Skip to content

Commit 448aa7a

Browse files
TiSiETiSiE
committed
[Applications] Refactor assertion for application access.
* Now one Assertion handles all access. (Currently only "read" and "delete"); * Small fixes and improvements in Acl and Authentication handling
1 parent 1b0287c commit 448aa7a

File tree

9 files changed

+96
-96
lines changed

9 files changed

+96
-96
lines changed

‎module/Applications/config/module.config.php

+5-60
Original file line numberDiff line numberDiff line change
@@ -103,83 +103,28 @@
103103
),
104104
),
105105
),
106-
'applicationsData' => array(
107-
'type' => 'Segment',
108-
'options' => array(
109-
'route' => '/rest/applications/:method/:key',
110-
'constraints' => array(
111-
'method' => '(get|set)',
112-
'key' => '.+',
113-
),
114-
'defaults' => array(
115-
'controller' => '\Applications\Controller\Manage',
116-
'action' => 'rest',
117-
),
118-
),
119-
'may_terminate' => true,
120-
'child_routes' => array(
121-
'detail' => array(
122-
'type' => 'Segment',
123-
'options' => array(
124-
'route' => '/:id',
125-
'constraints' => array(
126-
'id' => '[a-z0-9]+',
127-
),
128-
'defaults' => array(
129-
'action' => 'detail',
130-
),
131-
),
132-
),
133-
),
134-
),
135-
),
136-
),
137-
'applicationsData' => array(
138-
'type' => 'Segment',
139-
'options' => array(
140-
'route' => '/rest/applications/:method/:key',
141-
'constraints' => array(
142-
'method' => '(get|set)',
143-
'key' => '.+',
144-
),
145-
'defaults' => array(
146-
'controller' => '\Applications\Controller\Manage',
147-
'action' => 'rest',
148-
),
149-
),
150-
'may_terminate' => true,
151-
'child_routes' => array(
152-
'detail' => array(
153-
'type' => 'Segment',
154-
'options' => array(
155-
'route' => '/:id',
156-
'constraints' => array(
157-
'id' => '[a-z0-9]+',
158-
),
159-
'defaults' => array(
160-
'action' => 'detail',
161-
),
162-
),
163-
),
164106
),
165107
),
166108
),
167109
),
110+
111+
168112
'acl' => array(
169113
'rules' => array(
170114
'user' => array(
171115
'allow' => array(
172116
'route/lang/applications',
173117
'Applications\Controller\Manage',
174118
'Entity/Application' => array(
175-
'delete' => 'Applications/WriteAccess'
119+
'__ALL__' => 'Applications/Access',
120+
176121
),
177122
),
178123
),
179124
),
180125
'assertions' => array(
181126
'invokables' => array(
182-
'Applications/WriteAccess' => 'Applications\Acl\ApplicationWriteAccessAssertion',
127+
'Applications/Access' => 'Applications\Acl\ApplicationAccessAssertion',
183128
),
184129
),
185130
),

‎module/Applications/src/Applications/Acl/ApplicationWriteAccessAssertion.php renamed to ‎module/Applications/src/Applications/Acl/ApplicationAccessAssertion.php

+20-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
use Applications\Entity\ApplicationInterface;
1818
use Auth\Entity\UserInterface;
1919

20-
class ApplicationWriteAccessAssertion implements AssertionInterface
20+
class ApplicationAccessAssertion implements AssertionInterface
2121
{
2222
/* (non-PHPdoc)
2323
* @see \Zend\Permissions\Acl\Assertion\AssertionInterface::assert()
@@ -30,7 +30,26 @@ public function assert(Acl $acl,
3030
if (!$role instanceOf UserInterface || !$resource instanceOf ApplicationInterface) {
3131
return false;
3232
}
33+
34+
switch ($privilege) {
35+
case 'read':
36+
return $this->assertRead($role, $resource)
37+
|| $this->assertWrite($role, $resource);
38+
break;
3339

40+
default:
41+
return $this->assertWrite($role, $resource);
42+
break;
43+
}
44+
}
45+
46+
protected function assertRead($role, $resource)
47+
{
48+
return $resource->getUserId() == $role->getId();
49+
}
50+
51+
protected function assertWrite($role, $resource)
52+
{
3453
$job = $resource->getJob();
3554
return ($job && $role->getId() == $job->getUserId());
3655
}

‎module/Applications/src/Applications/Controller/IndexController.php

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@ public function indexAction()
8888
}
8989
//$form->populateValues($data);
9090
} else {
91-
91+
$auth = $this->auth();
92+
93+
if ($auth->isLoggedIn()) {
94+
$applicationEntity->setUserId($auth('id'));
95+
}
9296
$applicationEntity->setStatus(new Status());
9397
//$applicationEntity->injectJob($job);
9498
$imageData = $form->get('contact')->get('image')->getValue();

‎module/Applications/src/Applications/Controller/ManageController.php

+10-32
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
class ManageController extends AbstractActionController
2828
{
2929

30-
public function onDispatch(\Zend\Mvc\MvcEvent $e)
30+
public function onDispatch(\Zend\Mvc\MvcEvent $e)
3131
{
3232
$routeMatch = $e->getRouteMatch();
3333
$action = $this->params()->fromQuery('action');
@@ -100,10 +100,16 @@ public function indexAction()
100100

101101
public function detailAction(){
102102

103+
$nav = $this->getServiceLocator()->get('main_navigation');
104+
$page = $nav->findByRoute('lang/applications');
105+
$page->setActive();
106+
103107
$application = $this->getServiceLocator()
104108
->get('repositories')
105109
->get('application')->find($this->params('id'), 'EAGER');
106110

