1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace PhpAbac; |
4
|
|
|
|
5
|
|
|
use PhpAbac\Manager\AttributeManager; |
6
|
|
|
use PhpAbac\Manager\PolicyRuleManager; |
7
|
|
|
use PhpAbac\Manager\ConfigurationManager; |
8
|
|
|
use PhpAbac\Manager\CacheManager; |
9
|
|
|
use PhpAbac\Manager\ComparisonManager; |
10
|
|
|
|
11
|
|
|
use Symfony\Component\Config\FileLocator; |
12
|
|
|
|
13
|
|
|
use PhpAbac\Model\PolicyRuleAttribute; |
14
|
|
|
|
15
|
|
|
class Abac |
16
|
|
|
{ |
17
|
|
|
/** @var \PhpAbac\Manager\ConfigurationManager **/ |
18
|
|
|
private $configuration; |
19
|
|
|
/** @var \PhpAbac\Manager\PolicyRuleManager **/ |
20
|
|
|
private $policyRuleManager; |
21
|
|
|
/** @var \PhpAbac\Manager\AttributeManager **/ |
22
|
|
|
private $attributeManager; |
23
|
|
|
/** @var \PhpAbac\Manager\CacheManager **/ |
24
|
|
|
private $cacheManager; |
25
|
|
|
/** @var \PhpAbac\Manager\ComparisonManager **/ |
26
|
|
|
private $comparisonManager; |
27
|
|
|
|
28
|
|
|
/** |
29
|
|
|
* @param array $configPaths |
30
|
|
|
*/ |
31
|
1 |
|
public function __construct($configPaths) |
32
|
|
|
{ |
33
|
1 |
|
$this->configure($configPaths); |
34
|
1 |
|
$this->attributeManager = new AttributeManager($this->configuration->getAttributes()); |
35
|
1 |
|
$this->policyRuleManager = new PolicyRuleManager($this->attributeManager, $this->configuration->getRules()); |
36
|
1 |
|
$this->cacheManager = new CacheManager(); |
37
|
1 |
|
$this->comparisonManager = new ComparisonManager($this->attributeManager); |
38
|
1 |
|
} |
39
|
|
|
|
40
|
|
|
/** |
41
|
|
|
* @param array $configPaths |
42
|
|
|
*/ |
43
|
1 |
|
public function configure($configPaths) { |
44
|
1 |
|
$locator = new FileLocator($configPaths); |
45
|
1 |
|
$this->configuration = new ConfigurationManager($locator); |
46
|
1 |
|
$this->configuration->parseConfigurationFile($configPaths); |
47
|
1 |
|
} |
48
|
|
|
|
49
|
|
|
/** |
50
|
|
|
* Return true if both user and object respects all the rules conditions |
51
|
|
|
* If the objectId is null, policy rules about its attributes will be ignored |
52
|
|
|
* In case of mismatch between attributes and expected values, |
53
|
|
|
* an array with the concerned attributes slugs will be returned. |
54
|
|
|
* |
55
|
|
|
* Available options are : |
56
|
|
|
* * dynamic_attributes: array |
57
|
|
|
* * cache_result: boolean |
58
|
|
|
* * cache_ttl: integer |
59
|
|
|
* * cache_driver: string |
60
|
|
|
* |
61
|
|
|
* Available cache drivers are : |
62
|
|
|
* * memory |
63
|
|
|
* |
64
|
|
|
* @param string $ruleName |
65
|
|
|
* @param object $user |
66
|
|
|
* @param object $resource |
67
|
|
|
* @param array $options |
68
|
|
|
* @return boolean|array |
69
|
|
|
*/ |
70
|
1 |
|
public function enforce($ruleName, $user, $resource = null, $options = []) { |
71
|
|
|
// If there is dynamic attributes, we pass them to the comparison manager |
72
|
|
|
// When a comparison will be performed, the passed values will be retrieved and used |
73
|
1 |
|
if(isset($options['dynamic_attributes'])) { |
|
|
|
|
74
|
1 |
|
$this->comparisonManager->setDynamicAttributes($options['dynamic_attributes']); |
75
|
1 |
|
} |
76
|
|
|
