1
|
|
|
<?php |
2
|
|
|
/** |
3
|
|
|
* @link http://www.yiiframework.com/ |
4
|
|
|
* @copyright Copyright (c) 2008 Yii Software LLC |
5
|
|
|
* @license http://www.yiiframework.com/license/ |
6
|
|
|
*/ |
7
|
|
|
|
8
|
|
|
namespace yii\rbac; |
9
|
|
|
|
10
|
|
|
use yii\base\Component; |
11
|
|
|
use yii\base\InvalidConfigException; |
12
|
|
|
use yii\base\InvalidParamException; |
13
|
|
|
|
14
|
|
|
/** |
15
|
|
|
* BaseManager is a base class implementing [[ManagerInterface]] for RBAC management. |
16
|
|
|
* |
17
|
|
|
* For more details and usage information on DbManager, see the [guide article on security authorization](guide:security-authorization). |
18
|
|
|
* |
19
|
|
|
* @author Qiang Xue <[email protected]> |
20
|
|
|
* @since 2.0 |
21
|
|
|
*/ |
22
|
|
|
abstract class BaseManager extends Component implements ManagerInterface |
23
|
|
|
{ |
24
|
|
|
/** |
25
|
|
|
* @var array a list of role names that are assigned to every user automatically without calling [[assign()]]. |
26
|
|
|
*/ |
27
|
|
|
public $defaultRoles = []; |
28
|
|
|
|
29
|
|
|
|
30
|
|
|
/** |
31
|
|
|
* Returns the named auth item. |
32
|
|
|
* @param string $name the auth item name. |
33
|
|
|
* @return Item the auth item corresponding to the specified name. Null is returned if no such item. |
34
|
|
|
*/ |
35
|
|
|
abstract protected function getItem($name); |
36
|
|
|
|
37
|
|
|
/** |
38
|
|
|
* Returns the items of the specified type. |
39
|
|
|
* @param int $type the auth item type (either [[Item::TYPE_ROLE]] or [[Item::TYPE_PERMISSION]] |
40
|
|
|
* @return Item[] the auth items of the specified type. |
41
|
|
|
*/ |
42
|
|
|
abstract protected function getItems($type); |
43
|
|
|
|
44
|
|
|
/** |
45
|
|
|
* Adds an auth item to the RBAC system. |
46
|
|
|
* @param Item $item the item to add |
47
|
|
|
* @return bool whether the auth item is successfully added to the system |
48
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the role or permission is not unique) |
49
|
|
|
*/ |
50
|
|
|
abstract protected function addItem($item); |
51
|
|
|
|
52
|
|
|
/** |
53
|
|
|
* Adds a rule to the RBAC system. |
54
|
|
|
* @param Rule $rule the rule to add |
55
|
|
|
* @return bool whether the rule is successfully added to the system |
56
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the rule is not unique) |
57
|
|
|
*/ |
58
|
|
|
abstract protected function addRule($rule); |
59
|
|
|
|
60
|
|
|
/** |
61
|
|
|
* Removes an auth item from the RBAC system. |
62
|
|
|
* @param Item $item the item to remove |
63
|
|
|
* @return bool whether the role or permission is successfully removed |
64
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the role or permission is not unique) |
65
|
|
|
*/ |
66
|
|
|
abstract protected function removeItem($item); |
67
|
|
|
|
68
|
|
|
/** |
69
|
|
|
* Removes a rule from the RBAC system. |
70
|
|
|
* @param Rule $rule the rule to remove |
71
|
|
|
* @return bool whether the rule is successfully removed |
72
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the rule is not unique) |
73
|
|
|
*/ |
74
|
|
|
abstract protected function removeRule($rule); |
