bakaphp /
phalcon-api
| Total Complexity | 68 |
| Total Lines | 699 |
| Duplicated Lines | 0 % |
| Coverage | 78.02% |
| Changes | 0 | ||
Complex classes like Manager often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Manager, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 34 | class Manager extends Adapter |
||
| 35 | { |
||
| 36 | /** |
||
| 37 | * @var DbAdapter |
||
| 38 | */ |
||
| 39 | protected $connection; |
||
| 40 | |||
| 41 | /** |
||
| 42 | * Roles table |
||
| 43 | * @var string |
||
| 44 | */ |
||
| 45 | protected $roles; |
||
| 46 | |||
| 47 | /** |
||
| 48 | * Resources table |
||
| 49 | * @var string |
||
| 50 | */ |
||
| 51 | protected $resources; |
||
| 52 | |||
| 53 | /** |
||
| 54 | * Resources Accesses table |
||
| 55 | * @var string |
||
| 56 | */ |
||
| 57 | protected $resourcesAccesses; |
||
| 58 | |||
| 59 | /** |
||
| 60 | * Access List table |
||
| 61 | * @var string |
||
| 62 | */ |
||
| 63 | protected $accessList; |
||
| 64 | |||
| 65 | /** |
||
| 66 | * Roles Inherits table |
||
| 67 | * @var string |
||
| 68 | */ |
||
| 69 | protected $rolesInherits; |
||
| 70 | |||
| 71 | /** |
||
| 72 | * Default action for no arguments is allow |
||
| 73 | * @var int |
||
| 74 | */ |
||
| 75 | protected $noArgumentsDefaultAction = Acl::ALLOW; |
||
| 76 | |||
| 77 | /** |
||
| 78 | * Company Object |
||
| 79 | * |
||
| 80 | * @var Companies |
||
| 81 | */ |
||
| 82 | protected $company; |
||
| 83 | |||
| 84 | /** |
||
| 85 | * App Objc |
||
| 86 | * |
||
| 87 | * @var Apps |
||
| 88 | */ |
||
| 89 | protected $app; |
||
| 90 | |||
| 91 | /** |
||
| 92 | * Class constructor. |
||
| 93 | * |
||
| 94 | * @param array $options Adapter config |
||
| 95 | * @throws Exception |
||
| 96 | */ |
||
| 97 | 15 | public function __construct(array $options) |
|
| 98 | { |
||
| 99 | 15 | if (!isset($options['db']) || !$options['db'] instanceof DbAdapter) { |
|
| 100 | throw new Exception( |
||
| 101 | 'Parameter "db" is required and it must be an instance of Phalcon\Acl\AdapterInterface' |
||
| 102 | ); |
||
| 103 | } |
||
| 104 | |||
| 105 | 15 | $this->connection = $options['db']; |
|
| 106 | |||
| 107 | 15 | foreach (['roles', 'resources', 'resourcesAccesses', 'accessList', 'rolesInherits'] as $table) { |
|
| 108 | 15 | if (!isset($options[$table]) || empty($options[$table]) || !is_string($options[$table])) { |
|
| 109 | throw new Exception("Parameter '{$table}' is required and it must be a non empty string"); |
||
| 110 | } |
||
| 111 | |||
| 112 | 15 | $this->{$table} = $this->connection->escapeIdentifier($options[$table]); |
|
| 113 | } |
||
| 114 | 15 | } |
|
| 115 | |||
| 116 | /** |
||
| 117 | * Set current user Company |
||
| 118 | * |
||
| 119 | * @param Companies $company |
||
| 120 | * @return void |
||
| 121 | */ |
||
| 122 | 2 | public function setCompany(Companies $company): void |
|
| 123 | { |
||
| 124 | 2 | $this->company = $company; |
|
| 125 | 2 | } |
|
| 126 | |||
| 127 | /** |
||
| 128 | * Set current user app |
||
| 129 | * |
||
| 130 | * @param Apps $app |
||
| 131 | * @return void |
||
| 132 | */ |
||
| 133 | 8 | public function setApp(Apps $app): void |
|
| 134 | { |
||
| 135 | 8 | $this->app = $app; |
|
| 136 | 8 | } |
|
| 137 | |||
| 138 | /** |
||
| 139 | * Get the current App |
||
| 140 | * |
||
| 141 | * @return void |
||
| 142 | */ |
