PHP AuthItem类代码示例

 public function checkAccess($item_name)
 {
     //Если суперпользователь, то разрешено все
     if (isset(Yii::app()->user->role) && Yii::app()->user->role == AuthItem::ROLE_ROOT) {
         return true;
     }
     $auth_item = AuthItem::model()->findByPk($item_name);
     if (!$auth_item) {
         Yii::log('Задача $item_name не найдена!');
         return false;
     }
     if ($auth_item->allow_for_all) {
         return true;
     }
     if ($auth_item->task) {
         if ($auth_item->task->allow_for_all) {
             return true;
         } elseif (Yii::app()->user->checkAccess($auth_item->task->name)) {
             return true;
         }
     } else {
         if (Yii::app()->user->checkAccess($auth_item->name)) {
             return true;
         }
     }
     return false;
 }

 public function actionDelete($authItemName)
 {
     $authItemName = trim($authItemName);
     if ($authItemName == '') {
         return $this->result = errorHandler()->logException(null, -1, 'XUSER_ERR_ROLE_NAME_EMPTY', array('message' => 'Role name is empty'));
     }
     $authItem = AuthItem::model()->find('name=:name', array(':name' => $authItemName));
     if (!is_object($authItem)) {
         return $this->result = errorHandler()->logException(null, -1, 'XUSER_ERR_ROLE_NOT_FOUND', array('message' => 'Role is not found'));
     }
     // check if this role is system role
     if ($authItem->is_system == true) {
         return $this->result = errorHandler()->logException(null, -1, 'XUSER_ERR_ROLE_CANNOT_DELETE_BECAUSE_SYSTEM', array('message' => 'Cannot delete this role as it is a system role'));
     }
     // check if this role is assigned to any user
     $sql = 'SELECT COUNT(userid) FROM "' . SITE_ID . '_authassignment" WHERE itemname = \'' . $authItem->name . '\'';
     $count = app()->db->createCommand($sql)->queryScalar();
     if ($count > 0) {
         return $this->result = errorHandler()->logException(null, -1, 'XUSER_ERR_ROLE_CANNOT_DELETE_BECAUSE_ASSIGNED', array('message' => "Cannot delete this role as it's assigned to users"));
     }
     // delete the role
     if (!$authItem->delete()) {
         return $this->result = errorHandler()->logException(null, -1, 'XUSER_ERR_ROLE_DELETE_FAILED', array('message' => 'Deleting the role has been failed'));
     }
     return $this->result = array('result' => null, 'returnCode' => 1);
 }

 /**
  * Returns the data model based on the primary key given in the GET variable.
  * If the data model is not found, an HTTP exception will be raised.
  * @param integer $id the ID of the model to be loaded
  * @return AuthItem the loaded model
  * @throws CHttpException
  */
 public function loadModel($id)
 {
     $model = AuthItem::model()->findByPk($id);
     if ($model === null) {
         throw new CHttpException(404, 'The requested page does not exist.');
     }
     return $model;
 }

 public static function newRoleId()
 {
     $rows = AuthItem::model()->FindBySql('select CAST(SUBSTRING(name,11) as SIGNED INTEGER) + 1 AS name from AuthItem where name like "rolebyuser%" order by CAST(SUBSTRING(name,11) as SIGNED INTEGER) desc limit 1');
     $result = '1';
     if (count((array) $rows) > 0) {
         $result = $rows['name'];
     }
     return $result;
 }

 public function actionIndex()
 {
     $moduleId = $this->get('id', '');
     $model = Module::model()->find('name = :name', array(':name' => $moduleId));
     if ($model && $this->generateRoutes($moduleId)) {
         $features = $this->getFeatures($moduleId);
     }
     $roles = AuthItem::model()->findAll('type = 2');
     $this->render('index', array('model' => $model, 'features' => $features, 'roles' => $roles));
 }

 public function checkAccess($auth_item_name, $params = array(), $allow_caching = true)
 {
     return true;
     if (Yii::app()->user->isRootRole()) {
         return true;
     }
     $auth_item = AuthItem::model()->findByPk($auth_item_name);
     if ($auth_item && $auth_item['allow_for_all']) {
         return true;
     }
     return parent::checkAccess($auth_item_name, $params, $allow_caching);
 }

 public function checkName()
 {
     if ($this->isNewRecord) {
         if (AuthItem::model()->exists('name=LOWER(:name)', array(':name' => strtolower($this->name)))) {
             $this->addError('name', at('Sorry, That name is already in use.'));
         }
     } else {
         if (AuthItem::model()->exists('name=LOWER(:name) AND id!=:id', array(':id' => $this->id, ':name' => strtolower($this->name)))) {
             $this->addError('name', at('Sorry, That name is already in use.'));
         }
     }
 }

 public function beforeAction($action)
 {
     $item_name = AuthItem::constructName(Yii::app()->controller->id, $action->id);
     if (!RbacModule::isAllow($item_name)) {
         $this->forbidden();
     }
     if (isset(Yii::app()->params->save_site_actions) && Yii::app()->params->save_site_actions) {
         MainModule::saveSiteAction();
     }
     $this->setTitle($action);
     $this->_setMetaTags($action);
     return true;
 }

