Permissions::check() - Code Metrics - Inspection of "Extended and exposed permission system" - Schlaefer/Saito - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Branch — feature/currentUserRefactoring (c13c1d)

by Schlaefer

created 2019-10-31 06:54 UTC

Permissions::check() B

↳ Parent: Permissions

Complexity

Conditions	11
Paths	8

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	11
nc	8
nop	3
dl	0
loc	48
rs	7.3166
c	0
b	0
f	0

How to fix Complexity

<?php

declare(strict_types=1);

/**
 * Saito - The Threaded Web Forum
 *
 * @copyright Copyright (c) the Saito Project Developers
 * @link https://github.com/Schlaefer/Saito
 * @license http://opensource.org/licenses/MIT
 */

namespace Saito\User\Permission;

use App\Model\Table\CategoriesTable;
use Cake\Cache\Cache;
use InvalidArgumentException;
use Saito\RememberTrait;
use Saito\User\ForumsUserInterface;
use Saito\User\Permission\Identifier\IdentifierInterface;
use Saito\User\Permission\Roles;
use Stopwatch\Lib\Stopwatch;

/**
 * Class Permission
 *
 * Implements simple access control scheme.
 *
 * @package Saito\User
 */
class Permissions
{
    use RememberTrait;

    /** @var Roles */
    protected $roles;

    /** @var PermissionConfig */
    protected $PermissionConfig;

    /** @var CategoriesTable */
    protected $categories;

    /**
     * Constructor
     *
     * @param Roles $roles The roles
     * @param PermissionConfig $permissionConfig The config
     * @param CategoriesTable $categories Categories for accession permissions
     */
    public function __construct(Roles $roles, PermissionConfig $permissionConfig, CategoriesTable $categories)
    {
        Stopwatch::start('Permission::__construct()');
        $this->roles = $roles;
        $this->PermissionConfig = $permissionConfig;
        $this->categories = $categories;

        $categories = Cache::remember(
            'saito.core.permission.categories',
            function () {
                return $this->bootstrapCategories();
            }
        );
        foreach ($categories as $resource) {
            $this->PermissionConfig->allowRole($resource['resource'], $resource['role']);
        }

        Stopwatch::stop('Permission::__construct()');
    }

    /**
     * Check if access to resource is allowed.
     *
     * @param ForumsUserInterface $user CurrentUser
     * @param string $resource Resource
     * @param IdentifierInterface ...$identifiers Identifiers
     * @return bool
     */
    public function check(ForumsUserInterface $user, string $resource, IdentifierInterface ...$identifiers): bool
    {
        /// Force allow all check
        $force = $this->PermissionConfig->getForce($resource);
        if ($force) {
            return $force->check($resource);
        }

        $roleObject = null;

        if (!empty($identifiers)) {
            foreach ($identifiers as $identifier) {
                $type = $identifier->type();
                switch ($type) {
                    case ('owner'):
                        /// Owner check
                        foreach ($this->PermissionConfig->getOwner($resource) as $allowance) {
                            if ($allowance->check($resource, $user, $identifier->get())) {
                                return true;
                            }
                        }
                        break;
                    case ('role'):
                        // Just remember if there's a role object. Performed below.
                        $roleObject = $identifier->get();
                        break;
                    default:
                        new InvalidArgumentException(
                            sprintf('Unknown identifier type "%s" in permissin check.', $type)
                        );
                }
            }
        }

        /// Role check
        $roleAllowances = $this->PermissionConfig->getRole($resource);
        if (!empty($roleAllowances)) {
            foreach ($roleAllowances as $allowance) {
                $role = $user->getRole();
                $roles = $this->roles->get($role);
                if ($allowance->check($resource, $roles, $roleObject)) {
                    return true;
                }
            }
        }

        return false;
    }

    /**
     * Gets the roles object
     *
     * @return Roles
     */
    public function getRoles(): Roles
    {
        return $this->roles;
    }

    /**
     * convert category-accessions and insert them as resources
     *
     * Resource: `saito.core.category.<category-ID>.<action>`
     *
     * @return array [['resource' => <Resource>, 'role' => <role-type>]]
     */
    protected function bootstrapCategories(): array
    {
        $resources = [];
        $categories = $this->categories->getAllCategories();
        $roles = $this->roles->getAvailable(true);
        $accessions = array_combine(array_column($roles, 'id'), array_column($roles, 'type'));
        $actions = [
            'read' => 'accession',
            'thread' => 'accession_new_thread',
            'answer' => 'accession_new_posting'
        ];
        foreach ($categories as $category) {
            foreach ($actions as $action => $field) {
                if (empty($accessions[$category->get($field)])) {
                    continue;
                }
                $role = $accessions[$category->get($field)];
                $categoryId = $category->get('id');
                $resource = "saito.core.category.{$categoryId}.{$action}";
                $resources[] = ['resource' => $resource, 'role' => $role];
            }
        }

