1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace PhpAbac; |
4
|
|
|
|
5
|
|
|
use PhpAbac\Manager\AttributeManager; |
6
|
|
|
use PhpAbac\Manager\PolicyRuleManager; |
7
|
|
|
use PhpAbac\Manager\ConfigurationManager; |
8
|
|
|
use PhpAbac\Manager\CacheManager; |
9
|
|
|
use PhpAbac\Manager\ComparisonManager; |
10
|
|
|
|
11
|
|
|
use Symfony\Component\Config\FileLocator; |
12
|
|
|
|
13
|
|
|
use PhpAbac\Model\PolicyRuleAttribute; |
14
|
|
|
|
15
|
|
|
class Abac |
16
|
|
|
{ |
17
|
|
|
/** @var \PhpAbac\Manager\ConfigurationManager **/ |
18
|
|
|
private $configuration; |
19
|
|
|
/** @var \PhpAbac\Manager\PolicyRuleManager **/ |
20
|
|
|
private $policyRuleManager; |
21
|
|
|
/** @var \PhpAbac\Manager\AttributeManager **/ |
22
|
|
|
private $attributeManager; |
23
|
|
|
/** @var \PhpAbac\Manager\CacheManager **/ |
24
|
|
|
private $cacheManager; |
25
|
|
|
/** @var \PhpAbac\Manager\ComparisonManager **/ |
26
|
|
|
private $comparisonManager; |
27
|
|
|
|
28
|
|
|
/** |
29
|
|
|
* @param array $configPaths |
30
|
|
|
* @param array $options |
31
|
|
|
*/ |
32
|
1 |
|
public function __construct($configPaths, $options = []) |
33
|
|
|
{ |
34
|
1 |
|
$this->configure($configPaths); |
35
|
1 |
|
$this->attributeManager = new AttributeManager($this->configuration->getAttributes()); |
36
|
1 |
|
$this->policyRuleManager = new PolicyRuleManager($this->attributeManager, $this->configuration->getRules()); |
37
|
1 |
|
$this->cacheManager = new CacheManager($options); |
38
|
1 |
|
$this->comparisonManager = new ComparisonManager($this->attributeManager); |
39
|
1 |
|
} |
40
|
|
|
|
41
|
|
|
/** |
42
|
|
|
* @param array $configPaths |
43
|
|
|
*/ |
44
|
1 |
|
public function configure($configPaths) { |
45
|
1 |
|
$locator = new FileLocator($configPaths); |
46
|
1 |
|
$this->configuration = new ConfigurationManager($locator); |
47
|
1 |
|
$this->configuration->parseConfigurationFile($configPaths); |
48
|
1 |
|
} |
49
|
|
|
|
50
|
|
|
/** |
51
|
|
|
* Return true if both user and object respects all the rules conditions |
52
|
|
|
* If the objectId is null, policy rules about its attributes will be ignored |
53
|
|
|
* In case of mismatch between attributes and expected values, |
54
|
|
|
* an array with the concerned attributes slugs will be returned. |
55
|
|
|
* |
56
|
|
|
* Available options are : |
57
|
|
|
* * dynamic_attributes: array |
58
|
|
|
* * cache_result: boolean |
59
|
|
|
* * cache_ttl: integer |
60
|
|
|
* * cache_driver: string |
61
|
|
|
* |
62
|
|
|
* Available cache drivers are : |
63
|
|
|
* * memory |
64
|
|
|
* |
65
|
|
|
* @param string $ruleName |
66
|
|
|
* @param object $user |
67
|
|
|
* @param object $resource |
68
|
|
|
* @param array $options |
69
|
|
|
* @return boolean|array |
70
|
|
|
*/ |
71
|
1 |
|
public function enforce($ruleName, $user, $resource = null, $options = []) { |
72
|
|
|
// If there is dynamic attributes, we pass them to the comparison manager |
73
|
|
|
// When a comparison will be performed, the passed values will be retrieved and used |
74
|
1 |
|
if(isset($options['dynamic_attributes'])) { |
|
|
|
|
75
|
1 |
|
$this->comparisonManager->setDynamicAttributes($options['dynamic_attributes']); |
76
|
|
|
} |
77
|
|
|
