acl.php

00001 <?php
00002 /* SVN FILE: $Id: console_2libs_2acl_8php-source.html 580 2008-07-01 14:45:49Z gwoo $ */
00003 /**
00004  * Short description for file.
00005  *
00006  * Long description for file
00007  *
00008  * PHP versions 4 and 5
00009  *
00010  * CakePHP(tm) :  Rapid Development Framework <http://www.cakephp.org/>
00011  * Copyright 2005-2008, Cake Software Foundation, Inc.
00012  *                              1785 E. Sahara Avenue, Suite 490-204
00013  *                              Las Vegas, Nevada 89104
00014  *
00015  * Licensed under The MIT License
00016  * Redistributions of files must retain the above copyright notice.
00017  *
00018  * @filesource
00019  * @copyright       Copyright 2005-2008, Cake Software Foundation, Inc.
00020  * @link                http://www.cakefoundation.org/projects/info/cakephp CakePHP(tm) Project
00021  * @package         cake
00022  * @subpackage      cake.cake.console.libs
00023  * @since           CakePHP(tm) v 1.2.0.5012
00024  * @version         $Revision: 580 $
00025  * @modifiedby      $LastChangedBy: gwoo $
00026  * @lastmodified    $Date: 2008-07-01 09:45:49 -0500 (Tue, 01 Jul 2008) $
00027  * @license         http://www.opensource.org/licenses/mit-license.php The MIT License
00028  */
00029 App::import('Component', 'Acl');
00030 App::import('Model', 'DbAcl');
00031 /**
00032  * Shell for ACL management.
00033  *
00034  * @package     cake
00035  * @subpackage  cake.cake.console.libs
00036  */
00037 class AclShell extends Shell {
00038 /**
00039  * Contains instance of AclComponent
00040  *
00041  * @var object
00042  * @access public
00043  */
00044     var $Acl;
00045 /**
00046  * Contains arguments parsed from the command line.
00047  *
00048  * @var array
00049  * @access public
00050  */
00051     var $args;
00052 /**
00053  * Contains database source to use
00054  *
00055  * @var string
00056  * @access public
00057  */
00058     var $dataSource = 'default';
00059 /**
00060  * Contains tasks to load and instantiate
00061  *
00062  * @var array
00063  * @access public
00064  */
00065     var $tasks = array('DbConfig');
00066 /**
00067  * Override startup of the Shell
00068  *
00069  * @access public
00070  */
00071     function startup() {
00072         $this->dataSource = 'default';
00073 
00074         if (isset($this->params['datasource'])) {
00075             $this->dataSource = $this->params['datasource'];
00076         }
00077 
00078         if (!in_array(Configure::read('Acl.classname'), array('DbAcl', 'DB_ACL'))) {
00079             $out = "--------------------------------------------------\n";
00080             $out .= __("Error: Your current Cake configuration is set to", true) . "\n";
00081             $out .= __("an ACL implementation other than DB. Please change", true) . "\n";
00082             $out .= __("your core config to reflect your decision to use", true) . "\n";
00083             $out .= __("DbAcl before attempting to use this script", true) . ".\n";
00084             $out .= "--------------------------------------------------\n";
00085             $out .= sprintf(__("Current ACL Classname: %s", true), Configure::read('Acl.classname')) . "\n";
00086             $out .= "--------------------------------------------------\n";
00087             $this->err($out);
00088             $this->_stop();
00089         }
00090 
00091         if ($this->command && !in_array($this->command, array('help'))) {
00092             if (!config('database')) {
00093                 $this->out(__("Your database configuration was not found. Take a moment to create one.", true), true);
00094                 $this->args = null;
00095                 return $this->DbConfig->execute();
00096             }
00097             require_once (CONFIGS.'database.php');
00098 
00099             if (!in_array($this->command, array('initdb'))) {
00100                 $this->Acl = new AclComponent();
00101                 $controller = null;
00102                 $this->Acl->startup($controller);
00103             }
00104         }
00105     }
00106 /**
00107  * Override main() for help message hook
00108  *
00109  * @access public
00110  */
00111     function main() {
00112         $out  = __("Available ACL commands:", true) . "\n";