||
| 143 | 11 | public function getApp(): Apps |
|
| 144 | { |
||
| 145 | 11 | if (!is_object($this->app)) { |
|
| 146 | 5 | $this->app = new Apps(); |
|
| 147 | 5 | $this->app->id = 0; |
|
| 148 | 5 | $this->app->name = 'Canvas'; |
|
| 149 | } |
||
| 150 | |||
| 151 | 11 | return $this->app; |
|
| 152 | } |
||
| 153 | |||
| 154 | /** |
||
| 155 | * Get the current App |
||
| 156 | * |
||
| 157 | * @return void |
||
| 158 | */ |
||
| 159 | 10 | public function getCompany() : Companies |
|
| 160 | { |
||
| 161 | 10 | if (!is_object($this->company)) { |
|
| 162 | 8 | $this->company = new Companies(); |
|
| 163 | 8 | $this->company->id = 0; |
|
| 164 | 8 | $this->company->name = 'Canvas'; |
|
| 165 | } |
||
| 166 | |||
| 167 | 10 | return $this->company; |
|
| 168 | } |
||
| 169 | |||
| 170 | /** |
||
| 171 | * {@inheritdoc} |
||
| 172 | * |
||
| 173 | * Example: |
||
| 174 | * <code> |
||
| 175 | * $acl->addRole(new Phalcon\Acl\Role('administrator'), 'consultor'); |
||
| 176 | * $acl->addRole('administrator', 'consultor'); |
||
| 177 | * </code> |
||
| 178 | * |
||
| 179 | * @param \Phalcon\Acl\Role|string $role |
||
| 180 | * @param int $scope |
||
| 181 | * @param string $accessInherits |
||
| 182 | * @return boolean |
||
| 183 | * @throws \Phalcon\Acl\Exception |
||
| 184 | */ |
||
| 185 | 3 | public function addRole($role, $scope = 0, $accessInherits = null): bool |
|
| 186 | { |
||
| 187 | 3 | if (is_string($role)) { |
|
| 188 | 1 | $role = $this->setAppByRole($role); |
|
| 189 | |||
| 190 | 1 | $role = new Role($role, ucwords($role) . ' Role'); |
|
| 191 | } |
||
| 192 | 3 | if (!$role instanceof RoleInterface) { |
|
|
1 ignored issue
–
show
|
|||
| 193 | throw new Exception('Role must be either an string or implement RoleInterface'); |
||
| 194 | } |
||
| 195 | |||
| 196 | 3 | $exists = RolesDB::count([ |
|
| 197 | 3 | 'conditions' => 'name = ?0 AND company_id = ?1 AND apps_id = ?2', |
|
| 198 | 3 | 'bind' => [$role->getName(), $this->getCompany()->getId(), $this->getApp()->getId()] |
|
| 199 | ]); |
||
| 200 | |||
| 201 | 3 | if (!$exists) { |
|
| 202 | 1 | $rolesDB = new RolesDB(); |
|
| 203 | 1 | $rolesDB->name = $role->getName(); |
|
| 204 | 1 | $rolesDB->description = $role->getDescription(); |
|
| 205 | 1 | $rolesDB->company_id = $this->getCompany()->getId(); |
|
| 206 | 1 | $rolesDB->apps_id = $this->getApp()->getId(); |
|
| 207 | 1 | $rolesDB->scope = $scope; |
|
| 208 | 1 | if (!$rolesDB->save()) { |
|
| 209 | throw new ModelException((string) current($rolesDB->getMessages())); |
||
| 210 | } |
||
| 211 | |||
| 212 | 1 | $accessListDB = new AccessListDB(); |
|
| 213 | 1 | $accessListDB->roles_name = $role->getName(); |
|
| 214 | 1 | $accessListDB->roles_id = $rolesDB->getId(); |
|
| 215 | 1 | $accessListDB->resources_name = '*'; |
|
| 216 | 1 | $accessListDB->access_name = '*'; |
|
| 217 | 1 | $accessListDB->allowed = $this->_defaultAccess; |
|
| 218 | 1 | $accessListDB->apps_id = $this->_defaultAccess; |
|
| 219 | 1 | $accessListDB->apps_id = $this->getApp()->getId(); |
|
| 220 | |||
| 221 | 1 | if (!$accessListDB->save()) { |
|
| 222 | throw new ModelException((string)current($rolesDB->getMessages())); |
||
| 223 | } |
||
| 224 | } |
||
| 225 | 3 | if ($accessInherits) { |
|
| 226 | return $this->addInherit($role->getName(), $accessInherits); |
||
| 227 | } |
