PHP Acl::addRole方法代码示例

 public function initialAclRole($e, $serviceAdministratorConfigManager, $authenticationServiceStorage)
 {
     $oAcl = new Acl();
     $oAcl->deny();
     $oAcl->addRole(new Role('staff_1'));
     $oAcl->addRole(new Role('staff_2'));
     $oAcl->addRole(new Role('administrator'));
     $oAcl->addResource('administrator');
     $oAcl->addResource('api');
     $oAcl->allow('staff_1', 'administrator', 'index:index');
     $oAcl->allow('staff_1', 'administrator', 'user:profile');
     $oAcl->allow('staff_1', 'administrator', 'user:list');
     $oAcl->allow('staff_1', 'administrator', 'menu:list');
     $controllerClass = get_class($e->getTarget());
     $moduleName = strtolower(substr($controllerClass, 0, strpos($controllerClass, '\\')));
     $routeMatch = $e->getRouteMatch();
     $aName = strtolower($routeMatch->getParam('action', 'not-found'));
     $cName = strtolower($routeMatch->getParam('__CONTROLLER__', 'not-found'));
     /*
     if (!$oAcl->isAllowed("staff_1",$moduleName, "{$cName}:{$aName}"))
     {
     	$response = $e->getResponse();
     	$response->setStatusCode(302);
     	$response->getHeaders()->addHeaderLine('Location', $e->getRouter()->assemble($serviceAdministratorConfigManager['options']['constraints'], 
     			array('name' => $_SERVER['HTTP_HOST']. '/'. 'default')));
     	$e->stopPropagation();
     }
     */
 }

 /**
  * @return Acl
  */
 protected function roleAcl()
 {
     if (!$this->roleAcl) {
         $id = $this->objId();
         $this->roleAcl = new Acl();
         $this->roleAcl->addRole(new Role($id));
         $this->roleAcl->addResource(new Resource('admin'));
         $q = '
         select
             `denied`,
             `allowed`,
             `superuser`
         from
             `charcoal_admin_acl_roles`
         where
             ident = :id';
         $db = \Charcoal\App\App::instance()->getContainer()->get('database');
         $sth = $db->prepare($q);
         $sth->bindParam(':id', $id);
         $sth->execute();
         $permissions = $sth->fetch(\PDO::FETCH_ASSOC);
         $this->roleAllowed = explode(',', trim($permissions['allowed']));
         $this->roleDenied = explode(',', trim($permissions['denied']));
         foreach ($this->roleAllowed as $allowed) {
             $this->roleAcl->allow($id, 'admin', $allowed);
         }
         foreach ($this->roleDenied as $denied) {
             $this->roleAcl->deny($id, 'admin', $denied);
         }
     }
     return $this->roleAcl;
 }

 /**
  * AccessControl constructor.
  * @param $config
  * @param $entityManager
  * @param $userMapper
  * @param $roleMapper
  * @param $resourceMapper
  */
 public function __construct($config, $entityManager, $userMapper, $roleMapper, $resourceMapper)
 {
     $this->setConfig($config);
     $this->setEntityManager($entityManager);
     $this->setUserMapper($userMapper);
     $this->setRoleMapper($roleMapper);
     $this->setResourceMapper($resourceMapper);
     $this->modules = $this->getConfig()['mfcc_admin']['modules'];
     $this->acl = new Acl();
     foreach ($this->getRoleMapper()->getAll() as $index => $role) {
         /* @var $role RoleEntity */
         $this->acl->addRole(new Role($role->getName()));
     }
     foreach ($this->modules as $index => $module) {
         $this->acl->addResource(new GenericResource($module['module_name']));
     }
     $this->acl->addResource(new GenericResource('Users'));
     $this->acl->addResource(new GenericResource('Roles'));
     foreach ($this->getResourceMapper()->getAll() as $index => $resource) {
         /* @var $resource ResourceEntity */
         $this->acl->allow($resource->getRole()->getName(), $resource->getResource(), $resource->getPermission());
         if ($resource->getPermission() == self::WRITE) {
             $this->acl->allow($resource->getRole()->getName(), $resource->getResource(), self::READ);
         }
     }
 }