111+
$this->acl($application, 'read');
112+
107113
$jsonFormat = 'json' == $this->params()->fromQuery('format');
108114
if ($jsonFormat) {
109115
$viewModel = new JsonModel();
@@ -116,41 +122,11 @@ public function detailAction(){
116122
return $viewModel;
117123
}
118124

119-
$nav = $this->getServiceLocator()->get('main_navigation');
120-
$page = $nav->findByRoute('lang/applications');
121-
$page->setActive();
125+
122126

123127
return array('application'=> $application);
124128
}
125129

126-
public function restAction() {
127-
$method = $this->params('method');
128-
$value = $this->params()->fromPost('value','');
129-
$key = $this->params('key');
130-
$user = $this->auth()->getUser();
131-
$result = array();
132-
if (strcasecmp($key, 'mailtext') == 0) {
133-
$settingsJobAuth = $this->settings('auth', $user);
134-
if (strcasecmp($method, 'get') == 0) {
135-
$mailtext = $settingsJobAuth->getMailText();
136-
$result = array('result' => isset($mailtext)?$mailtext:'');
137-
}
138-
if (strcasecmp($method, 'set') == 0) {
139-
$settingsJobAuth->setAccessWrite(True);
140-
$settingsJobAuth->setMailText($value);
141-
$result = array('result' => $settingsJobAuth->getMailText());
142-
//$result['old'] = $value;
143-
//$result['post'] = $_POST;
144-
//$result['get'] = $_GET;
145-
//$result['server'] = $_SERVER;
146-
//$result['request'] = $_REQUEST;
147-
}
148-
}
149-
$viewModel = new JsonModel();
150-
$viewModel->setVariables($result);
151-
return $viewModel;
152-
}
153-
154130
public function statusAction()
155131
{
156132
$applicationId = $this->params('id');
@@ -252,6 +228,8 @@ public function forwardAction()
252228
$application = $services->get('repositories')->get('application')
253229
->find($this->params('id'), 'EAGER');
254230

231+
$this->acl($application, 'forward');
232+
255233
$translator = $services->get('translator');
256234

257235
if (!$emailAddress) {

‎module/Applications/src/Applications/Entity/Application.php

+25
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ class Application extends AbstractIdentifiableEntity implements ApplicationInter
1717
protected $jobId;
1818
protected $job;
1919

20+
protected $userId;
21+
protected $user;
22+
2023
/*
2124
* new
2225
*/
@@ -82,6 +85,28 @@ public function injectJob(EntityInterface $job)
8285
$this->setJobId($job->getId());
8386
return $this;
8487
}
88+
89+
public function setUserId($userId)
90+
{
91+
$this->userId = $userId;
92+
return $this;
93+
}
94+
95+
public function getUserId()
96+
{
97+
return $this->userId;
98+
}
99+
100+
public function injectUser(EntityInterface $user)
101+
{
102+
$this->user = $user;
103+
return $this;
104+
}
105+
106+
public function getUser()
107+
{
108+
return $this->user;
109+
}
85110

86111
public function setStatus($status)
87112
{

‎module/Applications/src/Applications/Entity/ApplicationInterface.php

+6
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ public function getJobId();
1515
public function getJob();
1616
public function injectJob(EntityInterface $job);
1717

18+
public function setUserId($userId);
19+
public function getUserId();
20+
21+
public function injectUser(EntityInterface $user);
22+
public function getUser();
23+
1824
public function setStatus($status);
1925
public function getStatus();
2026

‎module/Applications/src/Applications/Repository/EntityBuilder/ApplicationBuilder.php

+11
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,17 @@ public function build($data = array())
4949
$entity->injectJob($job);
5050
}
5151

52+
if (!$entity->user) {
53+
$userId = $entity->getUserId();
54+
if ($userId) {
55+
$user = new RelationEntity(
56+
array($this->repositories->get('user'), 'find'),
57+
array($userId)
58+
);
59+
$entity->injectUser($user);
60+
}
61+
}
62+
5263
$attachments = isset($data['refs']['applications-files'])
5364
? new RelationCollection(
5465
array($this->mappers->get('Applications/Files'), 'fetchByIds'),

‎module/Auth/src/Acl/Controller/Plugin/Acl.php

+11-2
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,19 @@ public function test($resource, $privilege=null)
7575
public function check($resource, $privilege=null)
7676
{
7777
if (!$this->test($resource, $privilege)) {
78+
79+
$msg = null === $privilege
80+
? sprintf('You are not allowed to access resource "%s"',
81+
is_object($resource) ? $resource->getResourceId() : $resource
82+
)
83+
: sprintf('You are not allowed to execute operation "%s" on resource "%s"',
84+
$privilege, is_object($resource) ? $resource->getResourceId() : $resource
85+
);
86+
7887
if ($resource instanceOf FileEntityInterface && 0 == strpos($resource->type, 'image/')) {
79-
throw new UnauthorizedImageAccessException('User access denied');
88+
throw new UnauthorizedImageAccessException(str_replace('resource', 'image', $msg));
8089
}
81-
throw new UnauthorizedAccessException('User access denied');
90+
throw new UnauthorizedAccessException($msg);
8291
}
8392
}
8493

‎module/Auth/src/Auth/Controller/Plugin/Auth.php

+3
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ public function __invoke($property=null)
3030
if (null === $property) {
3131
return $this;
3232
}
33+
if (true === $property) {
34+
return $this->isLoggedIn();
35+
}
3336
return $this->get($property);
3437
}
3538

0 commit comments

Comments
 (0)