Zemit\Mvc\Model\Behavior\Security

Complexity

Total Complexity

17

Size/Duplication

Total Lines	87
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes	1
Bugs	0	Features	0

3 Methods

Rating	Name	Duplication	Size	Complexity
A	isAllowed()	0	31	4
A	__construct()	0	6	1
C	notify()	0	23	12

<?php

/**
 * This file is part of the Zemit Framework.
 *
 * (c) Zemit Team <contact@zemit.com>
 *
 * For the full copyright and license information, please view the LICENSE.txt
 * file that was distributed with this source code.
 */

namespace Zemit\Mvc\Model\Behavior;

use Phalcon\Di;
use Phalcon\Text;
use Phalcon\Messages\Message;
use Phalcon\Mvc\ModelInterface;
use Phalcon\Mvc\Model\Behavior;
use Zemit\Config\Config;
use Zemit\Identity;

/**
 * Allows to check if the current identity is allowed to run some model actions
 * this behavior will stop operations if not allowed
 */
class Security extends Behavior
{
    use SkippableTrait;
    
    protected Config $config;
    
    protected \Zemit\Security $security;
    
    protected Identity $identity;
    
    /**
     * @todo avoid using DI
     * @param array|null $options
     */
    public function __construct(?array $options = null)
    {
        parent::__construct($options);

It seems like $options can also be of type null; however, parameter $options of Phalcon\Mvc\Model\Behavior::__construct() does only seem to accept array, maybe add an additional type check?

        $this->config ??= Di::getDefault()->get('config');
        $this->security ??= Di::getDefault()->get('security');
        $this->identity ??= Di::getDefault()->get('identity');
    }
    
    /**
     * Handling security on some model events
     * - beforeCreate
     * - beforeUpdate
     * - beforeDelete
     * - beforeRestore
     *
     * {@inheritdoc}
     */
    public function notify(string $type, ModelInterface $model): bool
    {
        if (!$this->isEnabled()) {
            return true;
        }
        
        $this->security->getAcl();
        switch ($type) {
            case 'beforeFind': // @todo implement this
            case 'beforeFindFirst': // @todo implement this
            case 'beforeCount':  // @todo implement this
            case 'beforeSum': // @todo implement this
            case 'beforeAverage': // @todo implement this
            case 'beforeCreate':
            case 'beforeUpdate':
            case 'beforeDelete':
            case 'beforeRestore':
            case 'beforeReorder':
                $type = lcfirst(Text::camelize(str_replace(['before_', 'after_'], [null, null], Text::uncamelize($type))));
                return $this->isAllowed($type, $model);
        }
        
        return true;
    }
    
    public function isAllowed(string $type, ModelInterface $model): bool
    {
        $acl = $this->security->getAcl(['models', 'components']);
        $modelClass = get_class($model);
        
        // component not found
        if (!$acl->isComponent($modelClass)) {
            $model->appendMessage(new Message(
                'Model permission not found for `' . $modelClass . '`',
                'id',
                'NotFound',
                404
            ));
            return false;
        }
        
        // allowed for roles
        $roles = $this->identity->getAclRoles();
        foreach ($roles as $role) {
            if ($acl->isAllowed($role, $modelClass, $type)) {
                return true;
            }
        }
        
        $model->appendMessage(new Message(
            'Current identity forbidden to execute `' . $type . '` on `' . $modelClass . '`',
            'id',
            'NotFound',
            403
        ));
        return false;
    }
}