00113         $out .= "\t - create\n";
00114         $out .= "\t - delete\n";
00115         $out .= "\t - setParent\n";
00116         $out .= "\t - getPath\n";
00117         $out .= "\t - check\n";
00118         $out .= "\t - grant\n";
00119         $out .= "\t - deny\n";
00120         $out .= "\t - inherit\n";
00121         $out .= "\t - view\n";
00122         $out .= "\t - initdb\n";
00123         $out .= "\t - help\n\n";
00124         $out .= __("For help, run the 'help' command.  For help on a specific command, run 'help <command>'", true);
00125         $this->out($out);
00126     }
00127 /**
00128  * Creates an ARO/ACO node
00129  *
00130  * @access public
00131  */
00132     function create() {
00133 
00134         $this->_checkArgs(3, 'create');
00135         $this->checkNodeType();
00136         extract($this->__dataVars());
00137 
00138         $class = ucfirst($this->args[0]);
00139         $object = new $class();
00140 
00141         if (preg_match('/^([\w]+)\.(.*)$/', $this->args[1], $matches) && count($matches) == 3) {
00142             $parent = array(
00143                 'model' => $matches[1],
00144                 'foreign_key' => $matches[2],
00145             );
00146         } else {
00147             $parent = $this->args[1];
00148         }
00149 
00150         if (!empty($parent) && $parent != '/' && $parent != 'root') {
00151             @$parent = $object->node($parent);
00152             if (empty($parent)) {
00153                 $this->err(sprintf(__('Could not find parent node using reference "%s"', true), $this->args[1]));
00154                 return;
00155             } else {
00156                 $parent = Set::extract($parent, "0.{$class}.id");
00157             }
00158         } else {
00159             $parent = null;
00160         }
00161 
00162         if (preg_match('/^([\w]+)\.(.*)$/', $this->args[2], $matches) && count($matches) == 3) {
00163             $data = array(
00164                 'model' => $matches[1],
00165                 'foreign_key' => $matches[2],
00166             );
00167         } else {
00168             if (!($this->args[2] == '/')) {
00169                 $data = array('alias' => $this->args[2]);
00170             } else {
00171                 $this->error(__('/ can not be used as an alias!', true), __('\t/ is the root, please supply a sub alias', true));
00172             }
00173         }
00174 
00175         $data['parent_id'] = $parent;
00176         $object->create();
00177 
00178         if ($object->save($data)) {
00179             $this->out(sprintf(__("New %s '%s' created.\n", true), $class, $this->args[2]), true);
00180         } else {
00181             $this->err(sprintf(__("There was a problem creating a new %s '%s'.", true), $class, $this->args[2]));
00182         }
00183     }
00184 /**
00185  * Delete an ARO/ACO node.
00186  *
00187  * @access public
00188  */
00189     function delete() {
00190         $this->_checkArgs(2, 'delete');
00191         $this->checkNodeType();
00192         extract($this->__dataVars());
00193         if (!$this->Acl->{$class}->delete($this->args[1])) {
00194             $this->error(__("Node Not Deleted", true), sprintf(__("There was an error deleting the %s. Check that the node exists", true), $class) . ".\n");
00195         }
00196         $this->out(sprintf(__("%s deleted", true), $class) . ".\n", true);
00197     }
00198 
00199 /**
00200  * Set parent for an ARO/ACO node.
00201  *
00202  * @access public
00203  */
00204     function setParent() {
00205         $this->_checkArgs(3, 'setParent');
00206         $this->checkNodeType();
00207         extract($this->__dataVars());
00208         $data = array(
00209             $class => array(
00210                 'id'        => $this->args[1],
00211                 'parent_id' => $this->args[2]
00212             )
00213         );
00214         $this->Acl->{$class}->create();
00215         if (!$this->Acl->{$class}->save($data)) {
00216             $this->out(__("Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.", true), true);
00217         } else {
00218             $this->out(sprintf(__("Node parent set to %s", true), $this->args[2]) . "\n", true);
00219         }
00220     }
00221 /**
00222  * Get path to specified ARO/ACO node.
