Myth\Auth\FlatAuthorization

Complexity

Total Complexity

91

Size/Duplication

Total Lines	757
Duplicated Lines	26.68 %

Coupling/Cohesion

Components	1
Dependencies	3

Importance

Changes

0

24 Methods

Rating	Name	Duplication	Size	Complexity
A	__construct()	0	7	3
A	error()	0	4	1
A	useModel()	0	6	1
D	inGroup()	0	42	9
C	hasPermission()	0	29	8
D	addUserToGroup()	36	36	9
D	removeUserFromGroup()	36	36	9
B	addPermissionToGroup()	27	27	4
B	removePermissionFromGroup()	27	27	4
B	addPermissionToUser()	0	42	6
B	removePermissionFromUser()	0	38	6
B	doesUserHavePermission()	0	30	5
A	group()	0	9	2
A	groups()	0	4	1
A	createGroup()	18	18	2
A	deleteGroup()	0	11	2
A	updateGroup()	20	20	3
A	getGroupID()	0	18	3
A	permission()	0	9	2
A	permissions()	0	4	1
A	createPermission()	18	18	2
A	deletePermission()	0	14	2
A	updatePermission()	20	20	3
A	getPermissionID()	0	20	3

<?php namespace Myth\Auth;
/**
 * Sprint
 *
 * A set of power tools to enhance the CodeIgniter framework and provide consistent workflow.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 *
 * @package     Sprint
 * @author      Lonnie Ezell
 * @copyright   Copyright 2014-2015, New Myth Media, LLC (http://newmythmedia.com)
 * @license     http://opensource.org/licenses/MIT  (MIT)
 * @link        http://sprintphp.com
 * @since       Version 1.0
 */

use Myth\Auth\Flat\FlatGroupsModel;
use Myth\Auth\Flat\FlatPermissionsModel;
use Myth\Events\Events;

class FlatAuthorization implements AuthorizeInterface {

	protected $groupModel;

	protected $permissionModel;

	protected $error = NULL;

	protected $user_model = null;

	//--------------------------------------------------------------------

	public function __construct($groupModel = null, $permModel = null)
	{
		$this->groupModel      = ! empty($groupModel) ? $groupModel : new FlatGroupsModel();
		$this->permissionModel = ! empty($permModel)  ? $permModel  : new FlatPermissionsModel();

		get_instance()->load->language('auth/auth');
	}

	//--------------------------------------------------------------------

	public function error()
	{
		return $this->error;
	}

	//--------------------------------------------------------------------

	/**
	 * Allows the consuming application to pass in a reference to the
	 * model that should be used.
	 *
	 * @param $model
	 * @return mixed
	 */
	public function useModel($model)
	{
		$this->user_model =& $model;

		return $this;
	}

	//--------------------------------------------------------------------

	//--------------------------------------------------------------------
	// Actions
	//--------------------------------------------------------------------

	/**
	 * Checks to see if a user is in a group.
	 *
	 * Groups can be either a string, with the name of the group, an INT
	 * with the ID of the group, or an array of strings/ids that the
	 * user must belong to ONE of. (It's an OR check not an AND check)
	 *
	 * @param $groups
	 *
	 * @return bool
	 */
	public function inGroup( $groups, $user_id )
	{
		if ( ! is_array( $groups ) )
		{
			$groups = [ $groups ];
		}

		if (empty($user_id))
		{
			return null;
		}

		$user_groups = $this->groupModel->getGroupsForUser( (int) $user_id );

		if ( ! $user_groups )
		{
			return false;
		}

		foreach ( $groups as $group )
		{
			if (is_numeric($group))
			{
				$ids = array_column($user_groups, 'id');
				if (in_array($group, $ids))
				{
					return true;
				}
			}

			else if (is_string($group))
			{
				$ids = array_column($user_groups, 'name');
				if (in_array($group, $ids))
				{
					return true;
				}
			}
		}

		return false;
	}

	//--------------------------------------------------------------------

	/**
	 * Checks a user's groups to see if they have the specified permission.
	 *
	 * @param int|string $permission
	 * @param int|string $user_id
	 *
	 * @return mixed
	 */
	public function hasPermission( $permission, $user_id )
	{
		if (empty($permission) || (! is_string($permission) && ! is_numeric($permission)) )
		{
			return null;
		}

