|
1
|
|
|
<?php /** MicroDbRBAC */ |
|
2
|
|
|
|
|
3
|
|
|
namespace Micro\Auth\Drivers; |
|
4
|
|
|
|
|
5
|
|
|
use Micro\Db\IConnection; |
|
6
|
|
|
use Micro\Mvc\Models\Query; |
|
7
|
|
|
|
|
8
|
|
|
/** |
|
9
|
|
|
* Database RBAC class file. |
|
10
|
|
|
* |
|
11
|
|
|
* RBAC security logic with DB |
|
12
|
|
|
* |
|
13
|
|
|
* @author Oleg Lunegov <[email protected]> |
|
14
|
|
|
* @link https://github.com/linpax/microphp-framework |
|
15
|
|
|
* @copyright Copyright (c) 2013 Oleg Lunegov |
|
16
|
|
|
* @license https://github.com/linpax/microphp-framework/blob/master/LICENSE |
|
17
|
|
|
* @package Micro |
|
18
|
|
|
* @subpackage Auth\Drivers |
|
19
|
|
|
* @version 1.0 |
|
20
|
|
|
* @since 1.0 |
|
21
|
|
|
*/ |
|
22
|
|
|
class DbRbac extends Rbac |
|
23
|
|
|
{ |
|
24
|
|
|
/** |
|
25
|
|
|
* Constructor file RBAC |
|
26
|
|
|
* |
|
27
|
|
|
* @public |
|
28
|
|
|
* |
|
29
|
|
|
* @param IConnection $connection |
|
30
|
|
|
* |
|
31
|
|
|
* @result void |
|
32
|
|
|
*/ |
|
33
|
|
|
public function __construct(IConnection $connection) |
|
34
|
|
|
{ |
|
35
|
|
|
parent::__construct($connection); |
|
36
|
|
|
|
|
37
|
|
View Code Duplication |
if (!$this->db->tableExists('rbac_role')) { |
|
|
|
|
|
|
38
|
|
|
$this->db->createTable('rbac_role', [ |
|
39
|
|
|
'`name` varchar(127) NOT NULL', |
|
40
|
|
|
'`type` int(11) NOT NULL DEFAULT \'0\'', |
|
41
|
|
|
'`based` varchar(127)', |
|
42
|
|
|
'`data` text', |
|
43
|
|
|
'UNIQUE KEY `name` (`name`)' |
|
44
|
|
|
], 'ENGINE=MyISAM DEFAULT CHARSET=utf8'); |
|
45
|
|
|
} |
|
46
|
|
|
} |
|
47
|
|
|
|
|
48
|
|
|
/** |
|
49
|
|
|
* Assign RBAC element into user |
|
50
|
|
|
* |
|
51
|
|
|
* @access public |
|
52
|
|
|
* |
|
53
|
|
|
* @param integer $userId user ID |
|
54
|
|
|
* @param string $name assign element name |
|
55
|
|
|
* |
|
56
|
|
|
* @return bool |
|
57
|
|
|
*/ |
|
58
|
|
|
public function assign($userId, $name) |
|
59
|
|
|
{ |
|
60
|
|
|
if ($this->db->exists('rbac_role', |
|
61
|
|
|
['name' => $name]) && $this->db->exists('user', |
|
62
|
|
|
['id' => $userId]) |
|
63
|
|
|
) { |
|
64
|
|
|
return $this->db->insert('rbac_user', ['role' => $name, 'user' => $userId]); |
|
65
|
|
|
} |
|
66
|
|
|
|
|
67
|
|
|
return false; |
|
68
|
|
|
} |
|
69
|
|
|
|
|
70
|
|
|
/** |
|
71
|
|
|
* Check privileges to operation |
|
72
|
|
|
* |
|
73
|
|
|
* @access public |
|
74
|
|
|
* |
|
75
|
|
|
* @param integer $userId user id |
|
76
|
|
|
* @param string $action checked action |
|
77
|
|
|
* @param array $data action params |
|
78
|
|
|
* |
|
79
|
|
|
* @return boolean |
|
80
|
|
|
* @throws \Micro\Base\Exception |
|
81
|
|
|
*/ |
|
82
|
|
|
public function check($userId, $action, array $data = []) |
|
83
|
|
|
{ |
|
84
|
|
|
return $this->db->exists('rbac_role', ['name' => $action]) ? parent::check($userId, $action, $data) : false; |
|
85
|
|
|
} |
|
86
|
|
|
|
|
87
|
|
|
/** |
|
88
|
|
|
* Add new element into RBAC rules |
|
89
|
|
|
* |
|
90
|
|
|
* @access public |
|
91
|
|
|
* |
|
92
|
|
|
* @param string $name element name |
|
93
|
|
|
* @param int $type element type |
|
94
|