00223  *
00224  * @access public
00225  */
00226     function getPath() {
00227         $this->_checkArgs(2, 'getPath');
00228         $this->checkNodeType();
00229         extract($this->__dataVars());
00230         $id = ife(is_numeric($this->args[1]), intval($this->args[1]), $this->args[1]);
00231         $nodes = $this->Acl->{$class}->getPath($id);
00232         if (empty($nodes)) {
00233             $this->error(sprintf(__("Supplied Node '%s' not found", true), $this->args[1]), __("No tree returned.", true));
00234         }
00235         for ($i = 0; $i < count($nodes); $i++) {
00236             $this->out(str_repeat('  ', $i) . "[" . $nodes[$i][$class]['id'] . "]" . $nodes[$i][$class]['alias'] . "\n");
00237         }
00238     }
00239 /**
00240  * Check permission for a given ARO to a given ACO.
00241  *
00242  * @access public
00243  */
00244     function check() {
00245         $this->_checkArgs(3, 'check');
00246         extract($this->__getParams());
00247 
00248         if ($this->Acl->check($aro, $aco, $action)) {
00249             $this->out(sprintf(__("%s is allowed.", true), $aro), true);
00250         } else {
00251             $this->out(sprintf(__("%s is not allowed.", true), $aro), true);
00252         }
00253     }
00254 /**
00255  * Grant permission for a given ARO to a given ACO.
00256  *
00257  * @access public
00258  */
00259     function grant() {
00260         $this->_checkArgs(3, 'grant');
00261         extract($this->__getParams());
00262 
00263         if ($this->Acl->allow($aro, $aco, $action)) {
00264             $this->out(__("Permission granted.", true), true);
00265         } else {
00266             $this->out(__("Permission was not granted.", true), true);
00267         }
00268     }
00269 /**
00270  * Deny access for an ARO to an ACO.
00271  *
00272  * @access public
00273  */
00274     function deny() {
00275         $this->_checkArgs(3, 'deny');
00276         extract($this->__getParams());
00277 
00278         if ($this->Acl->deny($aro, $aco, $action)) {
00279             $this->out(__("Permission denied.", true), true);
00280         } else {
00281             $this->out(__("Permission was not denied.", true), true);
00282         }
00283     }
00284 /**
00285  * Set an ARO to inhermit permission to an ACO.
00286  *
00287  * @access public
00288  */
00289     function inherit() {
00290         $this->_checkArgs(3, 'inherit');
00291         extract($this->__getParams());
00292 
00293         if ($this->Acl->inherit($aro, $aco, $action)) {
00294             $this->out(__("Permission inherited.", true), true);
00295         } else {
00296             $this->out(__("Permission was not inherited.", true), true);
00297         }
00298     }
00299 /**
00300  * Show a specific ARO/ACO node.
00301  *
00302  * @access public
00303  */
00304     function view() {
00305         $this->_checkArgs(1, 'view');
00306         $this->checkNodeType();
00307         extract($this->__dataVars());
00308         if (isset($this->args[1]) && !is_null($this->args[1])) {
00309             $key = ife(is_numeric($this->args[1]), $secondary_id, 'alias');
00310             $conditions = array($class . '.' . $key => $this->args[1]);
00311         } else {
00312             $conditions = null;
00313         }
00314         $nodes = $this->Acl->{$class}->find('all', array('conditions' => $conditions, 'order' => 'lft ASC'));
00315         if (empty($nodes)) {
00316             if (isset($this->args[1])) {
00317                 $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
00318             } elseif (isset($this->args[0])) {
00319                 $this->error(sprintf(__("%s not found", true), $this->args[0]), __("No tree returned.", true));
00320             }
00321         }
00322         $this->out($class . " tree:");
00323         $this->hr();
00324         $stack = array();
00325         $last  = null;
00326         foreach ($nodes as $n) {
00327             $stack[] = $n;
00328             if (!empty($last)) {
00329                 $end = end($stack);
00330                 if ($end[$class]['rght'] > $last) {
00331                     foreach ($stack as $k => $v) {
00332                         $end = end($stack);
00333                         if ($v[$class]['rght'] < $end[$class]['rght']) {
00334                             unset($stack[$k]);
00335                         }
00336                     }
00337                 }
00338             }
00339             $last   = $n[$class]['rght'];
00340             $count  = count($stack);
00341             $this->out(str_repeat('  ', $count) . "[" . $n[$class]['id'] . "]" . $n[$class]['alias']."\n");
00342         }
00343         $this->hr();
00344     }
00345 /**
00346  * Initialize ACL database.
