silverstripe /
silverstripe-framework
Complex classes like Permission often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use Permission, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 27 | class Permission extends DataObject implements TemplateGlobalProvider { |
||
| 28 | |||
| 29 | // the (1) after Type specifies the DB default value which is needed for |
||
| 30 | // upgrades from older SilverStripe versions |
||
| 31 | private static $db = array( |
||
| 32 | "Code" => "Varchar(255)", |
||
| 33 | "Arg" => "Int", |
||
| 34 | "Type" => "Int(1)" |
||
| 35 | ); |
||
| 36 | |||
| 37 | private static $has_one = array( |
||
| 38 | "Group" => "SilverStripe\\Security\\Group" |
||
| 39 | ); |
||
| 40 | |||
| 41 | private static $indexes = array( |
||
| 42 | "Code" => true |
||
| 43 | ); |
||
| 44 | |||
| 45 | private static $defaults = array( |
||
| 46 | "Type" => 1 |
||
| 47 | ); |
||
| 48 | |||
| 49 | private static $table_name = "Permission"; |
||
| 50 | |||
| 51 | /** |
||
| 52 | * This is the value to use for the "Type" field if a permission should be |
||
| 53 | * granted. |
||
| 54 | */ |
||
| 55 | const GRANT_PERMISSION = 1; |
||
| 56 | |||
| 57 | /** |
||
| 58 | * This is the value to use for the "Type" field if a permission should be |
||
| 59 | * denied. |
||
| 60 | */ |
||
| 61 | const DENY_PERMISSION = -1; |
||
| 62 | |||
| 63 | /** |
||
| 64 | * This is the value to use for the "Type" field if a permission should be |
||
| 65 | * inherited. |
||
| 66 | */ |
||
| 67 | const INHERIT_PERMISSION = 0; |
||
| 68 | |||
| 69 | |||
| 70 | /** |
||
| 71 | * Method to globally disable "strict" checking, which means a permission |
||
| 72 | * will be granted if the key does not exist at all. |
||
| 73 | * |
||
| 74 | * @var array |
||
| 75 | */ |
||
| 76 | private static $declared_permissions = null; |
||
| 77 | |||
| 78 | /** |
||
| 79 | * Linear list of declared permissions in the system. |
||
| 80 | * |
||
| 81 | * @var array |
||
| 82 | */ |
||
| 83 | private static $declared_permissions_list = null; |
||
| 84 | |||
| 85 | /** |
||
| 86 | * @config |
||
| 87 | * @var $strict_checking Boolean Method to globally disable "strict" checking, |
||
| 88 | * which means a permission will be granted if the key does not exist at all. |
||
| 89 | */ |
||
| 90 | private static $strict_checking = true; |
||
| 91 | |||
| 92 | /** |
||
| 93 | * Set to false to prevent the 'ADMIN' permission from implying all |
||
| 94 | * permissions in the system |
||
| 95 | * |
||
| 96 | * @config |
||
| 97 | * @var bool |
||
| 98 | */ |
||
| 99 | private static $admin_implies_all = true; |
||
| 100 | |||
| 101 | /** |
||
| 102 | * a list of permission codes which doesn't appear in the Permission list |
||
| 103 | * when make the {@link PermissionCheckboxSetField} |
||
| 104 | * @config |
||
| 105 | * @var array; |
||
| 106 | */ |
||
| 107 | private static $hidden_permissions = array(); |
||
| 108 | |||
| 109 | /** |
||
| 110 | * @config These permissions can only be applied by ADMIN users, to prevent |
||
| 111 | * privilege escalation on group assignments and inheritance. |
||
| 112 | * @var array |
||
| 113 | */ |
||
| 114 | private static $privileged_permissions = array( |
||
| 115 | 'ADMIN', |
||
| 116 | 'APPLY_ROLES', |
||
| 117 | 'EDIT_PERMISSIONS' |
||
| 118 | ); |
||
| 119 | |||
| 120 | /** |
||
| 121 | * Check that the current member has the given permission. |
||
| 122 | * |
||
| 123 | * @param string|array $code Code of the permission to check (case-sensitive) |
||
| 124 | * @param string $arg Optional argument (e.g. a permissions for a specific page) |
||
| 125 | * @param int|Member $member Optional member instance or ID. If set to NULL, the permssion |