 public function __invoke($serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $this->acl = $serviceLocator->get('MultiRoleAclBase\\Service\\MultiRolesAcl');
     if (get_class($this->acl) == 'MultiRoleAclBase\\Service\\MultiRolesAcl' || is_subclass_of($this->acl, 'MultiRoleAclBase\\Service\\MultiRolesAcl')) {
         $this->acl->setAllowAccessWhenResourceUnknown(false);
     }
     $this->roleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RoleBuilder');
     $this->resourceBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\ResourceBuilder');
     $this->ruleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RuleBuilder');
     // Get all Roles from RoleBuilder
     $roles = $this->roleBuilder->buildRoles($this->acl, $serviceLocator);
     if (is_array($roles)) {
         foreach ($roles as $role) {
             $this->acl->addRole($role);
         }
     }
     // Get all Resources from ResourceBuilder
     $resources = $this->resourceBuilder->buildResources($this->acl, $serviceLocator);
     if (is_array($resources)) {
         foreach ($resources as $resource) {
             $this->acl->addResource($resource);
         }
     }
     // Build all the rules
     $this->ruleBuilder->buildRules($this->acl, $serviceLocator);
     return $this->acl;
 }

 public function doAuthorization($e)
 {
     return;
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Stick'));
     $acl->addResource(new Resource('Auth'));
     $acl->deny('anonymous', 'Stick', 'list');
     $acl->allow('anonymous', 'Auth', 'login');
     $acl->allow('anonymous', 'Auth', 'signup');
     $acl->allow('user', 'Stick', 'add');
     $acl->allow('user', 'Auth', 'logout');
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', 'Stick');
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     $namespace = substr($controllerClass, strrpos($controllerClass, '\\') + 1);
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     echo $role;
     exit;
     if (!$acl->isAllowed($role, $namespace, 'view')) {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'Login/auth'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         $response->getHeaders()->addHeaderLine('Location', $url);
     }
 }

 /**
  * Constructor
  * 
  * @param array $roles
  * @param array $resources
  */
 public function __construct($roles, $resources)
 {
     //Create brand new Acl object
     $this->acl = new Acl();
     //Add each resources
     foreach ($resources as $resource) {
         //Add the resource
         $this->acl->addResource(new Resource($resource));
     }
     //Add each roles
     foreach ($roles as $role => $resources) {
         //Add the role
         $this->acl->addRole(new Role($role));
         //If we want to grant all privileges on all resources
         if ($resources === true) {
             //Allow all privileges
             $this->acl->allow($role);
             //Else if we have specific privileges for the role
         } elseif (is_array($resources)) {
             //Create each resource permissions
             foreach ($resources as $resource => $permissions) {
                 //Add resource permissions of the role
                 $this->acl->allow($role, $resource, $permissions);
             }
         }
     }
 }

 public function doAuthorization($e)
 {
     //setting ACL...
     $acl = new Acl();
     //add role ..
     $acl->addRole(new Role('anonymous'));
     $acl->addRole(new Role('user'), 'anonymous');
     $acl->addRole(new Role('admin'), 'user');
     $acl->addResource(new Resource('Application'));
     $acl->addResource(new Resource('Login'));
     $acl->addResource(new Resource('ZfcAdmin'));
     $acl->deny('anonymous', 'Application', 'view');
     $acl->allow('anonymous', 'Login', 'view');
     $acl->allow('user', array('Application'), array('view'));
     //admin is child of user, can publish, edit, and view too !
     $acl->allow('admin', array('Application'), array('publish', 'edit'));
     $controller = $e->getTarget();
     $controllerClass = get_class($controller);
     //echo "<pre>";print_r($controllerClass);exit;
     $namespace = substr($controllerClass, 0, strpos($controllerClass, '\\'));
     // echo "<pre>";print_r($namespace);exit;
     $role = !$this->getSessContainer()->role ? 'anonymous' : $this->getSessContainer()->role;
     if (!isset($_SESSION['admin']['user_id']) && $namespace == 'ZfcAdmin') {
         $router = $e->getRouter();
         $url = $router->assemble(array(), array('name' => 'zfcadmin'));
         $response = $e->getResponse();
         $response->setStatusCode(302);
         //redirect to login route...
         /* change with header('location: '.$url); if code below not working */
         $response->getHeaders()->addHeaderLine('Location', $url);
         $e->stopPropagation();
     }
 }