00347  *
00348  * @access public
00349  */
00350     function initdb() {
00351         $this->Dispatch->args = array('schema', 'run', 'create', 'DbAcl');
00352         $this->Dispatch->dispatch();
00353     }
00354 /**
00355  * Show help screen.
00356  *
00357  * @access public
00358  */
00359     function help() {
00360         $head  = __("Usage: cake acl <command> <arg1> <arg2>...", true) . "\n";
00361         $head .= "-----------------------------------------------\n";
00362         $head .= __("Commands:", true) . "\n\n";
00363 
00364         $commands = array(
00365             'create' => "\tcreate aro|aco <parent> <node>\n" .
00366                         "\t\t" . __("Creates a new ACL object <node> under the parent specified by <parent>, an id/alias.", true) . "\n" .
00367                         "\t\t" . __("The <parent> and <node> references can be in one of the following formats:", true) . "\n" .
00368                         "\t\t\t- " . __("<model>.<id> - The node will be bound to a specific record of the given model", true) . "\n" .
00369                         "\t\t\t- " . __("<alias> - The node will be given a string alias (or path, in the case of <parent>),", true) . "\n" .
00370                         "\t\t\t  " . __("i.e. 'John'.  When used with <parent>, this takes the form of an alias path,", true) . "\n" .
00371                         "\t\t\t  " . __("i.e. <group>/<subgroup>/<parent>.", true) . "\n" .
00372                         "\t\t" . __("To add a node at the root level, enter 'root' or '/' as the <parent> parameter.", true) . "\n",
00373 
00374             'delete' => "\tdelete aro|aco <node>\n" .
00375                         "\t\t" . __("Deletes the ACL object with the given <node> reference (see 'create' for info on node references).", true) . "\n",
00376 
00377             'setparent' => "\tsetParent aro|aco <node> <parent>\n" .
00378                             "\t\t" . __("Moves the ACL object specified by <node> beneath the parent ACL object specified by <parent>.", true) . "\n" .
00379                             "\t\t" . __("To identify the node and parent, use the row id.", true) . "\n",
00380 
00381             'getpath' => "\tgetPath aro|aco <node>\n" .
00382                         "\t\t" . __("Returns the path to the ACL object specified by <node>. This command", true) . "\n" .
00383                         "\t\t" . __("is useful in determining the inhertiance of permissions for a certain", true) . "\n" .
00384                         "\t\t" . __("object in the tree.", true) . "\n" .
00385                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00386 
00387             'check' =>  "\tcheck <aro_id> <aco_id> [<aco_action>] " . __("or", true) . " all\n" .
00388                         "\t\t" . __("Use this command to check ACL permissions.", true) . "\n" .
00389                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00390 
00391             'grant' =>  "\tgrant <aro_id> <aco_id> [<aco_action>] " . __("or", true) . " all\n" .
00392                         "\t\t" . __("Use this command to grant ACL permissions. Once executed, the ARO", true) . "\n" .
00393                         "\t\t" . __("specified (and its children, if any) will have ALLOW access to the", true) . "\n" .
00394                         "\t\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
00395                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00396 
00397             'deny' =>   "\tdeny <aro_id> <aco_id> [<aco_action>]" . __("or", true) . " all\n" .
00398                         "\t\t" . __("Use this command to deny ACL permissions. Once executed, the ARO", true) . "\n" .
00399                         "\t\t" . __("specified (and its children, if any) will have DENY access to the", true) . "\n" .
00400                         "\t\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
00401                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00402 
00403             'inherit' =>    "\tinherit <aro_id> <aco_id> [<aco_action>]" . __("or", true) . " all\n" .
00404                             "\t\t" . __("Use this command to force a child ARO object to inherit its", true) . "\n" .
00405                             "\t\t" . __("permissions settings from its parent.", true) . "\n" .
00406                             "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00407 
00408             'view' =>   "\tview aro|aco [<node>]\n" .
00409                         "\t\t" . __("The view command will return the ARO or ACO tree. The optional", true) . "\n" .
