PHP Acl\Acl類代碼示例

 /**
  * Checks if the current user has the priviledge to do something.
  *
  * @param string $priviledge
  * @return AccessProhibitedException
  **/
 protected function _checkAcl($priviledge)
 {
     $service = new UserService($this->_em);
     if (!$this->_acl->isAllowed($service->getCurrentRole(), $this, $priviledge)) {
         throw new AccessProhibitedException('Access is prohibited.');
     }
 }

 /**
  * @return Acl
  */
 protected function roleAcl()
 {
     if (!$this->roleAcl) {
         $id = $this->objId();
         $this->roleAcl = new Acl();
         $this->roleAcl->addRole(new Role($id));
         $this->roleAcl->addResource(new Resource('admin'));
         $q = '
         select
             `denied`,
             `allowed`,
             `superuser`
         from
             `charcoal_admin_acl_roles`
         where
             ident = :id';
         $db = \Charcoal\App\App::instance()->getContainer()->get('database');
         $sth = $db->prepare($q);
         $sth->bindParam(':id', $id);
         $sth->execute();
         $permissions = $sth->fetch(\PDO::FETCH_ASSOC);
         $this->roleAllowed = explode(',', trim($permissions['allowed']));
         $this->roleDenied = explode(',', trim($permissions['denied']));
         foreach ($this->roleAllowed as $allowed) {
             $this->roleAcl->allow($id, 'admin', $allowed);
         }
         foreach ($this->roleDenied as $denied) {
             $this->roleAcl->deny($id, 'admin', $denied);
         }
     }
     return $this->roleAcl;
 }

 private function addAllowAndDeny(Acl $acl)
 {
     foreach ($this->config as $roleName => $roleConfig) {
         $allowList = isset($roleConfig['allow']) ? $roleConfig['allow'] : [];
         foreach ($allowList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->allow($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->allow($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
         $denyList = isset($roleConfig['deny']) ? $roleConfig['deny'] : [];
         foreach ($denyList as $resource => $privilegeList) {
             if (empty($privilegeList)) {
                 $acl->deny($roleName, strtolower($resource));
             } else {
                 foreach ((array) $privilegeList as $privilege) {
                     $acl->deny($roleName, strtolower($resource), strtolower($privilege));
                 }
             }
         }
     }
 }

 /**
  * autentica o usuário
  */
 public function autenticaAction()
 {
     if ($this->getRequest()->isPost()) {
         $this->adapter->setOptions(array('object_manager' => Conn::getConn(), 'identity_class' => 'MyClasses\\Entities\\AclUsuario', 'identity_property' => 'login', 'credential_property' => 'senha'));
         $this->adapter->setIdentityValue($this->getRequest()->getPost('login'));
         $this->adapter->setCredentialValue(sha1($this->getRequest()->getPost('senha')));
         $result = $this->auth->authenticate($this->adapter);
         if ($result->isValid()) {
             $equipes = $result->getIdentity()->getEquipes();
             $acl = new Acl();
             $acl->addRole(new Role($equipes[0]->getPerfil()));
             $recursos = $equipes[0]->getRecursos();
             foreach ($recursos as $recurso) {
                 if (!$acl->hasResource($recurso->getRecurso())) {
                     /* echo "add recurso: ".
                        $perfil->getPerfil().", ".
                        $recurso->getRecurso()->getRecurso().", ".
                        $recurso->getPermissao(); */
                     $acl->addResource(new Resource($recurso->getRecurso()));
                     $acl->allow($equipes[0]->getPerfil(), $recurso->getRecurso());
                 }
             }
             $this->auth->getStorage()->write(array($result->getIdentity(), $equipes[0]->getPerfil(), $acl));
             $this->layout()->id = $result->getIdentity()->getId();
             $this->layout()->nome = $result->getIdentity()->getNome();
             return new ViewModel(array('nome' => $result->getIdentity()->getNome()));
         } else {
             return new ViewModel(array('erro' => array_pop($result->getMessages())));
         }
     }
 }

 public function __invoke($serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $this->acl = $serviceLocator->get('MultiRoleAclBase\\Service\\MultiRolesAcl');
     if (get_class($this->acl) == 'MultiRoleAclBase\\Service\\MultiRolesAcl' || is_subclass_of($this->acl, 'MultiRoleAclBase\\Service\\MultiRolesAcl')) {
         $this->acl->setAllowAccessWhenResourceUnknown(false);
     }
     $this->roleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RoleBuilder');
     $this->resourceBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\ResourceBuilder');
     $this->ruleBuilder = $serviceLocator->get('MultiRoleAclBase\\Acl\\Builder\\RuleBuilder');
     // Get all Roles from RoleBuilder
     $roles = $this->roleBuilder->buildRoles($this->acl, $serviceLocator);
     if (is_array($roles)) {
         foreach ($roles as $role) {
             $this->acl->addRole($role);
         }
     }
     // Get all Resources from ResourceBuilder
     $resources = $this->resourceBuilder->buildResources($this->acl, $serviceLocator);
     if (is_array($resources)) {
         foreach ($resources as $resource) {
             $this->acl->addResource($resource);
         }
     }
     // Build all the rules
     $this->ruleBuilder->buildRules($this->acl, $serviceLocator);
     return $this->acl;
 }

 public function assert(Acl $acl, RoleInterface $role = null, ResourceInterface $resource = null, $privilege = null)
 {
     if (!$resource instanceof User) {
         return false;
     }
     return $acl->isAdminRole($resource->getRole());
 }

 /**
  * Check the acl
  *
  * @param string $resource
  * @param string $privilege
  * @return boolean
  */
 public function isAllowed($resource = null, $privilege = null)
 {
     if (null === $this->acl) {
         $this->getAcl();
     }
     return $this->acl->isAllowed($this->getIdentity()->getRoleId(), $resource, $privilege);
 }