||
| 126 | * will be checked for the current user |
||
| 127 | * @param bool $strict Use "strict" checking (which means a permission |
||
| 128 | * will be granted if the key does not exist at all)? |
||
| 129 | * @return int|bool The ID of the permission record if the permission |
||
| 130 | * exists; FALSE otherwise. If "strict" checking is |
||
| 131 | * disabled, TRUE will be returned if the permission does not exist at all. |
||
| 132 | */ |
||
| 133 | public static function check($code, $arg = "any", $member = null, $strict = true) { |
||
| 143 | |||
| 144 | /** |
||
| 145 | * Permissions cache. The format is a map, where the keys are member IDs, and the values are |
||
| 146 | * arrays of permission codes. |
||
| 147 | */ |
||
| 148 | private static $cache_permissions = array(); |
||
| 149 | |||
| 150 | /** |
||
| 151 | * Flush the permission cache, for example if you have edited group membership or a permission record. |
||
| 152 | * @todo Call this whenever Group_Members is added to or removed from |
||
| 153 | */ |
||
| 154 | public static function flush_permission_cache() { |
||
| 157 | |||
| 158 | /** |
||
| 159 | * Check that the given member has the given permission. |
||
| 160 | * |
||
| 161 | * @param int|Member memberID The ID of the member to check. Leave blank for the current member. |
||
| 162 | * Alternatively you can use a member object. |
||
| 163 | * @param string|array $code Code of the permission to check (case-sensitive) |
||
| 164 | * @param string $arg Optional argument (e.g. a permissions for a specific page) |
||
| 165 | * @param bool $strict Use "strict" checking (which means a permission |
||
| 166 | * will be granted if the key does not exist at all)? |
||
| 167 | * @return int|bool The ID of the permission record if the permission |
||
| 168 | * exists; FALSE otherwise. If "strict" checking is |
||
| 169 | * disabled, TRUE will be returned if the permission does not exist at all. |
||
| 170 | */ |
||
| 171 | public static function checkMember($member, $code, $arg = "any", $strict = true) { |
||
| 289 | |||
| 290 | /** |
||
| 291 | * Get all the 'any' permission codes available to the given member. |
||
| 292 | * |
||
| 293 | * @param int $memberID |
||
| 294 | * @return array |
||
| 295 | */ |
||
| 296 | public static function permissions_for_member($memberID) { |
||
| 327 | |||
| 328 | |||
| 329 | /** |
||
| 330 | * Get the list of groups that the given member belongs to. |
||
| 331 | * |
||
| 332 | * Call without an argument to get the groups that the current member |
||
| 333 | * belongs to. In this case, the results will be session-cached. |
||
| 334 | * |
||
| 335 | * @param int $memberID The ID of the member. Leave blank for the current |
||
| 336 | * member. |
||
| 337 | * @return array Returns a list of group IDs to which the member belongs |
||
| 338 | * to or NULL. |
||
| 339 | */ |
||
| 340 | public static function groupList($memberID = null) { |
||
| 372 | |||
| 373 | |||
| 374 | /** |
||
| 375 | * Grant the given permission code/arg to the given group |
||
| 376 | * |
||
| 377 | * @param int $groupID The ID of the group |
||
| 378 | * @param string $code The permission code |
||
| 379 | * @param string $arg Optional: The permission argument (e.g. a page ID). |
||
| 380 | * @returns Permission Returns the new permission object. |
||
| 381 | */ |
||
| 382 | public static function grant($groupID, $code, $arg = "any") { |
||
| 407 | |||
| 408 | |||
| 409 | /** |
||
| 410 | * Deny the given permission code/arg to the given group |
||
| 411 | * |
||
| 412 | * @param int $groupID The ID of the group |
||