||
| 228 | 3 | return true; |
|
| 229 | } |
||
| 230 | |||
| 231 | /** |
||
| 232 | * {@inheritdoc} |
||
| 233 | * |
||
| 234 | * @param string $roleName |
||
| 235 | * @param string $roleToInherit |
||
| 236 | * @throws \Phalcon\Acl\Exception |
||
| 237 | */ |
||
| 238 | public function addInherit($roleName, $roleToInherit): bool |
||
| 239 | { |
||
| 240 | $sql = "SELECT COUNT(*) FROM {$this->roles} WHERE name = ?"; |
||
| 241 | $exists = $this->connection->fetchOne($sql, null, [$roleName]); |
||
| 242 | if (!$exists[0]) { |
||
| 243 | throw new Exception("Role '{$roleName}' does not exist in the role list"); |
||
| 244 | } |
||
| 245 | $exists = $this->connection->fetchOne( |
||
| 246 | "SELECT COUNT(*) FROM {$this->rolesInherits} WHERE roles_name = ? AND roles_inherit = ?", |
||
| 247 | null, |
||
| 248 | [$roleName, $roleToInherit] |
||
| 249 | ); |
||
| 250 | if (!$exists[0]) { |
||
| 251 | $this->connection->execute( |
||
| 252 | "INSERT INTO {$this->rolesInherits} VALUES (?, ?)", |
||
| 253 | [$roleName, $roleToInherit] |
||
| 254 | ); |
||
| 255 | } |
||
| 256 | } |
||
| 257 | |||
| 258 | /** |
||
| 259 | * {@inheritdoc} |
||
| 260 | * |
||
| 261 | * @param string $roleName |
||
| 262 | * @return boolean |
||
| 263 | */ |
||
| 264 | 4 | public function isRole($roleName): bool |
|
| 265 | { |
||
| 266 | 4 | $exists = RolesDB::count([ |
|
| 267 | 4 | 'conditions' => 'name = ?0 AND apps_id = ?1 AND company_id in (?2, ?3)', |
|
| 268 | 4 | 'bind' => [$roleName, $this->getApp()->getId(), $this->getCompany()->getId(), 0] |
|
| 269 | ]); |
||
| 270 | |||
| 271 | 4 | return (bool)$exists; |
|
| 272 | } |
||
| 273 | |||
| 274 | /** |
||
| 275 | * {@inheritdoc} |
||
| 276 | * |
||
| 277 | * @param string $resourceName |
||
| 278 | * @return boolean |
||
| 279 | */ |
||
| 280 | 1 | public function isResource($resourceName): bool |
|
| 281 | { |
||
| 282 | 1 | $exists = ResourcesDB::count([ |
|
| 283 | 1 | 'conditions' => 'name = ?0 AND apps_id in (?1, ?2)', |
|
| 284 | 1 | 'bind' => [$resourceName, $this->getApp()->getId(), 0] |
|
| 285 | ]); |
||
| 286 | |||
| 287 | 1 | return (bool) $exists; |
|
| 288 | } |
||
| 289 | |||
| 290 | /** |
||
| 291 | * Get a resource by it name |
||
| 292 | * |
||
| 293 | * @param string $resourceName |
||
| 294 | * @return ResourcesDB |
||
| 295 | */ |
||
| 296 | 5 | protected function getResource(string $resourceName) : ResourcesDB |
|
| 297 | { |
||
| 298 | 5 | $resource = ResourcesDB::findFirst([ |
|
| 299 | 5 | 'conditions' => 'name = ?0 AND apps_id in (?1, ?2)', |
|
| 300 | 5 | 'bind' => [$resourceName, $this->getApp()->getId(), 0] |
|
| 301 | ]); |
||
| 302 | |||
| 303 | 5 | if (!is_object($resource)) { |
|
| 304 | 2 | throw new ModelException(_('Resource ' . $resourceName . ' not found on this app ' . $this->getApp()->getId())); |
|
| 305 | } |
||
| 306 | |||
| 307 | 3 | return $resource; |
|
|
1 ignored issue
–
show
|
|||
| 308 | } |
||
| 309 | |||
| 310 | /** |
||
| 311 | * Get a role by it name |
||
| 312 | * |
||
| 313 | * @param string $resourceName |
||
| 314 | * @return RolesDB |
||
| 315 | */ |
||
| 316 | 6 | protected function getRole(string $role) : RolesDB |
|
| 317 | { |
||
| 318 | 6 | $role = RolesDB::findFirst([ |
|
| 319 | 6 | 'conditions' => 'name = ?0 AND apps_id = ?1 AND company_id in (?2, ?3)', |
|
