Zemit\Mvc\Model\Behavior\Security

Complexity

Total Complexity

16

Size/Duplication

Total Lines	128
Duplicated Lines	0 %

Test Coverage

Coverage

29.69%

Importance

Changes	1
Bugs	0	Features	0

7 Methods

Rating	Name	Duplication	Size	Complexity
A	setRoles()	0	3	1
A	setAcl()	0	3	1
A	getAcl()	0	8	2
A	getRoles()	0	8	2
A	isAllowed()	0	31	4
A	__construct()	0	3	1
A	notify()	0	36	5

<?php

/**
 * This file is part of the Zemit Framework.
 *
 * (c) Zemit Team <contact@zemit.com>
 *
 * For the full copyright and license information, please view the LICENSE.txt
 * file that was distributed with this source code.
 */

namespace Zemit\Mvc\Model\Behavior;

use Phalcon\Acl\Adapter\Memory;
use Phalcon\Di\Di;
use Phalcon\Messages\Message;
use Phalcon\Mvc\Model\Behavior;
use Phalcon\Mvc\ModelInterface;

/**
 * Allows to check if the current identity is allowed to run some model actions
 * this behavior will stop operations if not allowed
 */
class Security extends Behavior
{
    use SkippableTrait;
    use ProgressTrait;
    
    public static ?array $roles = null;
    
    public static ?Memory $acl = null;
    
    /**
     * Set the ACL
     */
    public static function setAcl(?Memory $acl = null): void
    {
        self::$acl = $acl;
    }
    
    /**
     * Get the ACL
     */
    public static function getAcl(): Memory
    {
        if (is_null(self::$acl)) {
            $acl = Di::getDefault()->get('acl');
            assert($acl instanceof \Zemit\Acl\Acl);
            self::setAcl($acl->get(['models', 'components']));
        }
        return self::$acl;

The expression return self::acl could return the type null which is incompatible with the type-hinted return Phalcon\Acl\Adapter\Memory. Consider adding an additional type-check to rule them out.

    }
    
    /**
     * Set the current identity's roles
     */
    public static function setRoles(?array $roles = null): void
    {
        self::$roles = $roles;
    }
    
    /**
     * Return the current identity's acl roles
     */
    public static function getRoles(): array
    {
        if (is_null(self::$roles)) {
            $identity = Di::getDefault()->get('identity');
            assert($identity instanceof \Zemit\Identity);
            self::setRoles($identity->getAclRoles());
        }
        return self::$roles;

The expression return self::roles could return the type null which is incompatible with the type-hinted return array. Consider adding an additional type-check to rule them out.

    }
    
    public function __construct(?array $options = null)
    {
        parent::__construct($options);

It seems like $options can also be of type null; however, parameter $options of Phalcon\Mvc\Model\Behavior::__construct() does only seem to accept array, maybe add an additional type check?

    }
    
    /**
     * Handling security (acl) on before model's events
     */
    public function notify(string $type, ModelInterface $model): ?bool
    {
        if (!$this->isEnabled()) {
            return null;
        }
        
        // skip check while still in progress
        // needed to retrieve roles for itself
        if ($this->inProgress()) {
            return null;
        }
        
        $beforeEvents = [
            'beforeFind' => true,
            'beforeFindFirst' => true,
            'beforeCount' => true,
            'beforeSum' => true,
            'beforeAverage' => true,
            'beforeCreate' => true,
            'beforeUpdate' => true,
            'beforeDelete' => true,
            'beforeRestore' => true,
            'beforeReorder' => true,
        ];
        
        if ($beforeEvents[$type] ?? false) {
            self::staticStart();
            
            $type = (strpos($type, 'before') === 0) ? lcfirst(substr($type, 6)) : $type;
            $isAllowed = $this->isAllowed($type, $model);
            
            self::staticStop();
            return $isAllowed;
        }
        
        return true;
    }
    
    public function isAllowed(string $type, ModelInterface $model, ?Memory $acl = null, ?array $roles = null): bool
    {
        $acl ??= self::getAcl();
        $modelClass = get_class($model);
        
        // component not found
        if (!$acl->isComponent($modelClass)) {
            $model->appendMessage(new Message(
                'Model permission not found for `' . $modelClass . '`',
                'id',
                'NotFound',
                404
            ));
            return false;
        }
        
        // allowed for roles
        $roles ??= self::getRoles();
        foreach ($roles as $role) {
            if ($acl->isAllowed($role, $modelClass, $type)) {
                return true;
            }
        }
        
        $model->appendMessage(new Message(
            'Current identity forbidden to execute `' . $type . '` on `' . $modelClass . '`',
            'id',
            'Forbidden',
            403
        ));
        return false;
    }
}