75
|
|
|
|
76
|
|
|
/** |
77
|
|
|
* Updates an auth item in the RBAC system. |
78
|
|
|
* @param string $name the name of the item being updated |
79
|
|
|
* @param Item $item the updated item |
80
|
|
|
* @return bool whether the auth item is successfully updated |
81
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the role or permission is not unique) |
82
|
|
|
*/ |
83
|
|
|
abstract protected function updateItem($name, $item); |
84
|
|
|
|
85
|
|
|
/** |
86
|
|
|
* Updates a rule to the RBAC system. |
87
|
|
|
* @param string $name the name of the rule being updated |
88
|
|
|
* @param Rule $rule the updated rule |
89
|
|
|
* @return bool whether the rule is successfully updated |
90
|
|
|
* @throws \Exception if data validation or saving fails (such as the name of the rule is not unique) |
91
|
|
|
*/ |
92
|
|
|
abstract protected function updateRule($name, $rule); |
93
|
|
|
|
94
|
|
|
/** |
95
|
|
|
* @inheritdoc |
96
|
|
|
*/ |
97
|
110 |
|
public function createRole($name) |
98
|
|
|
{ |
99
|
110 |
|
$role = new Role(); |
100
|
110 |
|
$role->name = $name; |
101
|
110 |
|
return $role; |
102
|
|
|
} |
103
|
|
|
|
104
|
|
|
/** |
105
|
|
|
* @inheritdoc |
106
|
|
|
*/ |
107
|
104 |
|
public function createPermission($name) |
108
|
|
|
{ |
109
|
104 |
|
$permission = new Permission(); |
110
|
104 |
|
$permission->name = $name; |
111
|
104 |
|
return $permission; |
112
|
|
|
} |
113
|
|
|
|
114
|
|
|
/** |
115
|
|
|
* @inheritdoc |
116
|
|
|
*/ |
117
|
110 |
|
public function add($object) |
118
|
|
|
{ |
119
|
110 |
|
if ($object instanceof Item) { |
120
|
105 |
|
if ($object->ruleName && $this->getRule($object->ruleName) === null) { |
121
|
5 |
|
$rule = \Yii::createObject($object->ruleName); |
122
|
5 |
|
$rule->name = $object->ruleName; |
123
|
5 |
|
$this->addRule($rule); |
124
|
5 |
|
} |
125
|
105 |
|
return $this->addItem($object); |
126
|
104 |
|
} elseif ($object instanceof Rule) { |
127
|
104 |
|
return $this->addRule($object); |
128
|
|
|
} else { |
129
|
|
|
throw new InvalidParamException('Adding unsupported object type.'); |
130
|
|
|
} |
131
|
|
|
} |
132
|
|
|
|
133
|
|
|
/** |
134
|
|
|
* @inheritdoc |
135
|
|
|
*/ |
136
|
6 |
|
public function remove($object) |
137
|
|
|
{ |
138
|
6 |
|
if ($object instanceof Item) { |
139
|
6 |
|
return $this->removeItem($object); |
140
|
5 |
|
} elseif ($object instanceof Rule) { |
141
|
5 |
|
return $this->removeRule($object); |
142
|
|
|
} else { |
143
|
|
|
throw new InvalidParamException('Removing unsupported object type.'); |
144
|
|
|
} |
145
|
|
|
} |
146
|
|
|
|
147
|
|
|
/** |
148
|
|
|
* @inheritdoc |
149
|
|
|
*/ |
150
|
14 |
|
public function update($name, $object) |
151
|
|
|
{ |
152
|
14 |
|
if ($object instanceof Item) { |
153
|
14 |
|
if ($object->ruleName && $this->getRule($object->ruleName) === null) { |
154
|
|
|
$rule = \Yii::createObject($object->ruleName); |
155
|
|
|
$rule->name = $object->ruleName; |
156
|
|
|
$this->addRule($rule); |
157
|
|
|
} |
158
|
14 |
|
return $this->updateItem($name, $object); |
159
|
5 |
|
} elseif ($object instanceof Rule) { |