| 320 | 6 | 'bind' => [$role, $this->getApp()->getId(), $this->getCompany()->getId(), 0] |
|
| 321 | ]); |
||
| 322 | |||
| 323 | 6 | if (!is_object($role)) { |
|
| 324 | throw new ModelException(_('Roles ' . $role . ' not found on this app ' . $this->getApp()->getId() . ' AND Company' . $this->getCompany()->getId())); |
||
| 325 | } |
||
| 326 | |||
| 327 | 6 | return $role; |
|
|
1 ignored issue
–
show
|
|||
| 328 | } |
||
| 329 | |||
| 330 | /** |
||
| 331 | * Given a resource with a dot CRM.Leads , it will set the app |
||
| 332 | * |
||
| 333 | * @param string $resource |
||
| 334 | * @return void |
||
| 335 | */ |
||
| 336 | 9 | protected function setAppByResource(string $resource): string |
|
| 337 | { |
||
| 338 | //echeck if we have a dot , taht means we are sending the specific app to use |
||
| 339 | 9 | if (strpos($resource, '.') !== false) { |
|
| 340 | 5 | $appResource = explode('.', $resource); |
|
| 341 | 5 | $resource = $appResource[1]; |
|
| 342 | 5 | $appName = $appResource[0]; |
|
| 343 | |||
| 344 | //look for the app and set it |
||
| 345 | 5 | if ($app = Apps::getACLApp($appName)) { |
|
| 346 | 5 | $this->setApp($app); |
|
| 347 | } |
||
| 348 | } |
||
| 349 | |||
| 350 | 9 | return $resource; |
|
| 351 | } |
||
| 352 | |||
| 353 | /** |
||
| 354 | * Given a resource with a dot CRM.Leads , it will set the app |
||
| 355 | * |
||
| 356 | * @param string $resource |
||
| 357 | * @return void |
||
| 358 | */ |
||
| 359 | 5 | protected function setAppByRole(string $role) : string |
|
| 360 | { |
||
| 361 | //echeck if we have a dot , taht means we are sending the specific app to use |
||
| 362 | 5 | if (strpos($role, '.') !== false) { |
|
| 363 | 1 | $appRole = explode('.', $role); |
|
| 364 | 1 | $role = $appRole[1]; |
|
| 365 | 1 | $appName = $appRole[0]; |
|
| 366 | |||
| 367 | //look for the app and set it |
||
| 368 | 1 | if ($app = Apps::getACLApp($appName)) { |
|
| 369 | 1 | $this->setApp($app); |
|
| 370 | } |
||
| 371 | } |
||
| 372 | |||
| 373 | 5 | return $role; |
|
| 374 | } |
||
| 375 | |||
| 376 | /** |
||
| 377 | * {@inheritdoc} |
||
| 378 | * Example: |
||
| 379 | * <code> |
||
| 380 | * //Add a resource to the the list allowing access to an action |
||
| 381 | * $acl->addResource(new Phalcon\Acl\Resource('customers'), 'search'); |
||
| 382 | * $acl->addResource('customers', 'search'); |
||
| 383 | * //Add a resource with an access list |
||
| 384 | * $acl->addResource(new Phalcon\Acl\Resource('customers'), ['create', 'search']); |
||
| 385 | * $acl->addResource('customers', ['create', 'search']); |
||
| 386 | * $acl->addResource('App.customers', ['create', 'search']); |
||
| 387 | * </code> |
||
| 388 | * |
||
| 389 | * @param \Phalcon\Acl\Resource|string $resource |
||
| 390 | * @param array|string $accessList |
||
| 391 | * @return boolean |
||
| 392 | */ |
||
| 393 | 1 | public function addResource($resource, $accessList = null): bool |
|
| 394 | { |
||
| 395 | 1 | if (!is_object($resource)) { |
|
| 396 | //echeck if we have a dot , taht means we are sending the specific app to use |
||
| 397 | 1 | $resource = $this->setAppByResource($resource); |
|
| 398 | |||
| 399 | 1 | $resource = new Resource($resource); |
|
| 400 | } |
||
| 401 | |||
| 402 | 1 | if (!$this->isResource($resource->getName())) { |
|
| 403 | 1 | $resourceDB = new ResourcesDB(); |
|
