1
|
|
|
<?php |
2
|
|
|
namespace Ubiquity\security\acl\models; |
3
|
|
|
|
4
|
|
|
use Ubiquity\security\acl\persistence\AclProviderInterface; |
5
|
|
|
use Ubiquity\exceptions\AclException; |
6
|
|
|
|
7
|
|
|
/** |
8
|
|
|
* Ubiquity\security\acl\models$AclList |
9
|
|
|
* This class is part of Ubiquity |
10
|
|
|
* |
11
|
|
|
* @author jc |
12
|
|
|
* @version 1.0.0 |
13
|
|
|
* |
14
|
|
|
*/ |
15
|
|
|
class AclList { |
16
|
|
|
|
17
|
|
|
/** |
18
|
|
|
* |
19
|
|
|
* @var AclElement[] |
20
|
|
|
*/ |
21
|
|
|
protected $acls; |
22
|
|
|
|
23
|
|
|
/** |
24
|
|
|
* |
25
|
|
|
* @var Role[] |
26
|
|
|
*/ |
27
|
|
|
protected $roles; |
28
|
|
|
|
29
|
|
|
/** |
30
|
|
|
* |
31
|
|
|
* @var \Ubiquity\security\acl\models\Resource[] |
32
|
|
|
*/ |
33
|
|
|
protected $resources; |
34
|
|
|
|
35
|
|
|
/** |
36
|
|
|
* |
37
|
|
|
* @var Permission[] |
38
|
|
|
*/ |
39
|
|
|
protected $permissions; |
40
|
|
|
|
41
|
|
|
/** |
42
|
|
|
* |
43
|
|
|
* @var AclProviderInterface[] |
44
|
|
|
*/ |
45
|
|
|
protected $providers = []; |
46
|
|
|
|
47
|
|
|
protected $elementsCache = []; |
48
|
|
|
|
49
|
14 |
|
protected function getElementByName(string $name, array $inArray, string $type) { |
50
|
14 |
|
foreach ($inArray as $elm) { |
51
|
14 |
|
if ($elm->getName() == $name) { |
52
|
13 |
|
return $elm; |
53
|
|
|
} |
54
|
|
|
} |
55
|
3 |
|
throw new AclException("$name does not exist in $type ACL"); |
56
|
|
|
} |
57
|
|
|
|
58
|
|
|
protected function elementExistByName(string $name, array $inArray): bool { |
59
|
|
|
foreach ($inArray as $elm) { |
60
|
|
|
if ($elm->getName() == $name) { |
61
|
|
|
return true; |
62
|
|
|
} |
63
|
|
|
} |
64
|
|
|
return false; |
65
|
|
|
} |
66
|
|
|
|
67
|
14 |
|
public function init() { |
68
|
14 |
|
$this->roles['role_@ALL'] = new Role('@ALL'); |
69
|
14 |
|
$this->resources['res_*'] = new Resource('*'); |
70
|
14 |
|
$this->permissions['perm_ALL'] = new Permission('ALL', 1000); |
71
|
14 |
|
$this->acls = []; |
72
|
14 |
|
} |
73
|
|
|
|
74
|
14 |
|
public function getRoleByName(string $name) { |
75
|
14 |
|
return $this->elementsCache["role_$name"] ??= $this->getElementByName($name, $this->roles, 'roles'); |
76
|
|
|
} |
77
|
|
|
|
78
|
6 |
|
public function getResourceByName(string $name) { |
79
|
6 |
|
return $this->elementsCache["res_$name"] ??= $this->getElementByName($name, $this->resources, 'resources'); |
80
|
|
|
} |
81
|
|
|
|
82
|
10 |
|
public function getPermissionByName(string $name) { |
83
|
10 |
|
return $this->elementsCache["perm_$name"] ??= $this->getElementByName($name, $this->permissions, 'permissions'); |
84
|
|
|
} |
85
|
|
|
|
86
|
6 |
|
public function loadAcls(): array { |
87
|
6 |
|
foreach ($this->providers as $provider) { |
88
|
6 |
|
$this->acls += $provider->loadAllAcls(); |
89
|
|
|
} |
90
|
6 |
|
return $this->acls; |
91
|
|
|
} |
92
|
|
|
|
93
|
6 |
|
public function loadRoles(): array { |
94
|
6 |
|
foreach ($this->providers as $provider) { |
95
|
6 |
|
$this->roles += $provider->loadAllRoles(); |
96
|
|
|
} |
97
|
6 |
|
return $this->roles; |
98
|
|
|
} |
99
|
|
|
|
100
|
6 |
|
public function loadResources(): array { |
101
|
6 |
|
foreach ($this->providers as $provider) { |
102
|
6 |
|
$this->resources += $provider->loadAllResources(); |
103
|
|
|
} |
104
|
6 |
|
return $this->resources; |
105
|
|
|
} |
106
|
|
|
|
107
|
6 |
|
public function loadPermissions(): array { |
108
|
6 |
|
foreach ($this->providers as $provider) { |
109
|
6 |
|
$this->permissions += $provider->loadAllPermissions(); |
110
|
|
|
} |
111
|
6 |
|
return $this->permissions; |