00410                         "\t\t" . __("id/alias parameter allows you to return only a portion of the requested tree.", true) . "\n" .
00411                         "\t\t" . __("For more detailed parameter usage info, see help for the 'create' command.", true) . "\n",
00412 
00413             'initdb' => "\tinitdb\n".
00414                         "\t\t" . __("Uses this command : cake schema run create DbAcl", true) . "\n",
00415 
00416             'help' =>   "\thelp [<command>]\n" .
00417                         "\t\t" . __("Displays this help message, or a message on a specific command.", true) . "\n"
00418         );
00419 
00420         $this->out($head);
00421         if (!isset($this->args[0])) {
00422             foreach ($commands as $cmd) {
00423                 $this->out("{$cmd}\n\n");
00424             }
00425         } elseif (isset($commands[low($this->args[0])])) {
00426             $this->out($commands[low($this->args[0])] . "\n\n");
00427         } else {
00428             $this->out(sprintf(__("Command '%s' not found", true), $this->args[0]));
00429         }
00430     }
00431 /**
00432  * Check that first argument specifies a valid Node type (ARO/ACO)
00433  *
00434  * @access public
00435  */
00436     function checkNodeType() {
00437         if (!isset($this->args[0])) {
00438             return false;
00439         }
00440         if ($this->args[0] != 'aco' && $this->args[0] != 'aro') {
00441             $this->error(sprintf(__("Missing/Unknown node type: '%s'", true), $this->args[1]), __('Please specify which ACL object type you wish to create.', true));
00442         }
00443     }
00444 /**
00445  * Checks that given node exists
00446  *
00447  * @param string $type Node type (ARO/ACO)
00448  * @param integer $id Node id
00449  * @return boolean Success
00450  * @access public
00451  */
00452     function nodeExists() {
00453         if (!$this->checkNodeType() && !isset($this->args[1])) {
00454             return false;
00455         }
00456         extract($this->__dataVars($this->args[0]));
00457         $key = (ife(is_numeric($this->args[1]), $secondary_id, 'alias'));
00458         $conditions = array($class . '.' . $key => $this->args[1]);
00459         $possibility = $this->Acl->{$class}->find('all', compact('conditions'));
00460         if (empty($possibility)) {
00461             $this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
00462         }
00463         return $possibility;
00464     }
00465 /**
00466  * get params for standard Acl methods
00467  *
00468  * @return array aro, aco, action
00469  * @access private
00470  */
00471     function __getParams() {
00472         $aro = ife(is_numeric($this->args[0]), intval($this->args[0]), $this->args[0]);
00473         $aco = ife(is_numeric($this->args[1]), intval($this->args[1]), $this->args[1]);
00474 
00475         if (is_string($aro) && preg_match('/^([\w]+)\.(.*)$/', $aro, $matches)) {
00476             $aro = array(
00477                 'model' => $matches[1],
00478                 'foreign_key' => $matches[2],
00479             );
00480         }
00481 
00482         if (is_string($aco) && preg_match('/^([\w]+)\.(.*)$/', $aco, $matches)) {
00483             $aco = array(
00484                 'model' => $matches[1],
00485                 'foreign_key' => $matches[2],
00486             );
00487         }
00488 
00489         $action = null;
00490         if (isset($this->args[2])) {
00491             $action = $this->args[2];
00492             if ($action == '' || $action == 'all') {
00493                 $action = '*';
00494             }
00495         }
00496         return compact('aro', 'aco', 'action');
00497     }
00498 
00499 /**
00500  * Build data parameters based on node type
00501  *
00502  * @param string $type Node type  (ARO/ACO)
00503  * @return array Variables
00504  * @access private
00505  */
00506     function __dataVars($type = null) {
00507         if ($type == null) {
00508             $type = $this->args[0];
00509         }
00510         $vars = array();
00511         $class = ucwords($type);
00512         $vars['secondary_id'] = ife(strtolower($class) == 'aro', 'foreign_key', 'object_id');
00513         $vars['data_name'] = $type;
00514         $vars['table_name'] = $type . 's';
00515         $vars['class'] = $class;
00516         return $vars;
00517     }
00518 }
00519 ?>
The API

acl.php