| 404 | 1 | $resourceDB->name = $resource->getName(); |
|
| 405 | 1 | $resourceDB->description = $resource->getDescription(); |
|
| 406 | 1 | $resourceDB->apps_id = $this->getApp()->getId(); |
|
| 407 | |||
| 408 | 1 | if (!$resourceDB->save()) { |
|
| 409 | throw new ModelException((string)current($resourceDB->getMessages())); |
||
| 410 | } |
||
| 411 | } |
||
| 412 | |||
| 413 | 1 | if ($accessList) { |
|
| 414 | 1 | return $this->addResourceAccess($resource->getName(), $accessList); |
|
| 415 | } |
||
| 416 | |||
| 417 | return true; |
||
| 418 | } |
||
| 419 | |||
| 420 | /** |
||
| 421 | * {@inheritdoc} |
||
| 422 | * |
||
| 423 | * @param string $resourceName |
||
| 424 | * @param array|string $accessList |
||
| 425 | * @return boolean |
||
| 426 | * @throws \Phalcon\Acl\Exception |
||
| 427 | */ |
||
| 428 | 1 | public function addResourceAccess($resourceName, $accessList): bool |
|
| 429 | { |
||
| 430 | 1 | if (!$this->isResource($resourceName)) { |
|
| 431 | throw new Exception("Resource '{$resourceName}' does not exist in ACL"); |
||
| 432 | } |
||
| 433 | |||
| 434 | 1 | $resource = $this->getResource($resourceName); |
|
| 435 | 1 | $exists = ResourcesAccesses::count([ |
|
| 436 | 1 | 'conditions' => 'resources_id = ?0 AND access_name = ?1 AND apps_id = ?2', |
|
| 437 | 1 | 'bind' => [$resource->getId(), $accessName, $this->getApp()->getId()] |
|
| 438 | ]); |
||
| 439 | |||
| 440 | 1 | if (!is_array($accessList)) { |
|
| 441 | $accessList = [$accessList]; |
||
| 442 | } |
||
| 443 | |||
| 444 | 1 | foreach ($accessList as $accessName) { |
|
| 445 | 1 | if (!$exists) { |
|
| 446 | 1 | $resourceAccesses = new ResourcesAccesses(); |
|
| 447 | 1 | $resourceAccesses->beforeCreate(); //wtf? |
|
| 448 | 1 | $resourceAccesses->resources_name = $resourceName; |
|
| 449 | 1 | $resourceAccesses->access_name = $accessName; |
|
| 450 | 1 | $resourceAccesses->apps_id = $this->getApp()->getId(); |
|
| 451 | 1 | $resourceAccesses->resources_id = $resource->getId(); |
|
| 452 | |||
| 453 | 1 | if (!$resourceAccesses->save()) { |
|
| 454 | 1 | throw new ModelException((string)current($resourceAccesses->getMessages())); |
|
| 455 | } |
||
| 456 | } |
||
| 457 | } |
||
| 458 | 1 | return true; |
|
| 459 | } |
||
| 460 | |||
| 461 | /** |
||
| 462 | * {@inheritdoc} |
||
| 463 | * |
||
| 464 | * @return \Phalcon\Acl\Resource[] |
||
| 465 | */ |
||
| 466 | public function getResources(): \Phalcon\Acl\ResourceInterface |
||
| 474 | } |
||
| 475 | |||
| 476 | /** |
||
| 477 | * {@inheritdoc} |
||
| 478 | * |
||
| 479 | * @return RoleInterface[] |
||
| 480 | */ |
||
| 481 | public function getRoles(): \Phalcon\Acl\RoleInterface |
||
| 482 | { |
||
| 483 | $roles = []; |
||
| 484 | |||
| 485 | foreach (RolesDB::find() as $row) { |
||
| 486 | $roles[] = new Role($row->name, $row->description); |
||
| 487 | } |
||
| 488 | return $roles; |
||
| 489 | } |
||
| 490 | |||
| 491 | /** |
||
| 492 | * {@inheritdoc} |
||
| 493 | * |
||
| 494 | * @param string $resourceName |
||
| 495 | * @param array|string $accessList |
||
| 496 | */ |
||
| 497 | public function dropResourceAccess($resourceName, $accessList) |
||
| 498 | { |
||
| 499 | throw new BadMethodCallException('Not implemented yet.'); |
||
| 500 | } |
||
| 501 | |||
| 502 | /** |
||
| 503 | * {@inheritdoc} |
||
| 504 | * You can use '*' as wildcard |
||