 public function createService(ServiceLocatorInterface $serviceLocator)
 {
     //print_r('--factoryservicerolecreater');
     $config = $serviceLocator->get('config');
     $acl = new Acl();
     $moduleManager = $serviceLocator->get('ModuleManager');
     $modules = $moduleManager->getLoadedModules();
     $loadedModules = array_keys($modules);
     //print_r($loadedModules);
     if (!empty($loadedModules)) {
         foreach ($loadedModules as $key) {
             $acl->addResource(strtolower(trim($key)));
         }
     }
     if (isset($config['ACL_pages'])) {
         if (!empty($config['ACL_pages'])) {
             $aclArr = $config['ACL_pages'];
             foreach ($aclArr as $key => $value) {
                 $parent = null;
                 if (isset($value['parent'])) {
                     $parent = $value['parent'];
                 }
                 if (isset($parent)) {
                     $acl->addRole(new Role($key), $parent);
                 } else {
                     $acl->addRole(new Role($key));
                 }
                 if (isset($value['action'])) {
                     foreach ($value['action'] as $action => $actArr) {
                         foreach ($actArr as $index) {
                             $acl->allow($key, $action, $index);
                         }
                     }
                     //print_r($value['action']);
                 }
                 //print_r('--key-->'.$key.'--parent-->'.$parent);
                 $parent = null;
             }
         }
     }
     /*$acl->addRole(new Role('Consultant'))
       ->addRole(new Role('Supervisor'), 'Consultant')
       ->addRole(new Role('Admin'), 'Supervisor')
       ->addRole(new Role('Guest'))
       ->addRole(new Role('New User'), 'Guest')
       ->addRole(new Role('Firm User'), 'New User')
       ->addRole(new Role('Firm Owner'), 'Firm User');*/
     /*$acl->addResource('consultant');
       $acl->addResource('login');
       $acl->addResource('sanalfabrika');*/
     /*$acl->allow('consultant', 'sfdm', 'index'); 
       $acl->allow('consultant', 'sfdm', 'registration'); 
       $acl->allow('consultant', 'login', 'index'); */
     /*$acl->allow('anonymous', 'album', 'album:add'); 
       $acl->deny('anonymous', 'album', 'album:hello'); 
       $acl->allow('anonymous', 'album', 'album:view');
       $acl->allow('anonymous', 'album', 'album:edit'); */
     return $acl;
 }

 public function fillRoles(array $rolesConfig)
 {
     foreach ($rolesConfig as $role => $options) {
         $inherit = $this->getOption($options, self::INHERIT);
         if (null !== $inherit && !is_string($inherit) && !is_array($inherit) && !$inherit instanceof RoleInterface) {
             throw new Exceptions\RuntimeException('Inherit option must be a string, an array or implement RoleInterface for roles');
         }
         $this->acl->addRole($role, $inherit);
     }
 }

 public function setRoles(Acl $acl)
 {
     $acl->addRole(new Role($this->getConfig()->defaults->guestRoleName));
     foreach ($this->getConfig()->defaults->roles as $role => $subRole) {
         if (is_numeric($role)) {
             $acl->addRole(new Role($subRole), $this->getConfig()->defaults->guestRoleName);
         } else {
             $acl->addRole(new Role($role), new Role($subRole));
         }
     }
 }

 public function testIsAuthorizedNegative()
 {
     $acl = new Acl();
     $acl->addRole('administrator');
     $acl->addRole('foo', 'administrator');
     $acl->addRole('bar');
     $access = new AclInheritRoleAccess();
     $access->setAcl($acl);
     $access->setUser('bar');
     $this->assertFalse($access->isAuthorized());
 }