// Retrieve cache value for the current rule and values if cache item is valid |
78
|
1 |
|
if(($cacheResult = isset($options['cache_result']) && $options['cache_result'] === true) === true) { |
|
|
|
|
79
|
|
|
$cacheItem = $this->cacheManager->getItem( |
80
|
|
|
"$ruleName-{$user->getId()}-" . (($resource !== null) ? $resource->getId() : ''), |
81
|
|
|
(isset($options['cache_driver'])) ? $options['cache_driver'] : null, |
82
|
|
|
(isset($options['cache_ttl'])) ? $options['cache_ttl'] : null |
83
|
|
|
); |
84
|
|
|
// We check if the cache value s valid before returning it |
85
|
|
|
if(($cacheValue = $cacheItem->get()) !== null) { |
|
|
|
|
86
|
|
|
return $cacheValue; |
87
|
|
|
} |
88
|
|
|
} |
89
|
1 |
|
$policyRule = $this->policyRuleManager->getRule($ruleName, $user, $resource); |
|
|
|
|
90
|
|
|
// For each policy rule attribute, we retrieve the attribute value and proceed configured extra data |
91
|
1 |
|
foreach ($policyRule->getPolicyRuleAttributes() as $pra) { |
92
|
1 |
|
$attribute = $pra->getAttribute(); |
93
|
1 |
|
$attribute->setValue($this->attributeManager->retrieveAttribute($attribute, $user, $resource)); |
94
|
1 |
|
if(count($pra->getExtraData()) > 0) { |
|
|
|
|
95
|
1 |
|
$this->processExtraData($pra, $user, $resource); |
|
|
|
|
96
|
|
|
} |
97
|
1 |
|
$this->comparisonManager->compare($pra); |
98
|
|
|
} |
99
|
|
|
// The given result could be an array of rejected attributes or true |
100
|
|
|
// True means that the rule is correctly enforced for the given user and resource |
101
|
1 |
|
$result = $this->comparisonManager->getResult(); |
102
|
1 |
|
if($cacheResult) { |
|
|
|
|
103
|
|
|
$cacheItem->set($result); |
|
|
|
|
104
|
|
|
$this->cacheManager->save($cacheItem); |
105
|
|
|
} |
106
|
1 |
|
return $result; |
107
|
|
|
} |
108
|
|
|
|
109
|
|
|
/** |
110
|
|
|
* @param \PhpAbac\Model\PolicyRuleAttribute $pra |
111
|
|
|
* @param object $user |
112
|
|
|
* @param object $resource |
113
|
|
|
*/ |
114
|
1 |
|
public function processExtraData(PolicyRuleAttribute $pra, $user, $resource) { |
115
|
1 |
|
foreach($pra->getExtraData() as $key => $data) { |
|
|
|
|
116
|
|
|
switch($key) { |
|
|
|
|
117
|
1 |
|
case 'with': |
118
|
|
|
// This data has to be removed for it will be stored elsewhere |
119
|
|
|
// in the policy rule attribute |
120
|
1 |
|
$pra->removeExtraData('with'); |
121
|
|
|
// The "with" extra data is an array of attributes, which are objects |
122
|
|
|
// Once we process it as policy rule attributes, we set it as the main policy rule attribute value |
123
|
1 |
|
$subPolicyRuleAttributes = []; |
124
|
1 |
|
$extraData = []; |
|
|
|
|
125
|
|
|
|
126
|
1 |
|
foreach($this->policyRuleManager->processRuleAttributes($data, $user, $resource) as $subPolicyRuleAttribute) { |
|
|
|
|
127
|
1 |
|
$subPolicyRuleAttributes[] = $subPolicyRuleAttribute; |
128
|
|
|
} |
129
|
1 |
|
$pra->setValue($subPolicyRuleAttributes); |
130
|
|
|
// This data can be used in complex comparisons |
131
|
1 |
|
$pra->addExtraData('attribute', $pra->getAttribute()); |
132
|
1 |
|
$pra->addExtraData('user', $user); |
|
|
|
|
133
|
1 |
|
$pra->addExtraData('resource', $resource); |
|
|
|
|
134
|
1 |
|
break; |
135
|
|
|
} |
136
|
|
|
} |
137
|
1 |
|
} |
138
|
|
|
} |
139
|
|
|
|