acl.php

Ir a la documentación de este archivo.

<?php
include CORE_PATH . 'libs/acl/role/role.php';

include CORE_PATH . 'libs/acl/resource/resource.php';

class Acl {

    private $roles_names = array();

    private $roles = array();

    private $resources = array();

    public $access = array();

    private $role_inherits = array();

    private $resources_names = array('*');

    private $access_list = array('*' => array('*'));

    public function add_role(AclRole $roleObject, $access_inherits='') {
        if(in_array($roleObject->name, $this->roles_names)) {
            return false;
        }
        $this->roles[] = $roleObject;
        $this->roles_names[] = $roleObject->name;
        $this->access[$roleObject->name]['*']['*'] = 'A';
        if($access_inherits) {
            $this->add_inherit($roleObject->name, $access_inherits);
        }
    }

    public function add_inherit($role, $role_to_inherit) {
        if(!in_array($role, $this->roles_names)) {
            return false;
        }
        if($role_to_inherit!='') {
            if(is_array($role_to_inherit)) {
                foreach($role_to_inherit as $rol_in) {
                    if($rol_in==$role) {
                        return false;
                    }
                    if(!in_array($rol_in, $this->roles_names)) {
                        throw new KumbiaException("El Rol '{$rol_in}' no existe en la lista");
                        return false;
                    }
                    $this->role_inherits[$role][] = $role_in;
                }
                $this->rebuild_access_list();
            } else {
                if($role_to_inherit==$role) {
                    return false;
                }
                if(!in_array($role_to_inherit, $this->roles_names)) {
                    throw new KumbiaException("El Rol '{$role_to_inherit}' no existe en la lista");
                    return false;
                }
                $this->role_inherits[$role][] = $role_to_inherit;
                $this->rebuild_access_list();
            }
        } else {
            throw new KumbiaException("Debe especificar un rol a heredar en Acl::add_inherit");
            return false;
        }
    }

    public function is_role($role_name) {
        return in_array($role_name, $this->roles_names);
    }

    public function is_resource($resource_name) {
        return in_array($resource_name, $this->resources_names);
    }

    public function add_resource(AclResource $resource) {
        if(!in_array($resource->name, $this->resources)) {
            $this->resources[] = $resource;
            $this->access_list[$resource->name] = array();
            $this->resources_names[] = $resource->name;
        }
        if(func_num_args()>1) {
            $access_list = func_get_args();
            unset($access_list[0]);
            $this->add_resource_access($resource->name, $access_list);
        }
    }

    public function add_resource_access($resource, $access_list) {
        if(is_array($access_list)) {
            foreach($access_list as $access_name) {
                if(!in_array($access_name, $this->access_list[$resource])) {
                    $this->access_list[$resource][] = $access_name;
                }
            }
        } else {
            if(!in_array($access_list, $this->access_list[$resource])) {
                $this->access_list[$resource][] = $access_list;
            }
        }
    }

    public function drop_resource_access($resource, $access_list) {
        if(is_array($access_list)) {
            foreach($access_list as $access_name) {
                if(in_array($access_name, $this->access_list[$resource])) {
                    foreach($this->access_list[$resource] as $i => $access) {
                        if($access==$access_name) {
                            unset($this->access_list[$resource][$i]);
                        }
                    }
                }
            }
        } else {
            if(in_array($access_list, $this->access_list[$resource])) {
                foreach($this->access_list[$resource] as $i => $access) {
                    if($access==$access_list) {
                        unset($this->access_list[$resource][$i]);
                    }
                }
            }
        }
        $this->rebuild_access_list();

    }

    public function allow($role, $resource, $access) {
        if(!in_array($role, $this->roles_names)) {
            throw new KumbiaException("No existe el rol '$role' en la lista");
            return;
        }
        if(!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("No existe el resource '$resource' en la lista");
            return;
        }
        if(is_array($access)) {
            foreach($access as $acc) {
                if(!in_array($acc, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe el acceso '$acc' en el resource '$resource' de la lista");
                    return false;
                }
            }
            foreach($access as $acc) {
                $this->access[$role][$resource][$acc] = 'A';
            }
        } else {
            if(!in_array($access, $this->access_list[$resource])) {
                throw new KumbiaException("No existe el acceso '$access' en el resource '$resource' de la lista");
                return false;
            }
            $this->access[$role][$resource][$access] = 'A';
            $this->rebuild_access_list();
        }
    }

    public function deny($role, $resource, $access) {
        if(!in_array($role, $this->roles_names)) {
            throw new KumbiaException("No existe el rol '$role' en la lista");
            return;
        }
        if(!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("No existe el resource '$resource' en la lista");
            return;
        }
        if(is_array($access)) {
            foreach($access as $acc) {
                if(!in_array($acc, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe el acceso '$acc' en el resource '$resource' de la lista");
                    return false;
                }
            }
            foreach($access as $acc) {
                $this->access[$role][$resource][$acc] = 'D';
            }
        } else {
            if(!in_array($access, $this->access_list[$resource])) {
                throw new KumbiaException("No existe el acceso '$access' en el resource '$resource' de la lista");
                return false;
            }
            $this->access[$role][$resource][$access] = 'D';
            $this->rebuild_access_list();
        }
    }

    public function is_allowed($role, $resource, $access_list) {
        if(!in_array($role, $this->roles_names)) {
            throw new KumbiaException("El rol '$role' no existe en la lista en acl::is_allowed");
            return false;
        }
        if(!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("El resource '$resource' no existe en la lista en acl::is_allowed");
            return false;
        }
        if(is_array($access_list)) {
            foreach ($access_list as $access) {
                if(!in_array($access, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe en acceso '$access' en el resource '$resource' en acl::is_allowed");
                    return false;
                }
            }
        } else {
            if(!in_array($access_list, $this->access_list[$resource])) {
                throw new KumbiaException("No existe en acceso '$access_list' en el resource '$resource' en acl::is_allowed");
                return false;
            }
        }

                /*foreach($this->access[$role] as ){

                }*/
                // FIXME: Por lo pronto hacemos esta validación, luego se mejorará
                if(!isset($this->access[$role][$resource][$access_list])) return false;
                if($this->access[$role][$resource][$access_list] == "A") return true;
        }

    private function rebuild_access_list() {
        for($i=0;$i<=ceil(count($this->roles)*count($this->roles)/2);$i++) {
            foreach($this->roles_names as $role) {
                if(isset($this->role_inherits[$role])) {
                    foreach($this->role_inherits[$role] as $role_inherit) {
                        if(isset($this->access[$role_inherit])) {
                            foreach($this->access[$role_inherit] as $resource_name => $access) {
                                foreach ($access as $access_name => $value) {
                                    if(!in_array($access_name, $this->access_list[$resource_name])) {
                                        unset($this->access[$role_inherit][$resource_name][$access_name]);
                                    } else {
                                        if(!isset($this->access[$role][$resource_name][$access_name])) {
                                            $this->access[$role][$resource_name][$access_name] = $value;
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}