160
|
5 |
|
return $this->updateRule($name, $object); |
161
|
|
|
} else { |
162
|
|
|
throw new InvalidParamException('Updating unsupported object type.'); |
163
|
|
|
} |
164
|
|
|
} |
165
|
|
|
|
166
|
|
|
/** |
167
|
|
|
* @inheritdoc |
168
|
|
|
*/ |
169
|
30 |
|
public function getRole($name) |
170
|
|
|
{ |
171
|
30 |
|
$item = $this->getItem($name); |
172
|
30 |
|
return $item instanceof Item && $item->type == Item::TYPE_ROLE ? $item : null; |
173
|
|
|
} |
174
|
|
|
|
175
|
|
|
/** |
176
|
|
|
* @inheritdoc |
177
|
|
|
*/ |
178
|
13 |
|
public function getPermission($name) |
179
|
|
|
{ |
180
|
13 |
|
$item = $this->getItem($name); |
181
|
13 |
|
return $item instanceof Item && $item->type == Item::TYPE_PERMISSION ? $item : null; |
182
|
|
|
} |
183
|
|
|
|
184
|
|
|
/** |
185
|
|
|
* @inheritdoc |
186
|
|
|
*/ |
187
|
20 |
|
public function getRoles() |
188
|
|
|
{ |
189
|
20 |
|
return $this->getItems(Item::TYPE_ROLE); |
190
|
|
|
} |
191
|
|
|
|
192
|
|
|
/** |
193
|
|
|
* @inheritdoc |
194
|
|
|
*/ |
195
|
15 |
|
public function getPermissions() |
196
|
|
|
{ |
197
|
15 |
|
return $this->getItems(Item::TYPE_PERMISSION); |
198
|
|
|
} |
199
|
|
|
|
200
|
|
|
/** |
201
|
|
|
* Executes the rule associated with the specified auth item. |
202
|
|
|
* |
203
|
|
|
* If the item does not specify a rule, this method will return true. Otherwise, it will |
204
|
|
|
* return the value of [[Rule::execute()]]. |
205
|
|
|
* |
206
|
|
|
* @param string|int $user the user ID. This should be either an integer or a string representing |
207
|
|
|
* the unique identifier of a user. See [[\yii\web\User::id]]. |
208
|
|
|
* @param Item $item the auth item that needs to execute its rule |
209
|
|
|
* @param array $params parameters passed to [[CheckAccessInterface::checkAccess()]] and will be passed to the rule |
210
|
|
|
* @return bool the return value of [[Rule::execute()]]. If the auth item does not specify a rule, true will be returned. |
211
|
|
|
* @throws InvalidConfigException if the auth item has an invalid rule. |
212
|
|
|
*/ |
213
|
10 |
|
protected function executeRule($user, $item, $params) |
214
|
|
|
{ |
215
|
10 |
|
if ($item->ruleName === null) { |
216
|
10 |
|
return true; |
217
|
|
|
} |
218
|
10 |
|
$rule = $this->getRule($item->ruleName); |
219
|
10 |
|
if ($rule instanceof Rule) { |
220
|
10 |
|
return $rule->execute($user, $item, $params); |
221
|
|
|
} else { |
222
|
|
|
throw new InvalidConfigException("Rule not found: {$item->ruleName}"); |
223
|
|
|
} |
224
|
|
|
} |
225
|
|
|
|
226
|
|
|
/** |
227
|
|
|
* Checks whether array of $assignments is empty and [[defaultRoles]] property is empty as well |
228
|
|
|
* |
229
|
|
|
* @param Assignment[] $assignments array of user's assignments |
230
|
|
|
* @return bool whether array of $assignments is empty and [[defaultRoles]] property is empty as well |
231
|
|
|
* @since 2.0.11 |
232
|
|
|
*/ |
233
|
10 |
|
protected function hasNoAssignments(array $assignments) |
234
|
|
|
{ |
235
|
10 |
|
return empty($assignments) && empty($this->defaultRoles); |
236
|
|
|
} |
237
|
|
|
} |
238
|
|
|
|