 /**
  * @param Acl $acl
  * @param $resource
  */
 protected function addAclResource(ZendAcl $acl, AclResource $resource)
 {
     if (!$acl->hasResource($resource->getResource())) {
         $acl->addResource(new \Zend\Permissions\Acl\Resource\GenericResource($resource->getResource()));
     }
     return $this;
 }

 /**
  * Set and get Zend\Permissions\Acl\Acl
  *
  * @see \Contentinum\Service\AclAwareInterface::getAcl()
  * @return Zend\Permissions\Acl\Acl
  */
 public function getAcl($settings)
 {
     if (null === $this->acl) {
         $acl = new Acl();
         // start to set first roles ...
         foreach ($settings['roles'] as $role) {
             $parents = null;
             if (isset($settings['parent'][$role])) {
                 $parents = array($settings['parent'][$role]);
             }
             $acl->addRole($role, $parents);
         }
         $role = null;
         // ... then resoures ...
         foreach ($settings['resources'] as $resource) {
             $acl->addResource($resource);
         }
         // ... and now the rules
         foreach ($settings['rules'] as $access => $rule) {
             foreach ($rule as $role => $restrictions) {
                 foreach ($restrictions as $resource => $restriction) {
                     if ('all' == $restriction) {
                         $acl->{$access}($role, $resource);
                     } else {
                         $acl->{$access}($role, $resource, $restriction);
                     }
                 }
             }
         }
         $this->setAcl($acl);
     }
     return $this->acl;
 }

 /**
  * Create the service using the configuration from the modules config-file
  *
  * @param ServiceLocator $services The ServiceLocator
  *
  * @see \Zend\ServiceManager\FactoryInterface::createService()
  * @return Hybrid_Auth
  */
 public function createService(ServiceLocatorInterface $serviceLocator)
 {
     $config = $serviceLocator->get('config');
     $config = $config['acl'];
     if (!isset($config['roles']) || !isset($config['resources'])) {
         throw new \Exception('Invalid ACL Config found');
     }
     $roles = $config['roles'];
     if (!isset($roles[self::DEFAULT_ROLE])) {
         $roles[self::DEFAULT_ROLE] = '';
     }
     $this->admins = $config['admins'];
     if (!isset($this->admins)) {
         throw new \UnexpectedValueException('No admin-user set');
     }
     $acl = new Acl();
     foreach ($roles as $name => $parent) {
         if (!$acl->hasRole($name)) {
             if (empty($parent)) {
                 $parent = array();
             } else {
                 $parent = explode(',', $parent);
             }
             $acl->addRole(new Role($name), $parent);
         }
     }
     foreach ($config['resources'] as $permission => $controllers) {
         foreach ($controllers as $controller => $actions) {
             if ($controller == 'all') {
                 $controller = null;
             } else {
                 if (!$acl->hasResource($controller)) {
                     $acl->addResource(new Resource($controller));
                 }
             }
             foreach ($actions as $action => $role) {
                 if ($action == 'all') {
                     $action = null;
                 }
                 $assert = null;
                 if (is_array($role)) {
                     $assert = $serviceLocator->get($role['assert']);
                     $role = $role['role'];
                 }
                 $role = explode(',', $role);
                 foreach ($role as $roleItem) {
                     if ($permission == 'allow') {
                         $acl->allow($roleItem, $controller, $action, $assert);
                     } elseif ($permission == 'deny') {
                         $acl->deny($roleItem, $controller, $action, $assert);
                     } else {
                         continue;
                     }
                 }
             }
         }
     }
     return $acl;
 }

 public function testBuildItemWillAddRulesToAcl()
 {
     $this->assertFalse($this->acl->isAllowed('guest', 'login'));
     $this->assertFalse($this->acl->isAllowed('user', null, 'GET'));
     $this->assertTrue($this->object->buildItem());
     $this->assertTrue($this->acl->isAllowed('guest', 'login'));
     $this->assertTrue($this->acl->isAllowed('user', null, 'GET'));
 }

 /**
  * @param \Zend\Permissions\Acl\Resource\ResourceInterface|string $resource
  * @param string $action
  * @return bool
  */
 public function can($resource, $action)
 {
     foreach ($this->roles as $role) {
         if ($this->acl->isAllowed($role, $resource, $action)) {
             return true;
         }
     }
     return false;
 }

 public function testBuildCanAcceptXMLAsString()
 {
     $content = file_get_contents(__DIR__ . '/fixtures/test.xml');
     $this->object = new AclBuilder(new StringType($content), $this->acl);
     $this->assertTrue($this->object->build());
     $this->assertTrue($this->acl->hasRole('guest'));
     $this->assertTrue($this->acl->hasResource('logout'));
     $this->assertTrue($this->acl->isAllowed('guest', 'login'));
     $this->assertTrue($this->acl->isAllowed('user', null, 'GET'));
 }

 public function getPermissosAclRecursoDesprotegidos(\Zend\Permissions\Acl\Acl $acl, \Doctrine\ORM\EntityManager $em)
 {
     $repo = $em->getRepository('Security\\Entity\\Grupo');
     foreach ($repo->fetchPairs() as $grupo) {
         foreach ($this->getRecursosDesprotegidos() as $recurso) {
             $acl->allow($grupo, $recurso);
         }
     }
     return $acl;
 }

 public function testIsAuthorizedNegative()
 {
     $acl = new Acl();
     $acl->addRole('administrator');
     $acl->addRole('foo', 'administrator');
     $acl->addRole('bar');
     $access = new AclInheritRoleAccess();
     $access->setAcl($acl);
     $access->setUser('bar');
     $this->assertFalse($access->isAuthorized());
 }