112
|
|
|
} |
113
|
|
|
|
114
|
|
|
public function addProvider(AclProviderInterface $provider) { |
115
|
|
|
$this->providers[] = $provider; |
116
|
|
|
} |
117
|
|
|
|
118
|
|
|
/** |
119
|
|
|
* |
120
|
|
|
* @return AclElement[] |
121
|
|
|
*/ |
122
|
3 |
|
public function getAcls() { |
123
|
3 |
|
return $this->acls; |
124
|
|
|
} |
125
|
|
|
|
126
|
|
|
/** |
127
|
|
|
* |
128
|
|
|
* @return Role[] |
129
|
|
|
*/ |
130
|
3 |
|
public function getRoles() { |
131
|
3 |
|
return $this->roles; |
132
|
|
|
} |
133
|
|
|
|
134
|
|
|
/** |
135
|
|
|
* |
136
|
|
|
* @return \Ubiquity\security\acl\models\Resource[] |
137
|
|
|
*/ |
138
|
3 |
|
public function getResources() { |
139
|
3 |
|
return $this->resources; |
140
|
|
|
} |
141
|
|
|
|
142
|
|
|
/** |
143
|
|
|
* |
144
|
|
|
* @return Permission[] |
145
|
|
|
*/ |
146
|
5 |
|
public function getPermissions() { |
147
|
5 |
|
return $this->permissions; |
148
|
|
|
} |
149
|
|
|
|
150
|
|
|
/** |
151
|
|
|
* |
152
|
|
|
* @return AclProviderInterface[] |
153
|
|
|
*/ |
154
|
|
|
public function getProviders() { |
155
|
|
|
return $this->providers; |
156
|
|
|
} |
157
|
|
|
|
158
|
|
|
/** |
159
|
|
|
* |
160
|
|
|
* @param AclProviderInterface[] $providers |
161
|
|
|
*/ |
162
|
7 |
|
public function setProviders($providers) { |
163
|
7 |
|
$this->providers = $providers; |
164
|
7 |
|
} |
165
|
|
|
|
166
|
5 |
|
public function addRole(Role $role) { |
167
|
5 |
|
$this->roles[$role->getName()] = $role; |
168
|
5 |
|
$this->savePart($role); |
169
|
5 |
|
} |
170
|
|
|
|
171
|
4 |
|
public function addResource(Resource $resource) { |
172
|
4 |
|
$this->resources[$resource->getName()] = $resource; |
173
|
4 |
|
$this->savePart($resource); |
174
|
4 |
|
} |
175
|
|
|
|
176
|
5 |
|
public function addPermission(Permission $permission) { |
177
|
5 |
|
$this->permissions[$permission->getName()] = $permission; |
178
|
5 |
|
$this->savePart($permission); |
179
|
5 |
|
} |
180
|
|
|
|
181
|
3 |
|
public function setPermissionLevel(string $name, int $level) { |
182
|
3 |
|
$perm = $this->getPermissionByName($name); |
183
|
2 |
|
$perm->setLevel($level); |
184
|
2 |
|
$this->updatePart($perm); |
185
|
|
|
} |
186
|
6 |
|
|
187
|
6 |
|
public function allow(string $roleName, string $resourceName, string $permissionName) { |
188
|
6 |
|
$aclElm = new AclElement(); |
189
|
6 |
|
$aclElm->allow($this->getRoleByName($roleName), $this->getResourceByName($resourceName), $this->getPermissionByName($permissionName)); |
190
|
6 |
|
$this->acls[] = $aclElm; |
191
|
6 |
|
$this->saveAclElement($aclElm); |
192
|
|
|
} |
193
|
14 |
|
|
194
|
14 |
|
public function getRolePermissionsOn(string $roleName, $resourceName = '*'): array { |
195
|
13 |
|
$role = $this->getRoleByName($roleName); |
196
|
13 |
|
$parents = $role->getParentsArray(); |
197
|
13 |
|
$result = []; |
198
|
10 |
|
foreach ($this->acls as $aclElement) { |
199
|
10 |
|
$aclRoleName = $aclElement->getRole()->getName(); |
200
|
10 |
|
if ($aclRoleName === '@ALL' || $aclRoleName === $roleName) { |
201
|
10 |
|
$aclResourceName = $aclElement->getResource()->getName(); |
202
|
10 |
|
if ($aclResourceName === '*' || $aclResourceName === $resourceName) { |
203
|
|
|
$result[] = $aclElement; |
204
|
|
|
} |
205
|
|
|
} |
206
|
13 |
|
} |
207
|
3 |
|
foreach ($parents as $parentElm) { |
208
|
|
|
$result += $this->getRolePermissionsOn($parentElm, $resourceName); |
209
|
13 |
|
} |
210
|
|
|
return $result; |
211
|
|
|
} |
212
|
14 |
|
|
213
|
14 |
|
public function isAllowed(string $roleName, string $resourceName, string $permissionName) { |
