENSE.txt. |
| 7 |
|
* It is also available through the world-wide-web at this URL: |
| 8 |
|
* http://www.opensource.org/licenses/bsd-license.php |
| 9 |
|
* |
| 10 |
|
* @category Xyster |
| 11 |
|
* @package Xyster_Acl |
| 12 |
|
* @copyright Copyright (c) 2007-2008 Irrational Logic (http://irrationallogic.net) |
| 13 |
|
* @license http://www.opensource.org/licenses/bsd-license.php New BSD License |
| 14 |
|
* @version $Id: Acl.php 202 2008-01-20 16:20:09Z doublecompile $ |
| 15 |
|
*/ |
| 16 |
|
/** |
| 17 |
|
* Zend_Acl |
| 18 |
|
*/ |
| 19 |
1 |
require_once 'Zend/Acl.php'; |
| 20 |
|
/** |
| 21 |
|
* An access control list that can dynamically build its own rules |
| 22 |
|
* |
| 23 |
|
* @category Xyster |
| 24 |
|
* @package Xyster_Acl |
| 25 |
|
* @copyright Copyright (c) 2007-2008 Irrational Logic (http://irrationallogic.net) |
| 26 |
|
* @license http://www.opensource.org/licenses/bsd-license.php New BSD License |
| 27 |
|
*/ |
| 28 |
|
class Xyster_Acl extends Zend_Acl |
| 29 |
|
{ |
| 30 |
|
/** |
| 31 |
|
* The authorizers |
| 32 |
|
* |
| 33 |
|
* @var Xyster_Acl_Authorizer_Interface[] |
| 34 |
|
*/ |
| 35 |
|
protected $_authorizers = array(); |
| 36 |
|
|
| 37 |
|
/** |
| 38 |
|
* Adds an authorizer to the ACL |
| 39 |
|
* |
| 40 |
|
* @param Xyster_Acl_Authorizer_Interface $authorizer |
| 41 |
|
* @return Xyster_Acl provides a fluent interface |
| 42 |
|
*/ |
| 43 |
|
public function addAuthorizer( Xyster_Acl_Authorizer_Interface $authorizer ) |
| 44 |
|
{ |
| 45 |
3 |
if ( !in_array($authorizer, $this->_authorizers, true) ) { |
| 46 |
3 |
$this->_authorizers[] = $authorizer; |
| 47 |
3 |
} |
| 48 |
3 |
return $this; |
| 49 |
|
} |
| 50 |
|
|
| 51 |
|
/** |
| 52 |
|
* Throws an exception if the Role is denied access to the Resource |
| 53 |
|
* |
| 54 |
|
* @param Zend_Acl_Role_Interface|string $role |
| 55 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 56 |
|
* @param string $privilege |
| 57 |
|
* @throws Zend_Acl_Exception |
| 58 |
|
*/ |
| 59 |
|
public function assertAllowed($role = null, $resource = null, $privilege = null) |
| 60 |
|
{ |
| 61 |
2 |
if ( $this->isAllowed($role, $resource, $privilege) ) { |
| 62 |
1 |
return true; |
| 63 |
0 |
} |
| 64 |
|
|
| 65 |
1 |
$msg = 'Insufficient permissions: '; |
| 66 |
1 |
$msg .= ( $role instanceof Zend_Acl_Role_Interface ) ? |
| 67 |
1 |
$role->getRoleId() : $role; |
| 68 |
1 |
$msg .= ' -> '; |
| 69 |
1 |
$msg .= ( $resource instanceof Zend_Acl_Resource_Interface ) ? |
| 70 |
1 |
$resource->getResourceId() : $resource; |
| 71 |
1 |
if ( $privilege ) { |
| 72 |
1 |
$msg .= ' (' . $privilege . ')'; |
| 73 |
1 |
} |
| 74 |
|
|
| 75 |
1 |
require_once 'Zend/Acl/Exception.php'; |
| 76 |
1 |
throw new Zend_Acl_Exception($msg); |
| 77 |
|
} |
| 78 |
|
|
| 79 |
|
/** |
| 80 |
|
* Gets the authorizer for a resource |
| 81 |
|
* |
| 82 |
|
* If more than one authorizer applies to a resource, only the first is |
| 83 |
|
* returned (in the order in which they were added. First in, first out). |
| 84 |
|
* |
| 85 |
|
* If none apply, null is returned. |
| 86 |
|
* |
| 87 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 88 |
|
* @return Xyster_Acl_Authorizer_Interface |
| 89 |
|
*/ |
| 90 |
|
public function getAuthorizer($resource = null) |
| 91 |
|
{ |
| 92 |
10 |
$resource = ( $resource !== null ) ? $this->get($resource) : null; |
| 93 |
10 |
$return = null; |
| 94 |
|
|
| 95 |
10 |
if ( $resource !== null ) { |
| 96 |
10 |
foreach( $this->_authorizers as $authorizer ) { |
| 97 |
|
/* @var $authorizer Xyster_Acl_Authorizer_Interface */ |
| 98 |
3 |
if ( $authorizer->applies($resource) ) { |
| 99 |
3 |
$return = $authorizer; |
| 100 |
3 |
} |
| 101 |
3 |
} |
| 102 |
10 |
} |
| 103 |
|
|
| 104 |
10 |
return $return; |
| 105 |
|
} |
| 106 |
|
|
| 107 |
|
/** |
| 108 |
|
* Returns true if and only if the Role has access to the Resource |
| 109 |
|
* |
| 110 |
|
* {@inherit} |
| 111 |
|
* |
| 112 |
|
* @param Zend_Acl_Role_Interface|string $role |
| 113 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 114 |
|
* @param string $privilege |
| 115 |
|
* @return boolean |
| 116 |
|
*/ |
| 117 |
|
public function isAllowed($role = null, $resource = null, $privilege = null) |
| 118 |
|
{ |
| 119 |
9 |
$role = ( $role !== null ) ? $this->getRole($role) : null; |
| 120 |
9 |
$resource = ( $resource !== null ) ? $this->get($resource) : null; |
| 121 |
|
|
| 122 |
9 |
if ( $this->_getRuleType($resource, $role, $privilege) === null ) { |
| 123 |
9 |
if ( $authorizer = $this->getAuthorizer($resource) ) { |
| 124 |
2 |
$allowed = $authorizer->isAllowed($role, $resource, $privilege); |
| 125 |
|
|
| 126 |
2 |
if ( $allowed ) { |
| 127 |
1 |
$this->allow($role, $resource, $privilege); |
| 128 |
1 |
} else { |
| 129 |
1 |
$this->deny($role, $resource, $privilege); |
| 130 |
|
} |
| 131 |
|
|
| 132 |
2 |
return $allowed; |
| 133 |
0 |
} |
| 134 |
7 |
} |
| 135 |
|
|
| 136 |
9 |
return parent::isAllowed($role, $resource, $privilege); |
| 137 |
|
} |
| 138 |
|
} |