| 505 | * Example: |
||
| 506 | * <code> |
||
| 507 | * //Allow access to guests to search on customers |
||
| 508 | * $acl->allow('guests', 'customers', 'search'); |
||
| 509 | * //Allow access to guests to search or create on customers |
||
| 510 | * $acl->allow('guests', 'customers', ['search', 'create']); |
||
| 511 | * //Allow access to any role to browse on products |
||
| 512 | * $acl->allow('*', 'products', 'browse'); |
||
| 513 | * //Allow access to any role to browse on any resource |
||
| 514 | * $acl->allow('*', '*', 'browse'); |
||
| 515 | * </code> |
||
| 516 | * |
||
| 517 | * @param string $roleName |
||
| 518 | * @param string $resourceName |
||
| 519 | * @param array|string $access |
||
| 520 | * @param mixed $func |
||
| 521 | */ |
||
| 522 | 1 | public function allow($roleName, $resourceName, $access, $func = null) |
|
| 523 | { |
||
| 524 | 1 | return $this->allowOrDeny($roleName, $resourceName, $access, Acl::ALLOW); |
|
| 525 | } |
||
| 526 | |||
| 527 | /** |
||
| 528 | * {@inheritdoc} |
||
| 529 | * You can use '*' as wildcard |
||
| 530 | * Example: |
||
| 531 | * <code> |
||
| 532 | * //Deny access to guests to search on customers |
||
| 533 | * $acl->deny('guests', 'customers', 'search'); |
||
| 534 | * //Deny access to guests to search or create on customers |
||
| 535 | * $acl->deny('guests', 'customers', ['search', 'create']); |
||
| 536 | * //Deny access to any role to browse on products |
||
| 537 | * $acl->deny('*', 'products', 'browse'); |
||
| 538 | * //Deny access to any role to browse on any resource |
||
| 539 | * $acl->deny('*', '*', 'browse'); |
||
| 540 | * </code> |
||
| 541 | * |
||
| 542 | * @param string $roleName |
||
| 543 | * @param string $resourceName |
||
| 544 | * @param array|string $access |
||
| 545 | * @param mixed $func |
||
| 546 | * @return boolean |
||
| 547 | */ |
||
| 548 | 3 | public function deny($roleName, $resourceName, $access, $func = null) |
|
| 549 | { |
||
| 550 | 3 | return $this->allowOrDeny($roleName, $resourceName, $access, Acl::DENY); |
|
| 551 | } |
||
| 552 | |||
| 553 | /** |
||
| 554 | * {@inheritdoc} |
||
| 555 | * Example: |
||
| 556 | * <code> |
||
| 557 | * //Does Andres have access to the customers resource to create? |
||
| 558 | * $acl->isAllowed('Andres', 'Products', 'create'); |
||
| 559 | * //Do guests have access to any resource to edit? |
||
| 560 | * $acl->isAllowed('guests', '*', 'edit'); |
||
| 561 | * </code> |
||
| 562 | * |
||
| 563 | * @param string $role |
||
| 564 | * @param string $resource |
||
| 565 | * @param string $access |
||
| 566 | * @param array $parameters |
||
| 567 | * @return bool |
||
| 568 | */ |
||
| 569 | 4 | public function isAllowed($role, $resource, $access, array $parameters = null): bool |
|
| 570 | { |
||
| 571 | 4 | $role = $this->setAppByRole($role); |
|
| 572 | //resoure always overwrites the role app? |
||
| 573 | 4 | $resource = $this->setAppByResource($resource); |
|
| 574 | 4 | $roleObj = $this->getRole(($role)); |
|
| 575 | |||
| 576 | 4 | $sql = implode(' ', [ |
|
| 577 | 4 | 'SELECT ' . $this->connection->escapeIdentifier('allowed') . " FROM {$this->accessList} AS a", |
|
| 578 | // role_name in: |
||
| 579 | 4 | 'WHERE roles_id IN (', |
|
| 580 | // given 'role'-parameter |
||
| 581 | 4 | 'SELECT roles_id ', |
|
| 582 | // inherited role_names |