214
|
13 |
|
$acls = $this->getRolePermissionsOn($roleName, $resourceName); |
215
|
10 |
|
if (\count($acls) > 0) { |
216
|
9 |
|
$permissionLevel = $this->getPermissionByName($permissionName)->getLevel(); |
217
|
9 |
|
foreach ($acls as $aclElm) { |
218
|
9 |
|
$level = $aclElm->getPermission()->getLevel(); |
219
|
9 |
|
if ($level >= $permissionLevel) { |
220
|
|
|
return true; |
221
|
|
|
} |
222
|
|
|
} |
223
|
10 |
|
} |
224
|
|
|
return false; |
225
|
|
|
} |
226
|
6 |
|
|
227
|
6 |
|
public function saveAclElement(AclElement $aclElement) { |
228
|
2 |
|
foreach ($this->providers as $provider) { |
229
|
|
|
$provider->saveAcl($aclElement); |
230
|
6 |
|
} |
231
|
|
|
} |
232
|
8 |
|
|
233
|
8 |
|
public function removeAclElement(AclElement $aclElement) { |
234
|
4 |
|
foreach ($this->providers as $provider) { |
235
|
|
|
$provider->removeAcl($aclElement); |
236
|
8 |
|
} |
237
|
|
|
} |
238
|
1 |
|
|
239
|
1 |
|
public function savePart(AbstractAclPart $aclPart) { |
240
|
1 |
|
foreach ($this->providers as $provider) { |
241
|
1 |
|
$provider->savePart($aclPart); |
242
|
|
|
} |
243
|
|
|
} |
244
|
1 |
|
|
245
|
|
|
public function updatePart(AbstractAclPart $aclPart) { |
246
|
|
|
foreach ($this->providers as $provider) { |
247
|
|
|
$provider->updatePart($aclPart); |
248
|
|
|
} |
249
|
|
|
} |
250
|
|
|
|
251
|
|
|
public function removePart(AbstractAclPart $aclPart) { |
252
|
|
|
foreach ($this->providers as $provider) { |
253
|
|
|
$provider->removePart($aclPart); |
254
|
|
|
} |
255
|
|
|
} |
256
|
|
|
|
257
|
|
|
public function removeRole(string $roleName) { |
258
|
|
|
$role = $this->getRoleByName($roleName); |
259
|
|
|
unset($this->roles["role_$roleName"]); |
260
|
|
|
return $this->removePart($role); |
|
|
|
|
261
|
|
|
} |
262
|
|
|
|
263
|
|
|
public function removePermission(string $permissionName) { |
264
|
|
|
$permission = $this->getRoleByName($permissionName); |
265
|
|
|
unset($this->permissions["perm_$permissionName"]); |
266
|
|
|
return $this->removePart($permission); |
|
|
|
|
267
|
|
|
} |
268
|
|
|
|
269
|
|
|
public function removeResource(string $resourceName) { |
270
|
|
|
$resource = $this->getRoleByName($resourceName); |
271
|
|
|
unset($this->resources["res_$resourceName"]); |
272
|
|
|
return $this->removePart($resource); |
|
|
|
|
273
|
|
|
} |
274
|
|
|
|
275
|
|
|
public function removeAcl(string $roleName, string $resourceName, string $permissionName = null) { |
276
|
|
|
$toRemove = []; |
277
|
|
|
foreach ($this->acls as $index => $acl) { |
278
|
|
|
if ($acl->getResource()->getName() === $resourceName && $acl->getRole()->getName() === $roleName) { |
279
|
|
|
if ($permissionName == null || $acl->getPermission()->getName() === $permissionName) { |
|
|
|
|
280
|
|
|
foreach ($this->providers as $provider) { |
281
|
|
|
$provider->removeAcl($acl); |
282
|
|
|
} |
283
|
|
|
$toRemove[] = $index; |
284
|
|
|
} |
285
|
|
|
} |
286
|
|
|
} |
287
|
|
|
foreach ($toRemove as $remove) { |
288
|
|
|
unset($this->acls[$remove]); |
289
|
|
|
} |
290
|
|
|
} |
291
|
|
|
|
292
|
|
|
public function saveAll() { |
293
|
|
|
foreach ($this->providers as $provider) { |
294
|
|
|
if (! $provider->isAutosave()) { |
295
|
|
|
$provider->saveAll(); |
296
|
|
|
} |
297
|
|
|
} |
298
|
|
|
} |
299
|
|
|
} |
300
|
|
|
|
301
|
|
|
|
This check looks for function or method calls that always return null and whose return value is used.
The method
getObject()
can return nothing but null, so it makes no sense to use the return value.The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.