		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		// Get the Permission ID
		$permission_id = $this->getPermissionID($permission);

		if ( ! is_numeric( $permission_id ) )
		{
			return false;
		}

		// First check the permission model. If that exists, then we're golden.
		if ($this->permissionModel->doesUserHavePermission( (int)$user_id, (int)$permission_id ) )
		{
			return true;
		}

		// Still here? Then we have one last check to make - any user private permissions.
		return $this->doesUserHavePermission( (int)$user_id, (int)$permission_id);
	}

	//--------------------------------------------------------------------

	/**
	 * Makes a member a part of a group.
	 *
	 * @param $user_id
	 * @param $group // Either ID or name
	 *
	 * @return bool
	 */
	public function addUserToGroup( $user_id, $group )
	{
		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		if (empty($group) || (! is_numeric($group) && ! is_string($group) ) )
		{
			return null;
		}

		if (! Events::trigger('beforeAddUserToGroup', [$user_id, $group]))
		{
			return false;
		}

		$group_id = $this->getGroupID($group);

		// Group ID
		if ( ! is_numeric( $group_id ) )
		{
			return null;
		}

		if ( ! $this->groupModel->addUserToGroup( (int)$user_id, (int)$group_id ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		Events::trigger('didAddUserToGroup', [$user_id, $group]);

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Removes a single user from a group.
	 *
	 * @param $user_id
	 * @param $group
	 *
	 * @return mixed
	 */
	public function removeUserFromGroup( $user_id, $group )
	{
		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		if (empty($group) || (! is_numeric($group) && ! is_string($group) ) )
		{
			return null;
		}

		if (! Events::trigger('beforeRemoveUserFromGroup', [$user_id, $group]))
		{
			return false;
		}

		$group_id = $this->getGroupID($group);

		// Group ID
		if ( ! is_numeric( $group_id ) )
		{
			return false;
		}

		if ( ! $this->groupModel->removeUserFromGroup( $user_id, $group_id ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		Events::trigger('didRemoveUserFromGroup', [$user_id, $group]);

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Adds a single permission to a single group.
	 *
	 * @param int|string $permission
	 * @param int|string $group
	 *
	 * @return mixed
	 */
	public function addPermissionToGroup( $permission, $group )
	{
		$permission_id = $this->getPermissionID($permission);
		$group_id      = $this->getGroupID($group);

		// Permission ID
		if ( ! is_numeric( $permission_id ) )
		{
			return false;
		}

		// Group ID
		if ( ! is_numeric( $group_id ) )
		{
			return false;
		}

		// Remove it!
		if ( ! $this->groupModel->addPermissionToGroup( $permission_id, $group_id ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Removes a single permission from a group.
	 *
	 * @param int|string $permission
	 * @param int|string $group
	 *
	 * @return mixed
	 */
	public function removePermissionFromGroup( $permission, $group )
	{
		$permission_id = $this->getPermissionID($permission);
		$group_id      = $this->getGroupID($group);

		// Permission ID
		if ( ! is_numeric( $permission_id ) )
		{
			return false;
		}

		// Group ID
		if ( ! is_numeric( $group_id ) )
		{
			return false;
		}

		// Remove it!
		if ( ! $this->groupModel->removePermissionFromGroup( $permission_id, $group_id ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Assigns a single permission to a user, irregardless of permissions
	 * assigned by roles. This is saved to the user's meta information.
	 *
	 * @param int|string $permission
	 * @param int $user_id
	 *
	 * @return int|bool
	 */
	public function addPermissionToUser( $permission, $user_id )
	{
		$permission_id = $this->getPermissionID($permission);

		if (! is_numeric($permission_id) )
		{
			return null;
		}

		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		$user_id = (int)$user_id;

		if (! Events::trigger('beforeAddPermissionToUser', [$user_id, $permission]))
		{
			return false;
		}