// Retrieve cache value for the current rule and values if cache item is valid |
77
|
1 |
|
if(($cacheResult = isset($options['cache_result']) && $options['cache_result'] === true) === true) { |
|
|
|
|
78
|
|
|
$cacheItem = $this->cacheManager->getItem( |
79
|
|
|
"$ruleName-{$user->getId()}-" . (($resource !== null) ? $resource->getId() : ''), |
80
|
|
|
(isset($options['cache_driver'])) ? $options['cache_driver'] : null, |
81
|
|
|
(isset($options['cache_ttl'])) ? $options['cache_ttl'] : null |
82
|
|
|
); |
83
|
|
|
// We check if the cache value s valid before returning it |
84
|
|
|
if(($cacheValue = $cacheItem->get()) !== null) { |
|
|
|
|
85
|
|
|
return $cacheValue; |
86
|
|
|
} |
87
|
|
|
} |
88
|
1 |
|
$policyRule = $this->policyRuleManager->getRule($ruleName); |
89
|
|
|
// For each policy rule attribute, we retrieve the attribute value and proceed configured extra data |
90
|
1 |
|
foreach ($policyRule->getPolicyRuleAttributes() as $pra) { |
91
|
1 |
|
$attribute = $pra->getAttribute(); |
92
|
1 |
|
$attribute->setValue($this->attributeManager->retrieveAttribute($attribute, $user, $resource)); |
93
|
1 |
|
if(count($pra->getExtraData()) > 0) { |
|
|
|
|
94
|
1 |
|
$this->processExtraData($pra, $user, $resource); |
|
|
|
|
95
|
1 |
|
} |
96
|
1 |
|
$this->comparisonManager->compare($pra); |
97
|
1 |
|
} |
98
|
|
|
// The given result could be an array of rejected attributes or true |
99
|
|
|
// True means that the rule is correctly enforced for the given user and resource |
100
|
1 |
|
$result = $this->comparisonManager->getResult(); |
101
|
1 |
|
if($cacheResult) { |
|
|
|
|
102
|
|
|
$cacheItem->set($result); |
|
|
|
|
103
|
|
|
$this->cacheManager->save($cacheItem); |
104
|
|
|
} |
105
|
1 |
|
return $result; |
106
|
|
|
} |
107
|
|
|
|
108
|
|
|
/** |
109
|
|
|
* @param \PhpAbac\Model\PolicyRuleAttribute $pra |
110
|
|
|
* @param object $user |
111
|
|
|
* @param object $resource |
112
|
|
|
*/ |
113
|
1 |
|
public function processExtraData(PolicyRuleAttribute $pra, $user, $resource) { |
114
|
1 |
|
foreach($pra->getExtraData() as $key => $data) { |
|
|
|
|
115
|
|
|
switch($key) { |
|
|
|
|
116
|
1 |
|
case 'with': |
117
|
|
|
// This data has to be removed for it will be stored elsewhere |
118
|
|
|
// in the policy rule attribute |
119
|
1 |
|
$pra->removeExtraData('with'); |
120
|
|
|
// The "with" extra data is an array of attributes, which are objects |
121
|
|
|
// Once we process it as policy rule attributes, we set it as the main policy rule attribute value |
122
|
1 |
|
$subPolicyRuleAttributes = []; |
123
|
1 |
|
foreach($this->policyRuleManager->processRuleAttributes($data) as $subPolicyRuleAttribute) { |
|
|
|
|
124
|
1 |
|
$subPolicyRuleAttributes[] = $subPolicyRuleAttribute; |
125
|
1 |
|
} |
126
|
1 |
|
$pra->setValue($subPolicyRuleAttributes); |
127
|
|
|
// This data can be used in complex comparisons |
128
|
1 |
|
$pra->addExtraData('attribute', $pra->getAttribute()); |
129
|
1 |
|
$pra->addExtraData('user', $user); |
|
|
|
|
130
|
1 |
|
$pra->addExtraData('resource', $resource); |
|
|
|
|
131
|
1 |
|
break; |
132
|
|
|
} |
133
|
1 |
|
} |
134
|
1 |
|
} |
135
|
|
|
} |
136
|
|
|
|