Changeset 2445

Timestamp:

09/05/08 03:39:36 (3 months ago)

Author:

bjohnson

Message:

Schema06: Committing more work in progress on ACL. Nothing has been tested yet, but I've finished the first pass through the ACL and UserGroup classes.

Location:

branches/schema06/system/classes

Files:

• acl.php (modified) (10 diffs)
• usergroup.php (modified) (6 diffs)

branches/schema06/system/classes/acl.php

@@ -27 +27 @@
 
     /**
+     * Static initializer to fill the $permission_ids array
+     */
+    public static function __static()
+    {
+        $result = DB::get_results( 'SELECT id, name FROM {permissions};' );
+        foreach ( $result as $r ) {
+            self::$permission_ids[$r->name] = $r->id;
+        }
+    }
+
+    /**
      * Convert a permission access name (read, write, full, denied) into an ID
      * @param string The access name
@@ -33 +44 @@
     public static function permission_id( $name )
     {
-        if ( count( $access_ids ) == 0 ) {
-            $result = DB::query( 'SELECT id, name FROM {permissions};' );
-            foreach ( $result as $r ) {
-                $access_ids[$r->name] = $r->id;
-            }
-        }
-
-        return ( isset( $access_ids[$name] ) ? $access_ids[$name] : FALSE;
-    }
-
-    /**
-     * Create a new permission, and save it to the Permissions table
+        return ( isset( self::$permission_ids[$name] ) ? self::$permission_ids[$name] : FALSE;
+    }
+
+    /**
+     * Create a new permission, and save it to the permission tokens table
      * @param string The name of the permission
      * @param string The description of the permission
@@ -117 +121 @@
      * @return array an array of QueryRecord objects containing all permissions
     **/
-    public static function all_permission_tokens( $order= 'id' )
+    public static function all_permissions( $order= 'id' )
     {
         $order = strtolower( $order );
@@ -222 +226 @@
         $group = UserGroup::id( $group );
         $permission = self::token_id( $permission );
-        $sql = <<<SQL
-SELECT p.name FROM {group_token_permissions} gp, {permissions} p WHERE
-gp.group_id=? AND gp.token_id=? AND gp.permission_id=p.id;
-SQL;
+        $sql = 'SELECT permission_id FROM {group_token_permissions} WHERE
+            group_id=? AND token_id=?;';
+
         $result = DB::get_value( $sql );
-        if ( $result == $access ) {
+        if ( $result !== FALSE && self::$permission_ids[$result] == $access ) {
             // the permission has been granted to this group
             return true;
@@ -276 +279 @@
          */ 
         $sql = <<<SQL
-SELECT COALESCE(permission_id, 0) as permission_id
+SELECT permission_id
 FROM (
 (
@@ -300 +303 @@
         $result = DB::get_value( $sql, array( ':user_id' => $user_id, ':token_id' => $permission );
 
-        // TODO: modify above call to return the permission name rather than the ID
-        // For now, I'll just look for a result > 0
-        if ( $result !== FALSE && intval($result) > 0 ) {
+        if ( $result !== FALSE && self::permission_ids[$result] == $access ) {
             return true;
         }
 