		$ci =& get_instance();
		$ci->load->model('User_model');

		$permissions = $ci->user_model->getMetaItem($user_id, 'RBAC_permissions');

		// If we already have permissions, unserialize them and add
		// the new permission to it.
		if (! empty($permissions))
		{
			$permissions = unserialize($permissions);
		}
		else
		{
			$permissions = [];
		}

		$permissions[] = $permission_id;

		// Save the updated permissions
		return $ci->user_model->saveMetaToUser($user_id, 'RBAC_permissions', serialize($permissions));
	}

	//--------------------------------------------------------------------

	/**
	 * Removes a single permission from a user. Only applies to permissions
	 * that have been assigned with addPermissionToUser, not to permissions
	 * inherited based on groups they belong to.
	 *
	 * @param int/string $permission
	 * @param int        $user_id
	 */
	public function removePermissionFromUser( $permission, $user_id )
	{
		$permission_id = $this->getPermissionID($permission);

		if (! is_numeric($permission_id) )
		{
			return false;
		}

		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		$user_id = (int)$user_id;

		if (! Events::trigger('beforeRemovePermissionFromUser', [$user_id, $permission]))
		{
			return false;
		}

		// Grab the existing permissions for this user, and remove
		// the permission id from the list.
		$ci =& get_instance();
		$ci->load->model('User_model');

		$permissions = $ci->user_model->getMetaItem($user_id, 'RBAC_permissions');

		if (! is_array($permissions))
		{
			$permissions = [];
		}

		unset($permissions[ array_search($permission_id, $permissions) ]);

		// Save the updated permissions
		return $ci->user_model->saveMetaToUser($user_id, 'RBAC_permissions', serialize($permissions));
	}

	//--------------------------------------------------------------------

	/**
	 * Checks to see if a user has private permission assigned to it.
	 *
	 * @param $user_id
	 * @param $permission
	 *
	 * @return bool|null
	 */
	public function doesUserHavePermission($user_id, $permission)
	{
		$permission_id = $this->getPermissionID($permission);

		if (! is_numeric($permission_id) )
		{
			return false;
		}

		if (empty($user_id) || ! is_numeric($user_id))
		{
			return null;
		}

		$user_id = (int)$user_id;

		$model = $this->user_model;

		if (empty($model))
		{
			$ci =& get_instance();
			$ci->load->model( 'User_model' );

			$model = $ci->user_model;
		}

		$permissions = $model->getMetaItem($user_id, 'RBAC_permissions');

		return in_array($permission_id, $permissions);
	}

	//--------------------------------------------------------------------



	//--------------------------------------------------------------------
	// Groups
	//--------------------------------------------------------------------

	/**
	 * Grabs the details about a single group.
	 *
	 * @param $group
	 *
	 * @return object|null
	 */
	public function group( $group )
	{
		if ( is_numeric( $group ) )
		{
			return $this->groupModel->find( (int) $group );
		}

		return $this->groupModel->find_by( 'name', $group );
	}

	//--------------------------------------------------------------------

	/**
	 * Grabs an array of all groups.
	 *
	 * @return array of objects
	 */
	public function groups()
	{
		return $this->groupModel->find_all();
	}

	//--------------------------------------------------------------------

	/**
	 * @param $name
	 * @param string $description
	 *
	 * @return mixed
	 */
	public function createGroup( $name, $description = '' )
	{
		$data = [
			'name'        => $name,
			'description' => $description
		];