        return $resources;
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			/**
6			* Saito - The Threaded Web Forum
7			*
8			* @copyright Copyright (c) the Saito Project Developers
9			* @link https://github.com/Schlaefer/Saito
10			* @license http://opensource.org/licenses/MIT
11			*/
12
13			namespace Saito\User\Permission;
14
15			use App\Model\Table\CategoriesTable;
16			use Cake\Cache\Cache;
17			use InvalidArgumentException;
18			use Saito\RememberTrait;
19			use Saito\User\ForumsUserInterface;
20			use Saito\User\Permission\Identifier\IdentifierInterface;
21			use Saito\User\Permission\Roles;
22			use Stopwatch\Lib\Stopwatch;
23
24			/**
25			* Class Permission
26			*
27			* Implements simple access control scheme.
28			*
29			* @package Saito\User
30			*/
31			class Permissions
32			{
33			use RememberTrait;
34
35			/** @var Roles */
36			protected $roles;
37
38			/** @var PermissionConfig */
39			protected $PermissionConfig;
40
41			/** @var CategoriesTable */
42			protected $categories;
43
44			/**
45			* Constructor
46			*
47			* @param Roles $roles The roles
48			* @param PermissionConfig $permissionConfig The config
49			* @param CategoriesTable $categories Categories for accession permissions
50			*/
51			public function __construct(Roles $roles, PermissionConfig $permissionConfig, CategoriesTable $categories)
52			{
53			Stopwatch::start('Permission::__construct()');
54			$this->roles = $roles;
55			$this->PermissionConfig = $permissionConfig;
56			$this->categories = $categories;
57
58			$categories = Cache::remember(
59			'saito.core.permission.categories',
60			function () {
61			return $this->bootstrapCategories();
62			}
63			);
64			foreach ($categories as $resource) {
65			$this->PermissionConfig->allowRole($resource['resource'], $resource['role']);
66			}
67
68			Stopwatch::stop('Permission::__construct()');
69			}
70
71			/**
72			* Check if access to resource is allowed.
73			*
74			* @param ForumsUserInterface $user CurrentUser
75			* @param string $resource Resource
76			* @param IdentifierInterface ...$identifiers Identifiers
77			* @return bool
78			*/
79			public function check(ForumsUserInterface $user, string $resource, IdentifierInterface ...$identifiers): bool
80			{
81			/// Force allow all check
82			$force = $this->PermissionConfig->getForce($resource);
83			if ($force) {
84			return $force->check($resource);
85			}
86
87			$roleObject = null;
88
89			if (!empty($identifiers)) {
90			foreach ($identifiers as $identifier) {
91			$type = $identifier->type();
92			switch ($type) {
93			case ('owner'):
94			/// Owner check
95			foreach ($this->PermissionConfig->getOwner($resource) as $allowance) {
96			if ($allowance->check($resource, $user, $identifier->get())) {
97			return true;
98			}
99			}
100			break;
101			case ('role'):
102			// Just remember if there's a role object. Performed below.
103			$roleObject = $identifier->get();
104			break;
105			default:
106			new InvalidArgumentException(
107			sprintf('Unknown identifier type "%s" in permissin check.', $type)
108			);
109			}
110			}
111			}
112
113			/// Role check
114			$roleAllowances = $this->PermissionConfig->getRole($resource);
115			if (!empty($roleAllowances)) {
116			foreach ($roleAllowances as $allowance) {
117			$role = $user->getRole();
118			$roles = $this->roles->get($role);
119			if ($allowance->check($resource, $roles, $roleObject)) {
120			return true;
121			}
122			}
123			}
124
125			return false;
126			}
127
128			/**
129			* Gets the roles object
130			*
131			* @return Roles
132			*/
133			public function getRoles(): Roles
134			{
135			return $this->roles;
136			}
137
138			/**
139			* convert category-accessions and insert them as resources
140			*
141			* Resource: `saito.core.category.<category-ID>.<action>`
142			*
143			* @return array [['resource' => <Resource>, 'role' => <role-type>]]
144			*/
145			protected function bootstrapCategories(): array
146			{
147			$resources = [];
148			$categories = $this->categories->getAllCategories();
149			$roles = $this->roles->getAvailable(true);
150			$accessions = array_combine(array_column($roles, 'id'), array_column($roles, 'type'));
151			$actions = [
152			'read' => 'accession',
153			'thread' => 'accession_new_thread',
154			'answer' => 'accession_new_posting'
155			];
156			foreach ($categories as $category) {
157			foreach ($actions as $action => $field) {
158			if (empty($accessions[$category->get($field)])) {
159			continue;
160			}
161			$role = $accessions[$category->get($field)];
162			$categoryId = $category->get('id');
163			$resource = "saito.core.category.{$categoryId}.{$action}";
164			$resources[] = ['resource' => $resource, 'role' => $role];
165			}
166			}
167
168			return $resources;
169			}
170			}
171

Schlaefer / Saito

Branch — feature/currentUserRefactoring (c13c1d)

Permissions::check() B

Complexity

Size

Duplication

Importance

How to fix Complexity

Long Method

Duplication Side-by-Side

Filter issues like