| 1 |
|
<?php |
| 2 |
|
|
| 3 |
|
/** |
| 4 |
|
* Xyster Framework |
| 5 |
|
* |
| 6 |
|
* This source file is subject to the new BSD license that is bundled |
| 7 |
|
* with this package in the file LICENSE.txt. |
| 8 |
|
* It is also available through the world-wide-web at this URL: |
| 9 |
|
* http://www.opensource.org/licenses/bsd-license.php |
| 10 |
|
* |
| 11 |
|
* @category Xyster |
| 12 |
|
* @package Xyster_Acl |
| 13 |
|
* @copyright Copyright LibreWorks, LLC (http://libreworks.net) |
| 14 |
|
* @license http://www.opensource.org/licenses/bsd-license.php New BSD License |
| 15 |
|
* @version $Id: Acl.php 418 2010-10-18 21:40:08Z jonathanhawk $ |
| 16 |
|
*/ |
| 17 |
|
namespace Xyster\Acl; |
| 18 |
|
/** |
| 19 |
|
* An access control list that can dynamically build its own rules |
| 20 |
|
* |
| 21 |
|
* @category Xyster |
| 22 |
|
* @package Xyster_Acl |
| 23 |
|
* @copyright Copyright LibreWorks, LLC (http://libreworks.net) |
| 24 |
|
* @license http://www.opensource.org/licenses/bsd-license.php New BSD License |
| 25 |
|
*/ |
| 26 |
|
class Acl extends \Zend_Acl |
| 27 |
1 |
{ |
| 28 |
|
/** |
| 29 |
|
* The authorizers |
| 30 |
|
* |
| 31 |
|
* @var IAuthorizer[] |
| 32 |
|
*/ |
| 33 |
|
protected $_authorizers = array(); |
| 34 |
|
|
| 35 |
|
/** |
| 36 |
|
* Adds an authorizer to the ACL |
| 37 |
|
* |
| 38 |
|
* @param IAuthorizer $authorizer |
| 39 |
|
* @return Acl provides a fluent interface |
| 40 |
|
*/ |
| 41 |
|
public function addAuthorizer(IAuthorizer $authorizer) |
| 42 |
|
{ |
| 43 |
3 |
if (!in_array($authorizer, $this->_authorizers, true)) { |
| 44 |
3 |
$this->_authorizers[] = $authorizer; |
| 45 |
3 |
} |
| 46 |
3 |
return $this; |
| 47 |
|
} |
| 48 |
|
|
| 49 |
|
/** |
| 50 |
|
* Throws an exception if the Role is denied access to the Resource |
| 51 |
|
* |
| 52 |
|
* @param Zend_Acl_Role_Interface|string $role |
| 53 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 54 |
|
* @param string $privilege |
| 55 |
|
* @throws Zend_Acl_Exception |
| 56 |
|
*/ |
| 57 |
|
public function assertAllowed($role = null, $resource = null, $privilege = null) |
| 58 |
|
{ |
| 59 |
2 |
if ($this->isAllowed($role, $resource, $privilege)) { |
| 60 |
1 |
return true; |
| 61 |
|
} |
| 62 |
|
|
| 63 |
1 |
$msg = 'Insufficient permissions: '; |
| 64 |
1 |
$msg .= ( $role instanceof \Zend_Acl_Role_Interface ) ? |
| 65 |
1 |
$role->getRoleId() : $role; |
| 66 |
1 |
$msg .= ' -> '; |
| 67 |
1 |
$msg .= ( $resource instanceof \Zend_Acl_Resource_Interface ) ? |
| 68 |
1 |
$resource->getResourceId() : $resource; |
| 69 |
1 |
if ($privilege) { |
| 70 |
1 |
$msg .= ' (' . $privilege . ')'; |
| 71 |
1 |
} |
| 72 |
|
|
| 73 |
1 |
throw new \Zend_Acl_Exception($msg); |
| 74 |
|
} |
| 75 |
|
|
| 76 |
|
/** |
| 77 |
|
* Gets the authorizer for a resource |
| 78 |
|
* |
| 79 |
|
* If more than one authorizer applies to a resource, only the first is |
| 80 |
|
* returned (in the order in which they were added. First in, first out). |
| 81 |
|
* |
| 82 |
|
* If none apply, null is returned. |
| 83 |
|
* |
| 84 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 85 |
|
* @return IAuthorizer |
| 86 |
|
*/ |
| 87 |
|
public function getAuthorizer($resource = null) |
| 88 |
|
{ |
| 89 |
10 |
$resource = ( $resource !== null ) ? $this->get($resource) : null; |
| 90 |
10 |
$return = null; |
| 91 |
|
|
| 92 |
10 |
if ($resource !== null) { |
| 93 |
10 |
foreach ($this->_authorizers as $authorizer) { |
| 94 |
|
/* @var $authorizer IAuthorizer */ |
| 95 |
3 |
if ($authorizer->applies($resource)) { |
| 96 |
3 |
$return = $authorizer; |
| 97 |
3 |
} |
| 98 |
10 |
} |
| 99 |
10 |
} |
| 100 |
|
|
| 101 |
10 |
return $return; |
| 102 |
|
} |
| 103 |
|
|
| 104 |
|
/** |
| 105 |
|
* Returns true if and only if the Role has access to the Resource |
| 106 |
|
* |
| 107 |
|
* {@inherit} |
| 108 |
|
* |
| 109 |
|
* @param Zend_Acl_Role_Interface|string $role |
| 110 |
|
* @param Zend_Acl_Resource_Interface|string $resource |
| 111 |
|
* @param string $privilege |
| 112 |
|
* @return boolean |
| 113 |
|
*/ |
| 114 |
|
public function isAllowed($role = null, $resource = null, $privilege = null) |
| 115 |
|
{ |
| 116 |
9 |
$role = ( $role !== null ) ? $this->getRole($role) : null; |
| 117 |
9 |
$resource = ( $resource !== null ) ? $this->get($resource) : null; |
| 118 |
|
|
| 119 |
9 |
if ($this->_getRuleType($resource, $role, $privilege) === null) { |
| 120 |
9 |
if ($authorizer = $this->getAuthorizer($resource)) { |
| 121 |
2 |
$allowed = $authorizer->isAllowed($role, $resource, $privilege); |
| 122 |
|
|
| 123 |
2 |
if ($allowed) { |
| 124 |
1 |
$this->allow($role, $resource, $privilege); |
| 125 |
1 |
} else { |
| 126 |
1 |
$this->deny($role, $resource, $privilege); |
| 127 |
|
} |
| 128 |
|
|
| 129 |
2 |
return $allowed; |
| 130 |
|
} |
| 131 |
7 |
} |
| 132 |
9 |
return parent::isAllowed($role, $resource, $privilege); |
| 133 |
|
} |
| 134 |
1 |
} |