||
| 583 | 4 | "UNION SELECT roles_inherit FROM {$this->rolesInherits} WHERE roles_id = ?", |
|
| 584 | // or 'any' |
||
| 585 | 4 | "UNION SELECT '*'", |
|
| 586 | 4 | ')', |
|
| 587 | // resources_name should be given one or 'any' |
||
| 588 | 4 | "AND resources_name IN (?, '*')", |
|
| 589 | // access_name should be given one or 'any' |
||
| 590 | //"AND access_name IN (?, '*')", you need to specify * , we are forcing to check always for permisions |
||
| 591 | 4 | 'AND access_name IN (?)', |
|
| 592 | 4 | 'AND apps_id = ? ', |
|
| 593 | 4 | 'AND roles_id = ? ', |
|
| 594 | // order be the sum of bools for 'literals' before 'any' |
||
| 595 | 4 | 'ORDER BY ' . $this->connection->escapeIdentifier('allowed') . ' DESC', |
|
| 596 | // get only one... |
||
| 597 | 4 | 'LIMIT 1' |
|
| 598 | ]); |
||
| 599 | |||
| 600 | // fetch one entry... |
||
| 601 | 4 | $allowed = $this->connection->fetchOne($sql, Db::FETCH_NUM, [$roleObj->getId(), $resource, $access, $this->getApp()->getId(), $roleObj->getId()]); |
|
|
1 ignored issue
–
show
|
|||
| 602 | |||
| 603 | 4 | if (is_array($allowed)) { |
|
|
1 ignored issue
–
show
|
|||
| 604 | 4 | return (bool) $allowed[0]; |
|
| 605 | } |
||
| 606 | |||
| 607 | /** |
||
| 608 | * Return the default access action |
||
| 609 | */ |
||
| 610 | return (bool) $this->_defaultAccess; |
||
| 611 | } |
||
| 612 | |||
| 613 | /** |
||
| 614 | * Returns the default ACL access level for no arguments provided |
||
| 615 | * in isAllowed action if there exists func for accessKey |
||
| 616 | * |
||
| 617 | * @return int |
||
| 618 | */ |
||
| 619 | public function getNoArgumentsDefaultAction(): int |
||
| 622 | } |
||
| 623 | |||
| 624 | /** |
||
| 625 | * Sets the default access level for no arguments provided |
||
| 626 | * in isAllowed action if there exists func for accessKey |
||
| 627 | * |
||
| 628 | * @param int $defaultAccess Phalcon\Acl::ALLOW or Phalcon\Acl::DENY |
||
| 629 | */ |
||
| 630 | public function setNoArgumentsDefaultAction($defaultAccess) |
||
| 631 | { |
||
| 632 | $this->noArgumentsDefaultAction = intval($defaultAccess); |
||
| 633 | } |
||
| 634 | |||
| 635 | /** |
||
| 636 | * Inserts/Updates a permission in the access list |
||
| 637 | * |
||
| 638 | * @param string $roleName |
||
| 639 | * @param string $resourceName |
||
| 640 | * @param string $accessName |
||
| 641 | * @param integer $action |
||
| 642 | * @return boolean |
||
| 643 | * @throws \Phalcon\Acl\Exception |
||
| 644 | */ |
||
| 645 | 4 | protected function insertOrUpdateAccess($roleName, $resourceName, $accessName, $action) |
|
| 709 | } |
||
| 710 | |||
| 711 | /** |
||
| 712 | * Inserts/Updates a permission in the access list |
||
| 713 | * |
||
| 714 | * @param string $roleName |
||
| 715 | * @param string $resourceName |
||
| 716 | * @param array|string $access |
||
| 717 | * @param integer $action |
||
| 718 | * @throws \Phalcon\Acl\Exception |
||
| 719 | */ |
||
| 720 | 4 | protected function allowOrDeny($roleName, $resourceName, $access, $action) |
|
| 721 | { |
||
| 722 | 4 | if (!$this->isRole($roleName)) { |
|
| 723 | throw new Exception("Role '{$roleName}' does not exist in the list"); |
||
| 724 | } |
||
| 725 | 4 | if (!is_array($access)) { |
|
| 726 | 2 | $access = [$access]; |
|
| 727 | } |
||
| 733 | } |
||
| 734 | } |
||
| 735 |
Loading history...