		$id = $this->groupModel->insert( $data );

		if ( is_numeric( $id ) )
		{
			return (int) $id;
		}

		$this->error = $this->groupModel->error();

		return FALSE;
	}

	//--------------------------------------------------------------------

	/**
	 * Deletes a single group.
	 *
	 * @param int $group_id
	 *
	 * @return bool
	 */
	public function deleteGroup( $group_id )
	{
		if ( ! $this->groupModel->delete( $group_id ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Updates a single group's information.
	 *
	 * @param $id
	 * @param $name
	 * @param string $description
	 *
	 * @return mixed
	 */
	public function updateGroup( $id, $name, $description = '' )
	{
		$data = [
			'name' => $name
		];

		if ( ! empty( $description ) )
		{
			$data['description'] = $description;
		}

		if ( ! $this->groupModel->update( (int) $id, $data ) )
		{
			$this->error = $this->groupModel->error();

			return FALSE;
		}

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Given a group, will return the group ID. The group can be either
	 * the ID or the name of the group.
	 *
	 * @param int|string $group
	 *
	 * @return int|false
	 */
	protected function getGroupID( $group )
	{
		if (is_numeric($group))
		{
			return (int)$group;
		}

		$g = $this->groupModel->find_by( 'name', $group );

		if ( ! $g )
		{
			$this->error = lang('auth.group_not_found');

			return FALSE;
		}

		return (int)$g->id;
	}

	//--------------------------------------------------------------------

	//--------------------------------------------------------------------
	// Permissions
	//--------------------------------------------------------------------

	/**
	 * Returns the details about a single permission.
	 *
	 * @param int|string $permission
	 *
	 * @return object|null
	 */
	public function permission( $permission )
	{
		if ( is_numeric( $permission ) )
		{
			return $this->permissionModel->find( (int) $permission );
		}

		return $this->permissionModel->find_by( 'LOWER(name)', strtolower( $permission ) );
	}

	//--------------------------------------------------------------------

	/**
	 * Returns an array of all permissions in the system.
	 *
	 * @return mixed
	 */
	public function permissions()
	{
		return $this->permissionModel->find_all();
	}

	//--------------------------------------------------------------------

	/**
	 * Creates a single permission.
	 *
	 * @param $name
	 * @param string $description
	 *
	 * @return mixed
	 */
	public function createPermission( $name, $description = '' )
	{
		$data = [
			'name'        => $name,
			'description' => $description
		];

		$id = $this->permissionModel->insert( $data );

		if ( is_numeric( $id ) )
		{
			return (int) $id;
		}

		$this->error = $this->permissionModel->error();

		return FALSE;
	}

	//--------------------------------------------------------------------

	/**
	 * Deletes a single permission and removes that permission from all groups.
	 *
	 * @param $permission
	 *
	 * @return mixed
	 */
	public function deletePermission( $permission_id )
	{
		if ( ! $this->permissionModel->delete( $permission_id ) )
		{
			$this->error = $this->permissionModel->error();

			return FALSE;
		}

		// Remove the permission from all groups
		$this->groupModel->removePermissionFromAllGroups( $permission_id );

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Updates the details for a single permission.
	 *
	 * @param int $id
	 * @param string $name
	 * @param string $description
	 *
	 * @return bool
	 */
	public function updatePermission( $id, $name, $description = '' )
	{
		$data = [
			'name' => $name
		];

		if ( ! empty( $description ) )
		{
			$data['description'] = $description;
		}

		if ( ! $this->permissionModel->update( (int) $id, $data ) )
		{
			$this->error = $this->permissionModel->error();

			return FALSE;
		}

		return TRUE;
	}

	//--------------------------------------------------------------------

	/**
	 * Verifies that a permission (either ID or the name) exists and returns
	 * the permission ID.
	 *
	 * @param int|string $permission
	 *
	 * @return int|null
	 */
	protected function getPermissionID( $permission )
	{
		// If it's a number, we're done here.
		if (is_numeric($permission))
		{
			return (int)$permission;
		}

		// Otherwise, pull it from the database.
		$p = $this->permissionModel->find_by( 'name', $permission );

		if ( ! $p )
		{
			$this->error = lang('auth.permission_not_found');

			return FALSE;
		}

		return (int)$p->id;
	}

	//--------------------------------------------------------------------

}