1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace PhpAbac\Manager; |
4
|
|
|
|
5
|
|
|
use PhpAbac\Model\PolicyRule; |
6
|
|
|
use PhpAbac\Model\PolicyRuleAttribute; |
7
|
|
|
|
8
|
|
|
class PolicyRuleManager |
9
|
|
|
{ |
10
|
|
|
/** @var \PhpAbac\Manager\AttributeManager **/ |
11
|
|
|
private $attributeManager; |
12
|
|
|
/** @var array **/ |
13
|
|
|
private $rules; |
14
|
|
|
|
15
|
|
|
/** |
16
|
|
|
* @param \PhpAbac\Manager\AttributeManager $attributeManager |
17
|
|
|
* @param array $rules |
18
|
|
|
*/ |
19
|
2 |
|
public function __construct(AttributeManager $attributeManager, $rules) |
20
|
|
|
{ |
21
|
2 |
|
$this->attributeManager = $attributeManager; |
22
|
2 |
|
$this->rules = $rules; |
23
|
2 |
|
} |
24
|
|
|
|
25
|
|
|
/** |
26
|
|
|
* @param string $ruleName |
27
|
|
|
* @param object $user |
28
|
|
|
* @param object $resource |
29
|
|
|
* @return PolicyRule |
30
|
|
|
* @throws \InvalidArgumentException |
31
|
|
|
*/ |
32
|
2 |
|
public function getRule($ruleName, $user, $resource) |
33
|
|
|
{ |
34
|
2 |
|
if(!isset($this->rules[$ruleName])) { |
|
|
|
|
35
|
|
|
throw new \InvalidArgumentException('The given rule "' . $ruleName . '" is not configured'); |
36
|
|
|
} |
37
|
|
|
$rule = |
38
|
2 |
|
(new PolicyRule()) |
39
|
2 |
|
->setName($ruleName) |
40
|
|
|
; |
41
|
|
|
// For each policy rule attribute, the data is formatted |
42
|
2 |
|
foreach($this->processRuleAttributes($this->rules[$ruleName]['attributes'], $user, $resource) as $pra) { |
|
|
|
|
43
|
2 |
|
$rule->addPolicyRuleAttribute($pra); |
44
|
|
|
} |
45
|
2 |
|
return $rule; |
46
|
|
|
} |
47
|
|
|
|
48
|
|
|
/** |
49
|
|
|
* This method is meant to convert attribute data from array to formatted policy rule attribute |
50
|
|
|
* |
51
|
|
|
* @param array $attributes |
52
|
|
|
* @param object $user |
53
|
|
|
* @param object $resource |
54
|
|
|
*/ |
55
|
2 |
|
public function processRuleAttributes($attributes, $user, $resource) { |
56
|
2 |
|
foreach($attributes as $attributeName => $attribute) { |
|
|
|
|
57
|
2 |
|
$pra = (new PolicyRuleAttribute()) |
58
|
2 |
|
->setAttribute($this->attributeManager->getAttribute($attributeName)) |
59
|
2 |
|
->setComparison($attribute['comparison']) |
60
|
2 |
|
->setComparisonType($attribute['comparison_type']) |
61
|
2 |
|
->setValue((isset($attribute['value'])) ? $attribute['value'] : null) |
62
|
|
|
; |
63
|
2 |
|
$this->processRuleAttributeComparisonType($pra, $user, $resource); |
64
|
|
|
// In the case the user configured more keys than the basic ones |
65
|
|
|
// it will be stored as extra data |
66
|
2 |
|
foreach($attribute as $key => $value) { |
|
|
|
|
67
|
2 |
|
if(!in_array($key, ['comparison', 'comparison_type', 'value'])) { |
|
|
|
|
68
|
2 |
|
$pra->addExtraData($key, $value); |
69
|
|
|
} |
70
|
|
|
} |
71
|
|
|
// This generator avoid useless memory consumption instead of returning a whole array |
72
|
2 |
|
yield $pra; |
73
|
|
|
} |
74
|
2 |
|
} |
75
|
|
|
|
76
|
|
|
/** |
77
|
|
|
* This method is meant to set appropriated extra data to $pra depending on comparison type |
78
|
|
|
* |
79
|
|
|
* @param PolicyRuleAttribute $pra |
80
|
|
|
* @param object $user |
81
|
|
|
* @param object $resource |
82
|
|
|
*/ |
83
|
2 |
|
public function processRuleAttributeComparisonType(PolicyRuleAttribute $pra, $user, $resource) { |
84
|
2 |
|
switch($pra->getComparisonType()) { |
|
|
|
|
85
|
2 |
|
case 'user': $pra->setExtraData(['user' => $user]); break; |
|
|
|
|
86
|
2 |
|
case 'object': $pra->setExtraData(['resource' => $resource]); break; |
|
|
|
|
87
|
|
|
} |
88
|
2 |
|
} |
89
|
|
|
} |
90
|
|
|
|