 private function _load()
 {
     if ($this->loaded == false) {
         // Add roles
         $config = $this->serviceLocator->get('config');
         if (isset($config['acl']['role_providers'])) {
             $roles = [];
             foreach ($config['acl']['role_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Role\ProviderInterface $roleProvider */
                 $roleProvider = $this->serviceLocator->get($class);
                 $roles = $roles + $roleProvider->getRoles();
             }
             foreach ($roles as $role) {
                 /** @var \Acl\Entity\Role $role */
                 $this->acl->addRole($role, $role->getParents());
             }
         }
         // Add resources
         if (isset($config['acl']['resource_providers'])) {
             foreach ($config['acl']['resource_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Resource\ProviderInterface $resourceProvider */
                 $resourceProvider = $this->serviceLocator->get($class);
                 $resources = $resourceProvider->getResources();
                 if ($resources) {
                     foreach ($resources as $r) {
                         if (!$this->acl->hasResource($r)) {
                             $this->acl->addResource($r);
                         }
                     }
                 }
             }
         }
         // Add rules
         if (isset($config['acl']['rule_providers'])) {
             $rules = [];
             foreach ($config['acl']['rule_providers'] as $class => $options) {
                 /** @var \Acl\Provider\Rule\ProviderInterface $ruleProvider */
                 $ruleProvider = $this->serviceLocator->get($class);
                 $rules = $rules + $ruleProvider->getRules();
             }
             foreach ($rules as $rule) {
                 /** @var \Acl\Entity\Rule $rule */
                 if ($rule->allow) {
                     $this->acl->allow($rule->obj_id, $rule->resource, $rule->privilege);
                 } else {
                     $this->acl->deny($rule->obj_id, $rule->resource, $rule->privilege);
                 }
             }
         }
         $this->loaded = true;
     }
 }

 public function getAcl()
 {
     if (!$this->acl) {
         $acl = new Acl();
         $roleGuest = new Role('guest');
         $acl->addRole($roleGuest);
         $acl->addRole(new Role('admin'), $roleGuest);
         $acl->allow($roleGuest, null, 'view');
         $acl->allow('admin', null, array('add', 'edit', 'delete'));
         $this->acl = $acl;
     }
     return $this->acl;
 }

 public function onBootstrap(MvcEvent $event)
 {
     $app = $event->getApplication();
     $sm = $app->getServiceManager();
     $em = $app->getEventManager();
     $cfg = $sm->get('Config');
     if (isset($cfg['deit_authorisation'])) {
         //get the service config
         $serviceCfg = $cfg['deit_authorisation'];
         //construct the Access Control List
         $acl = new Acl();
         if (isset($serviceCfg['acl']['roles'])) {
             foreach ($serviceCfg['acl']['roles'] as $key => $value) {
                 if (is_string($key)) {
                     $acl->addRole($key, $value);
                 } else {
                     $acl->addRole($value);
                 }
             }
         }
         if (isset($serviceCfg['acl']['resources'])) {
             foreach ($serviceCfg['acl']['resources'] as $resource) {
                 $acl->addResource($resource);
             }
         }
         if (isset($serviceCfg['acl']['rules']['allow'])) {
             foreach ($serviceCfg['acl']['rules']['allow'] as $resource => $role) {
                 $acl->allow($role, $resource);
             }
         }
         //create the authorisation service
         $service = new \DeitAuthorisationModule\Service();
         $service->setAcl($acl);
         if (isset($serviceCfg['default_role'])) {
             $service->setDefaultRole($serviceCfg['default_role']);
         }
         if (isset($serviceCfg['role_resolver'])) {
             $service->setRoleResolver($serviceCfg['role_resolver']);
         }
         //create the authorisation strategy
         $options = $sm->get('deit_authorisation_options');
         $strategy = $sm->get($options->getStrategy());
         //attach the service listeners
         $em->attachAggregate($strategy);
         $em->attachAggregate($service);
         //TODO: specify the view
     }
 }

 public function initAcl(MvcEvent $e)
 {
     //Creamos el objeto ACL
     $acl = new Acl();
     //Incluimos la lista de roles y permisos, nos devuelve un array
     $roles = (require 'config/autoload/acl.roles.php');
     foreach ($roles as $role => $resources) {
         //Indicamos que el rol será genérico
         $role = new \Zend\Permissions\Acl\Role\GenericRole($role);
         //Añadimos el rol al ACL
         $acl->addRole($role);
         //Recorremos los recursos o rutas permitidas
         foreach ($resources["allow"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Permitimos a ese rol ese recurso
             $acl->allow($role, $resource);
         }
         foreach ($resources["deny"] as $resource) {
             //Si el recurso no existe lo añadimos
             if (!$acl->hasResource($resource)) {
                 $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource));
             }
             //Denegamos a ese rol ese recurso
             $acl->deny($role, $resource);
         }
     }
     //Establecemos la lista de control de acceso
     $e->getViewModel()->acl = $acl;
 }