[Sommaire] [Imprimer]

   1  <?php
   2  /**
   3   * TAuthorizationRule, TAuthorizationRuleCollection class file
   4   *
   5   * @author Qiang Xue <qiang.xue@gmail.com>
   6   * @link http://www.pradosoft.com/
   7   * @copyright Copyright &copy; 2005 PradoSoft
   8   * @license http://www.pradosoft.com/license/
   9   * @version $Id: TAuthorizationRule.php 1423 2006-09-16 19:16:14Z xue $
  10   * @package System.Security
  11   */
  12  /**
  13   * TAuthorizationRule class
  14   *
  15   * TAuthorizationRule represents a single authorization rule.
  16   * A rule is specified by an action (required), a list of users (optional),
  17   * a list of roles (optional), and a verb (optional).
  18   * Action can be either 'allow' or 'deny'.
  19   * Guest (anonymous, unauthenticated) users are represented by question mark '?'.
  20   * All users (including guest users) are represented by asterisk '*'.
  21   * Users/roles are case-insensitive.
  22   * Different users/roles are separated by comma ','.
  23   * Verb can be either 'get' or 'post'. If it is absent, it means both.
  24   *
  25   * @author Qiang Xue <qiang.xue@gmail.com>
  26   * @version $Id: TAuthorizationRule.php 1423 2006-09-16 19:16:14Z xue $
  27   * @package System.Security
  28   * @since 3.0
  29   */
  30  class TAuthorizationRule extends TComponent
  31  {
  32      /**
  33       * @var string action, either 'allow' or 'deny'
  34       */
  35      private $_action;
  36      /**
  37       * @var array list of user IDs
  38       */
  39      private $_users;
  40      /**
  41       * @var array list of roles
  42       */
  43      private $_roles;
  44      /**
  45       * @var string verb, may be empty, 'get', or 'post'.
  46       */
  47      private $_verb;
  48      /**
  49       * @var boolean if this rule applies to everyone
  50       */
  51      private $_everyone;
  52      /**
  53       * @var boolean if this rule applies to guest user
  54       */
  55      private $_guest;
  56  
  57      /**
  58       * Constructor.
  59       * @param string action, either 'deny' or 'allow'
  60       * @param string a comma separated user list
  61       * @param string a comma separated role list
  62       * @param string verb, can be empty, 'get', or 'post'
  63       */
  64  	public function __construct($action,$users,$roles,$verb='')
  65      {
  66          $action=strtolower(trim($action));
  67          if($action==='allow' || $action==='deny')
  68              $this->_action=$action;
  69          else
  70              throw new TInvalidDataValueException('authorizationrule_action_invalid',$action);
  71          $this->_users=array();
  72          $this->_roles=array();
  73          $this->_everyone=false;
  74          $this->_guest=false;
  75          foreach(explode(',',$users) as $user)
  76          {
  77              if(($user=trim(strtolower($user)))!=='')
  78              {
  79                  if($user==='*')
  80                  {
  81                      $this->_everyone=true;
  82                      break;
  83                  }
  84                  else if($user==='?')
  85                      $this->_guest=true;
  86                  else
  87                      $this->_users[]=$user;
  88              }
  89          }
  90          foreach(explode(',',$roles) as $role)
  91          {
  92              if(($role=trim(strtolower($role)))!=='')
  93                  $this->_roles[]=$role;
  94          }
  95          $verb=trim(strtolower($verb));
  96          if($verb==='' || $verb==='get' || $verb==='post')
  97              $this->_verb=$verb;
  98          else
  99              throw new TInvalidDataValueException('authorizationrule_verb_invalid',$verb);
 100      }
 101  
 102      /**
 103       * @return string action, either 'allow' or 'deny'
 104       */
 105  	public function getAction()
 106      {
 107          return $this->_action;
 108      }
 109  
 110      /**
 111       * @return array list of user IDs
 112       */
 113  	public function getUsers()
 114      {
 115          return $this->_users;
 116      }
 117  
 118      /**
 119       * @return array list of roles
 120       */
 121  	public function getRoles()
 122      {
 123          return $this->_roles;
 124      }
 125  
 126      /**
 127       * @return string verb, may be empty, 'get', or 'post'.
 128       */
 129  	public function getVerb()
 130      {
 131          return $this->_verb;
 132      }
 133  
 134      /**
 135       * @return boolean if this rule applies to everyone
 136       */
 137  	public function getGuestApplied()
 138      {
 139          return $this->_guest;
 140      }
 141  
 142      /**
 143       * @return boolean if this rule applies to everyone
 144       */
 145  	public function getEveryoneApplied()
 146      {
 147          return $this->_everyone;
 148      }
 149  
 150      /**
 151       * @return integer 1 if the user is allowed, -1 if the user is denied, 0 if the rule does not apply to the user
 152       */
 153  	public function isUserAllowed(IUser $user,$verb)
 154      {
 155          $decision=($this->_action==='allow')?1:-1;
 156          if($this->_verb==='' || strcasecmp($verb,$this->_verb)===0)
 157          {
 158              if($this->_everyone || ($this->_guest && $user->getIsGuest()))
 159                  return $decision;
 160              if(in_array(strtolower($user->getName()),$this->_users))
 161                  return $decision;
 162              foreach($this->_roles as $role)
 163                  if($user->isInRole($role))
 164                      return $decision;
 165          }
 166          return 0;
 167      }
 168  }
 169  
 170  
 171  /**
 172   * TAuthorizationRuleCollection class.
 173   * TAuthorizationRuleCollection represents a collection of authorization rules {@link TAuthorizationRule}.
 174   * To check if a user is allowed, call {@link isUserAllowed}.
 175   *
 176   * @author Qiang Xue <qiang.xue@gmail.com>
 177   * @version $Id: TAuthorizationRule.php 1423 2006-09-16 19:16:14Z xue $
 178   * @package System.Security
 179   * @since 3.0
 180   */
 181  class TAuthorizationRuleCollection extends TList
 182  {
 183      /**
 184       * @param IUser the user to be authorized
 185       * @param string verb, can be empty, 'post' or 'get'.
 186       * @return boolean whether the user is allowed
 187       */
 188  	public function isUserAllowed($user,$verb)
 189      {
 190          if($user instanceof IUser)
 191          {
 192              $verb=strtolower(trim($verb));
 193              foreach($this as $rule)
 194              {
 195                  if(($decision=$rule->isUserAllowed($user,$verb))!==0)
 196                      return ($decision>0);
 197              }
 198              return true;
 199          }
 200          else
 201              return false;
 202      }
 203  
 204      /**
 205       * Inserts an item at the specified position.
 206       * This overrides the parent implementation by performing additional
 207       * operations for each newly added TAuthorizationRule object.
 208       * @param integer the speicified position.
 209       * @param mixed new item
 210       * @throws TInvalidDataTypeException if the item to be inserted is not a TAuthorizationRule object.
 211       */
 212  	public function insertAt($index,$item)
 213      {
 214          if($item instanceof TAuthorizationRule)
 215              parent::insertAt($index,$item);
 216          else
 217              throw new TInvalidDataTypeException('authorizationrulecollection_authorizationrule_required');
 218      }
 219  }
 220  
 221  ?>