| 413 | * @param string $code The permission code |
||
| 414 | * @param string $arg Optional: The permission argument (e.g. a page ID). |
||
| 415 | * @returns Permission Returns the new permission object. |
||
| 416 | */ |
||
| 417 | public static function deny($groupID, $code, $arg = "any") { |
||
| 442 | |||
| 443 | /** |
||
| 444 | * Returns all members for a specific permission. |
||
| 445 | * |
||
| 446 | * @param $code String|array Either a single permission code, or a list of permission codes |
||
| 447 | * @return SS_List Returns a set of member that have the specified |
||
| 448 | * permission. |
||
| 449 | */ |
||
| 450 | public static function get_members_by_permission($code) { |
||
| 473 | |||
| 474 | /** |
||
| 475 | * Return all of the groups that have one of the given permission codes |
||
| 476 | * @param array|string $codes Either a single permission code, or an array of permission codes |
||
| 477 | * @return SS_List The matching group objects |
||
| 478 | */ |
||
| 479 | public static function get_groups_by_permission($codes) { |
||
| 495 | |||
| 496 | |||
| 497 | /** |
||
| 498 | * Get a list of all available permission codes, both defined through the |
||
| 499 | * {@link PermissionProvider} interface, and all not explicitly defined codes existing |
||
| 500 | * as a {@link Permission} database record. By default, the results are |
||
| 501 | * grouped as denoted by {@link Permission_Group}. |
||
| 502 | * |
||
| 503 | * @param bool $grouped Group results into an array of permission groups. |
||
| 504 | * @return array Returns an array of all available permission codes. The |
||
| 505 | * array indicies are the permission codes as used in |
||
| 506 | * {@link Permission::check()}. The value is a description |
||
| 507 | * suitable for using in an interface. |
||
| 508 | */ |
||
| 509 | public static function get_codes($grouped = true) { |
||
| 586 | |||
| 587 | /** |
||
| 588 | * Sort permissions based on their sort value, or name |
||
| 589 | * |
||
| 590 | * @param array $a |
||
| 591 | * @param array $b |
||
| 592 | * @return int |
||
| 593 | */ |
||
| 594 | public static function sort_permissions($a, $b) { |
||
| 603 | |||
| 604 | /** |
||
| 605 | * Get a linear list of the permissions in the system. |
||
| 606 | * |
||
| 607 | * @return array Linear list of declared permissions in the system. |
||
| 608 | */ |
||
| 609 | public static function get_declared_permissions_list() { |
||
| 622 | |||
| 623 | /** |
||
| 624 | * Look up the human-readable title for the permission as defined by <code>Permission::declare_permissions</code> |
||
| 625 | * |
||
| 626 | * @param string $perm Permission code |
||
| 627 | * @return string Label for the given permission, or the permission itself if the label doesn't exist |
||
| 628 | */ |
||
| 629 | public static function get_label_for_permission($perm) { |
||
| 634 | |||
| 635 | /** |
||
| 636 | * Recursively traverse the nested list of declared permissions and create |
||
| 637 | * a linear list. |
||
| 638 | * |
||
| 639 | * @param array $declared Nested structure of permissions. |
||
| 640 | * @param array $list List of permissions in the structure. The result will be |
||
| 641 | * written to this array. |
||
| 642 | */ |
||
| 643 | protected static function traverse_declared_permissions($declared, &$list) { |
||
| 656 | |||
| 657 | public function onBeforeWrite() { |
||
| 663 | |||
| 664 | public static function get_template_global_variables() { |
||
| 669 | } |
||
| 670 | |||
| 738 |
Loading history...
This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.
Consider making the comparison explicit by using
empty(..)or! empty(...)instead.