|
|
* @param string $based based element name |
|
95
|
|
|
* @param string $data element params |
|
96
|
|
|
* |
|
97
|
|
|
* @return bool |
|
98
|
|
|
*/ |
|
99
|
|
|
public function create($name, $type = self::TYPE_ROLE, $based = null, $data = null) |
|
100
|
|
|
{ |
|
101
|
|
|
if ($this->db->exists('rbac_role', ['name' => $name])) { |
|
102
|
|
|
return false; |
|
103
|
|
|
} |
|
104
|
|
|
|
|
105
|
|
|
if (null !== $based && !$this->db->exists('rbac_role', ['name' => $based])) { |
|
106
|
|
|
return false; |
|
107
|
|
|
} |
|
108
|
|
|
|
|
109
|
|
|
switch ($type) { |
|
110
|
|
|
case Rbac::TYPE_ROLE: |
|
111
|
|
|
case Rbac::TYPE_OPERATION: |
|
112
|
|
|
case Rbac::TYPE_PERMISSION: |
|
113
|
|
|
break; |
|
114
|
|
|
default: |
|
115
|
|
|
return false; |
|
116
|
|
|
} |
|
117
|
|
|
|
|
118
|
|
|
return $this->db->insert('rbac_role', ['name' => $name, 'type' => $type, 'based' => $based, 'data' => $data]); |
|
119
|
|
|
} |
|
120
|
|
|
|
|
121
|
|
|
/** |
|
122
|
|
|
* Delete element from RBAC rules |
|
123
|
|
|
* |
|
124
|
|
|
* @access public |
|
125
|
|
|
* |
|
126
|
|
|
* @param string $name element name |
|
127
|
|
|
* |
|
128
|
|
|
* @result void |
|
129
|
|
|
* @throws \Micro\Base\Exception |
|
130
|
|
|
*/ |
|
131
|
|
|
public function delete($name) |
|
132
|
|
|
{ |
|
133
|
|
|
$tree = $this->searchRoleRecursive($this->tree($this->rawRoles()), $name); |
|
|
|
|
|
|
134
|
|
|
if ($tree) { |
|
135
|
|
|
$this->recursiveDelete($tree); |
|
136
|
|
|
} |
|
137
|
|
|
} |
|
138
|
|
|
|
|
139
|
|
|
/** |
|
140
|
|
|
* Get raw roles |
|
141
|
|
|
* |
|
142
|
|
|
* @access public |
|
143
|
|
|
* |
|
144
|
|
|
* @param int $pdo PHPDataObject fetch key |
|
145
|
|
|
* |
|
146
|
|
|
* @return mixed |
|
147
|
|
|
* @throws \Micro\Base\Exception |
|
148
|
|
|
*/ |
|
149
|
|
|
public function rawRoles($pdo = \PDO::FETCH_ASSOC) |
|
150
|
|
|
{ |
|
151
|
|
|
$query = new Query($this->db); |
|
152
|
|
|
$query->table = $this->db->getDriverType() === 'pgsql' ? '"rbac_role"' : '`rbac_role`'; |
|
153
|
|
|
$query->order = $this->db->getDriverType() === 'pgsql' ? '"type" ASC' : '`type` ASC'; |
|
154
|
|
|
$query->single = false; |
|
155
|
|
|
|
|
156
|
|
|
return $query->run($pdo); |
|
157
|
|
|
} |
|
158
|
|
|
|
|
159
|
|
|
/** |
|
160
|
|
|
* Recursive delete roles from array |
|
161
|
|
|
* |
|
162
|
|
|
* @access public |
|
163
|
|
|
* |
|
164
|
|
|
* @param array $tree elements tree |
|
165
|
|
|
* |
|
166
|
|
|
* @return void |
|
167
|
|
|
*/ |
|
168
|
|
|
public function recursiveDelete(&$tree) |
|
169
|
|
|
{ |
|
170
|
|
|
foreach ($tree AS $key => $element) { |
|
171
|
|
|
$this->db->delete('rbac_user', 'role=:name', ['name' => $element['name']]); |
|
172
|
|
|
$this->db->delete('rbac_role', 'name=:name', ['name' => $element['name']]); |
|
173
|
|
|
|
|
174
|
|
|
if (!empty($tree['childs'])) { |
|
175
|
|
|
$this->recursiveDelete($element['childs']); |
|
176
|
|
|
} |
|
177
|
|
|
unset($tree[$key]); |
|
178
|
|
|
} |
|
179
|
|
|
} |
|
180
|
|
|
} |
|
181
|
|
|
|
linpax /
microphp-framework
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.