burzum / cakephp-simple-rbac

src/Auth/SimpleRbacAuthorize.php

<?php
namespace Burzum\SimpleRbac\Auth;

use Cake\Auth\BaseAuthorize;
use Cake\Core\Configure;
use Cake\Network\Request;
use Cake\Utility\Inflector;
use RuntimeException;

/**
 * Copyright 2011 - 2015, Florian Krämer
 *
 * Licensed under The MIT License
 * Redistributions of files must retain the above copyright notice.
 *
 * @copyright Copyright 2011 - 2015, Florian Krämer
 * @license MIT License (http://www.opensource.org/licenses/mit-license.php)
 */
class SimpleRbacAuthorize extends BaseAuthorize {

	/**
	 * Default config for this object.
	 *
	 * - `roleField` - The name of the role field in the user data array that is passed to authorize()
	 *
	 * @var array
	 */
	public $_defaultConfig = array(
		'roleField' => 'role',
		'allowEmptyActionMap' => false,
		'allowEmptyPrefixMap' => true,
		'undefinedActionsAreAllowed' => false
	);

	/**
	 * Authorize a user based on his roles
	 *
	 * @param array $user The user to authorize
	 * @param Request $request The request needing authorization.
	 * @return boolean
	 * @throws RuntimeException when the role field does not exist
	 */
	public function authorize($user, Request $request) {
		$roleField = $this->_config['roleField'];

		if (!isset($user[$roleField])) {
			throw new RuntimeException(sprintf('The role field `%s` does not exist!', $roleField));
		}

		if (is_string($user[$roleField])) {
			$user[$roleField] = array($user[$roleField]);
		}

		if ($this->authorizeByPrefix($user[$roleField], $request)) {
			return true;
		}

		if ($this->authorizeByControllerAndAction($user, $request)) {
			return true;
		}

		return false;
	}

	/**
	 * Checks if a role is granted access to a controller and action
	 *
	 * @param array $user
	 * @param Request $request
	 * @return boolean
	 */
	public function authorizeByControllerAndAction($user, Request $request) {
		$roleField = $this->_config['roleField'];
		extract($this->getControllerNameAndAction($request));

$this->getControllerNameAndAction($request) cannot be passed to extract() as the parameter $var_array expects a reference.

		$actionMap = $this->getActionMap();

		if (isset($actionMap[$name]['*'])) {

This code seems to be duplicated across your project.

			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name]['*'])) {
				return true;
			}
		}

		if (isset($actionMap[$name][$action])) {

This code seems to be duplicated across your project.

			if ($this->_isAllowedRole($user[$roleField], $actionMap[$name][$action])) {
				return true;
			}
		}

		if ($this->config('undefinedActionsAreAllowed') === true) {
			return true;
		}

		return false;
	}

	/**
	 * Checks if a role is allowed.
	 *
	 * @param array|string $userRoles
	 * @param array $allowedRoles
	 * @return boolean
	 */
	protected function _isAllowedRole($userRoles, array $allowedRoles) {
		if (in_array('*', $allowedRoles)) {
			return true;
		}
		if (is_string($userRoles)) {
			$userRoles = [$userRoles];
		}
		foreach ($userRoles as $userRole) {
			if (in_array($userRole, $allowedRoles)) {
				return true;
			}
		}
		return false;
	}

	/**
	 * Checks if a role is granted access to a prefix route like /admin.
	 *
	 * @param array $roles
	 * @param Request $request
	 * @return boolean
	 */
	public function authorizeByPrefix(array $roles, Request $request) {
		$prefixeMap = $this->getPrefixMap();
		if (isset($request->params['prefix']) && isset($prefixeMap[$request->params['prefix']])) {
			foreach ($roles as $role) {
				if (in_array($role, $prefixeMap[$request->params['prefix']])) {
					return true;
				}
			}
		}
		return false;
	}

	/**
	 * Gets the controller and action, prefixes the controller with the plugin if there is one
	 *
	 * @param Request $request
	 * @return array
	 */
	public function getControllerNameAndAction(Request $request) {
		$controller = $this->_registry->getController();
		$name = $controller->name;
		$action = $request->action;

The property action does not seem to exist in Cake\Network\Request.

		if (!empty($request->params['plugin'])) {
			$name = Inflector::camelize($request->params['plugin']) . '.' . $name;
		}
		return compact('name', 'action');
	}

	/**
	 * Can be overridden if inherited with a method to fetch this from anywhere, a database for example.
	 *
	 * @return array
	 * @throws RuntimeException
	 */
	public function getActionMap() {

This method seems to be duplicated in your project.

		$actionMap = (array) Configure::read('SimpleRbac.actionMap');
		if (empty($actionMap) && $this->_config['allowEmptyActionMap'] === false) {
			throw new \RuntimeException('SimpleRbac.actionMap configuration is empty!');
		}
		return $actionMap;
	}

	/**
	 * Can be overriden if inherited with a method to fetch this from anywhere, a database for exaple
	 *
	 * @return array
	 * @throws \RuntimeException
	 */
	public function getPrefixMap() {

This method seems to be duplicated in your project.

		$prefixMap = (array) Configure::read('SimpleRbac.prefixMap');
		if (empty($prefixMap) && $this->_config['allowEmptyPrefixMap'] === false) {
			throw new \RuntimeException('SimpleRbac.prefixMap configuration is empty!');
		}
		return $prefixMap;
	}
}