    public function loadModel($name)
    {
        $model = AuthItem::model()->findByAttributes(array(
            'name' => $name,
            'type' => CAuthItem::TYPE_ROLE
        ));

        if (!$model)
        {
            $this->pageNotFound();
        }

        return $model;
    }

 public function preFilter($filter_chain)
 {
     $item_name = AuthItem::constructName($filter_chain->action->controller->id, $filter_chain->action->id);
     if (Yii::app()->user->checkAccess($item_name)) {
         $filter_chain->run();
     } else {
         $msg = null;
         if (YII_DEBUG) {
             $msg = t('Зарещено!') . ' ' . t($item_name) . '<br/>';
             $msg .= CHtml::link('Разрешить для роли "' . Yii::app()->user->role . '"', Yii::app()->createUrl('/rbac/task/allow', array('item_name' => $item_name)));
         }
         $filter_chain->action->controller->forbidden($msg);
     }
 }

 public function actionAssignment()
 {
     $model = new Authassignment();
     if (isset($_POST['Authassignment'])) {
         $model->attributes = $_POST['Authassignment'];
         if ($model->validate()) {
             //$this->saveModel($model);
             //$this->redirect(array('view','itemname'=>$model->itemname, 'userid'=>$model->userid));
             $auth = Yii::app()->authManager;
             $auth->assign($model->itemname, $model->userid, $model->bizrule, $model->data);
         }
     }
     $user = User::model()->findAll();
     $item = AuthItem::model()->findAll(array('condition' => 'type=2'));
     $this->render('assignment', array('model' => $model, 'user' => $user, 'item' => $item));
 }

 /**
  * Загрузка данных из бд и распределение их по спискам
  */
 private function getData()
 {
     $userAssign = CHtml::listData(AuthAssignment::model()->findAllByAttributes(['userid' => $this->user->id]), 'itemname', 'userid');
     $authItems = AuthItem::model()->findAll(['order' => 'type DESC, description ASC']);
     foreach ((array) $authItems as $item) {
         $this->itemsGroupedByTypes[$item->type][$item->name] = $item;
         $this->itemsList[$item->name] = $item;
         // если проверять каждый элемент, то генерируется огромное количество запросов, но получается правильное дерево с отмеченными дочерними элементами
         // созможно стоит при сохранении ролей что-то придумать
         $this->permissionList[$item->name] = isset($userAssign[$item->name]);
         //Yii::app()->authManager->checkAccess($item->name, $this->user->id);
     }
     $authItemsChild = AuthItemChild::model()->findAll();
     foreach ((array) $authItemsChild as $item) {
         $this->hierarchy[$item->parent][] = $item->child;
         $this->wereChildren[] = $item->child;
     }
 }

 /**
  * 删除所有的action操作
  * 写着玩的，不可随意执行，会把所有的operation删掉，并且删除这么operation和用户、角色之间的所有关系
  * 但是也可以随便执行，因为AR模式在这里执行不了，提供个思路，哈哈。
  */
 public function clearOpers()
 {
     $criteria = new CDbCriteria();
     $criteria->condition = "type = 0";
     $actions = AuthItem::model()->findAll($criteria);
     foreach ($actions as $key => $action) {
         $criteria_child = new CDbCriteria();
         $criteria_child->condition = "child = '{$action->name}'";
         $flag = ItemChildren::model()->deleteAll($criteria_child);
         if ($flag > 0) {
             if ($action->delete()) {
                 echo "{$action->name} delete success\n";
             } else {
                 echo "{$action->name} delete failed\n";
             }
         }
     }
 }

 /**
  * Check if we have the access keys in the db
  *
  */
 public function checkAccess($operation, $params = array())
 {
     // First make sure we haven't already added it
     // without looking in the db
     $missingRoles = array();
     if (Yii::app()->cache) {
         $missingRoles = Yii::app()->cache->get('missing_roles');
         if ($missingRoles === false) {
             $missingRoles = array();
         }
     }
     // Do we have that roles in the array
     if (!in_array($operation, $missingRoles)) {
         // We don't so look up the db
         $roleExists = AuthItem::model()->find('name=:name', array(':name' => $operation));
         if (!$roleExists) {
             // Figure out the type first
             if (strpos($operation, 'op_') !== false) {
                 $type = CAuthItem::TYPE_OPERATION;
             } elseif (strpos($operation, 'task_') !== false) {
                 $type = CAuthItem::TYPE_TASK;
             } else {
                 $type = CAuthItem::TYPE_ROLE;
             }
             // Create new auth item
             Yii::app()->authManager->createAuthItem($operation, $type, $operation, null, null);
         }
         $missingRoles[$operation] = $operation;
         // Save
         if (Yii::app()->cache) {
             Yii::app()->cache->set('missing_roles', $missingRoles);
         }
     }
     // In case we are in debug mode then return true all the time
     if (YII_DEBUG) {
         return true;
     }
     // Return parent check access
     return parent::checkAccess($operation, $params);
 }

 /**
  * @return \yii\db\ActiveQuery
  */
 public function getAuthItems()
 {
     return $this->hasMany(AuthItem::className(), ['rule_name' => 'name'])->from(['authItems' => Authitem::tableName()]);
 }