acl.php

Ir a la documentación de este archivo.

<?php
include CORE_PATH . 'libs/acl/role/role.php';

include CORE_PATH . 'libs/acl/resource/resource.php';

class Acl
{

    private $roles_names = array();
    private $roles = array();
    private $resources = array();
    public $access = array();
    private $role_inherits = array();
    private $resources_names = array('*');
    private $access_list = array('*' => array('*'));

    public function add_role(AclRole $roleObject, $access_inherits='')
    {
        if (in_array($roleObject->name, $this->roles_names)) {
            return false;
        }
        $this->roles[] = $roleObject;
        $this->roles_names[] = $roleObject->name;
        $this->access[$roleObject->name]['*']['*'] = 'A';
        if ($access_inherits) {
            $this->add_inherit($roleObject->name, $access_inherits);
        }
    }

    public function add_inherit($role, $role_to_inherit)
    {
        if (!in_array($role, $this->roles_names)) {
            return false;
        }
        if ($role_to_inherit != '') {
            if (is_array($role_to_inherit)) {
                foreach ($role_to_inherit as $rol_in) {
                    if ($rol_in == $role) {
                        return false;
                    }
                    if (!in_array($rol_in, $this->roles_names)) {
                        throw new KumbiaException("El Rol '{$rol_in}' no existe en la lista");

                    }
                    $this->role_inherits[$role][] = $role_in;
                }
                $this->rebuild_access_list();
            } else {
                if ($role_to_inherit == $role) {
                    return false;
                }
                if (!in_array($role_to_inherit, $this->roles_names)) {
                    throw new KumbiaException("El Rol '{$role_to_inherit}' no existe en la lista");

                }
                $this->role_inherits[$role][] = $role_to_inherit;
                $this->rebuild_access_list();
            }
        } else {
            throw new KumbiaException("Debe especificar un rol a heredar en Acl::add_inherit");

        }
    }

    public function is_role($role_name)
    {
        return in_array($role_name, $this->roles_names);
    }

    public function is_resource($resource_name)
    {
        return in_array($resource_name, $this->resources_names);
    }

    public function add_resource(AclResource $resource)
    {
        if (!in_array($resource->name, $this->resources)) {
            $this->resources[] = $resource;
            $this->access_list[$resource->name] = array();
            $this->resources_names[] = $resource->name;
        }
        if (func_num_args() > 1) {
            $access_list = func_get_args();
            unset($access_list[0]);
            $this->add_resource_access($resource->name, $access_list);
        }
    }

    public function add_resource_access($resource, $access_list)
    {
        if (is_array($access_list)) {
            foreach ($access_list as $access_name) {
                if (!in_array($access_name, $this->access_list[$resource])) {
                    $this->access_list[$resource][] = $access_name;
                }
            }
        } else {
            if (!in_array($access_list, $this->access_list[$resource])) {
                $this->access_list[$resource][] = $access_list;
            }
        }
    }

    public function drop_resource_access($resource, $access_list)
    {
        if (is_array($access_list)) {
            foreach ($access_list as $access_name) {
                if (in_array($access_name, $this->access_list[$resource])) {
                    foreach ($this->access_list[$resource] as $i => $access) {
                        if ($access == $access_name) {
                            unset($this->access_list[$resource][$i]);
                        }
                    }
                }
            }
        } else {
            if (in_array($access_list, $this->access_list[$resource])) {
                foreach ($this->access_list[$resource] as $i => $access) {
                    if ($access == $access_list) {
                        unset($this->access_list[$resource][$i]);
                    }
                }
            }
        }
        $this->rebuild_access_list();
    }

    public function allow($role, $resource, $access)
    {
        if (!in_array($role, $this->roles_names)) {
            throw new KumbiaException("No existe el rol '$role' en la lista");

        }
        if (!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("No existe el resource '$resource' en la lista");

        }
        if (is_array($access)) {
            foreach ($access as $acc) {
                if (!in_array($acc, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe el acceso '$acc' en el resource '$resource' de la lista");

                }
            }
            foreach ($access as $acc) {
                $this->access[$role][$resource][$acc] = 'A';
            }
        } else {
            if (!in_array($access, $this->access_list[$resource])) {
                throw new KumbiaException("No existe el acceso '$access' en el resource '$resource' de la lista");

            }
            $this->access[$role][$resource][$access] = 'A';
            $this->rebuild_access_list();
        }
    }

    public function deny($role, $resource, $access)
    {
        if (!in_array($role, $this->roles_names)) {
            throw new KumbiaException("No existe el rol '$role' en la lista");

        }
        if (!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("No existe el resource '$resource' en la lista");

        }
        if (is_array($access)) {
            foreach ($access as $acc) {
                if (!in_array($acc, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe el acceso '$acc' en el resource '$resource' de la lista");

                }
            }
            foreach ($access as $acc) {
                $this->access[$role][$resource][$acc] = 'D';
            }
        } else {
            if (!in_array($access, $this->access_list[$resource])) {
                throw new KumbiaException("No existe el acceso '$access' en el resource '$resource' de la lista");

            }
            $this->access[$role][$resource][$access] = 'D';
            $this->rebuild_access_list();
        }
    }

    public function is_allowed($role, $resource, $access_list)
    {
        if (!in_array($role, $this->roles_names)) {
            throw new KumbiaException("El rol '$role' no existe en la lista en acl::is_allowed");

        }
        if (!in_array($resource, $this->resources_names)) {
            throw new KumbiaException("El resource '$resource' no existe en la lista en acl::is_allowed");

        }
        if (is_array($access_list)) {
            foreach ($access_list as $access) {
                if (!in_array($access, $this->access_list[$resource])) {
                    throw new KumbiaException("No existe en acceso '$access' en el resource '$resource' en acl::is_allowed");

                }
            }
        } else {
            if (!in_array($access_list, $this->access_list[$resource])) {
                throw new KumbiaException("No existe en acceso '$access_list' en el resource '$resource' en acl::is_allowed");

            }
        }

        /* foreach($this->access[$role] as ){

          } */
        // FIXME: Por lo pronto hacemos esta validación, luego se mejorará
        if (!isset($this->access[$role][$resource][$access_list]))
            return false;
        if ($this->access[$role][$resource][$access_list] == "A")
            return true;
    }

    private function rebuild_access_list()
    {
        for ($i = 0; $i <= ceil(count($this->roles) * count($this->roles) / 2); $i++) {
            foreach ($this->roles_names as $role) {
                if (isset($this->role_inherits[$role])) {
                    foreach ($this->role_inherits[$role] as $role_inherit) {
                        if (isset($this->access[$role_inherit])) {
                            foreach ($this->access[$role_inherit] as $resource_name => $access) {
                                foreach ($access as $access_name => $value) {
                                    if (!in_array($access_name, $this->access_list[$resource_name])) {
                                        unset($this->access[$role_inherit][$resource_name][$access_name]);
                                    } else {
                                        if (!isset($this->access[$role][$resource_name][$access_name])) {
                                            $this->access[$role][$resource_name][$access_name] = $value;
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }

}