-        // if the permission is neither denied nor granted, they're not
-        // allowed to do it.
-        return self::ACCESS_NONEXISTANT_PERMISSION;
+        // either the permission hasn't been granted, or it's been
+        // explicitly denied.
         return false;
     }
@@ -315 +315 @@
      * Grant a permission to a group
      * @param integer $group_id The group ID
-     * @param integer $token_id The permission token to grant
+     * @param mixed $token_id The name or ID of the permission token to grant
      * @param string $access The kind of access to assign the group
      * @return Result of the DB query
@@ -321 +321 @@
     public static function grant_group( $group_id, $token_id, $access = 'full' )
     {
-        $result = DB::query( 'INSERT INTO {group_tokens_permissions} (group_id, token_id, permission_id) VALUES (?, ?, ?);',
-            array( $group_id, $token_id, self::permission_ids( $access ) );
+        // DB::update will insert if the token is not already in the group tokens table
+        $result = DB::update(
+            '{group_tokens_permissions}',
+            array( 'permission_id' => self::$permission_ids[$access] ),
+            array( 'group_id' => $group_id, 'token_id' => self::token_id( $token_id ) )
+        );
+
         return $result;
     }
@@ -329 +334 @@
      * Grant a permission to a user 
      * @param integer $user_id The user ID
-     * @param integer $token_id The permission token to grant
+     * @param integer $token_id The name or ID of the permission token to grant
      * @param string $access The kind of access to assign the group
      * @return Result of the DB query
@@ -335 +340 @@
     public static function grant_user( $user_id, $token_id, $access = 'full' )
     {
-        $result = DB::query( 'INSERT INTO {user_tokens_permissions} (user_id, token_id, permission_id) VALUES (?, ?, ?);',
-            array( $user_id, $token_id, self::permission_ids( $access ) );
+        $result = DB::update(
+            '{user_tokens_permissions}',
+            array( 'permission_id' => self::$permission_ids[$access] ),
+            array( 'user_id' => $user_id, 'token_id' => self::token_id( $token_id ) )
+        );
+
         return $result;
     }
     
+    /**
+     * Deny permission to a group
+     * @param integer $group_id The group ID
+     * @param mixed $token_id The name or ID of the permission token
+     * @return Result of the DB query
+     **/
+    public static function deny_group( $group_id, $token_id )
+    {
+        self::grant_group( $group_id, $token_id, 'deny' );
+    }
+
+    /**
+     * Deny permission to a user 
+     * @param integer $user_id The user ID
+     * @param mixed $token_id The name or ID of the permission token
+     * @return Result of the DB query
+     **/
+    public static function deny_user( $user_id, $token_id )
+    {
+        self::grant_user( $group_id, $token_id, 'deny' );
+    }   
+
+    /**
+     * Remove a permission from the group permissions table
+     * @param integer $group_id The group ID
+     * @param mixed $token_id The name or ID of the permission token
+     * @return the result of the DB query
+     **/
+    public static function revoke_group_permission( $group_id, $token_id )
+    {
+        $result = DB::delete( '{group_tokens_permissions}',
+            array( 'group_id' => $group_id, 'token_id' => $token_id ) );
+
+        return $result;
+    }
+
+    /**
+     * Remove a permission from the user permissions table
+     * @param integer $user_id The user ID
+     * @param mixed $token_id The name or ID of the permission token
+     * @return the result of the DB query
+     **/
+    public static function revoke_user_permission( $user_id, $token_id )
+    {
+        $result = DB::delete( '{user_tokens_permissions}',
+            array( 'user_id' => $user_id, 'token_id' => $token_id ) );
+
+        return $result;
+    }
 
     /**

branches/schema06/system/classes/usergroup.php

@@ -7 +7 @@
 {
     // These arrays hold the current membership and permission settings for this group
-    // These arrays are NOT matched key and value pairs (the are not stored like array('foo'=>'foo') )
+    // $member_ids is not NOT matched key and value pairs ( like array('foo'=>'foo') )
     private $member_ids = array();
     private $permissions = array();
@@ -43 +43 @@
             if ( $results= DB::get_results( 'SELECT token_id, permission_id FROM {group_token_permissions} WHERE group_id=?', array( $this->id ) ) ) {
                 foreach ( $results as $result ) {
-                    $this->permissions[] = array(
-                        'token_id' => $result->token_id,
-                        'permission_id' => $result->permission_id,
-                    );
+                    $this->permissions[$result->token_id] = $result->permission_id;
                 }
             }
@@ -209 +206 @@
      * @param mixed A permission token ID, name, or array of the same
     **/
-    public function grant( $permissions )
+    public function grant( $permissions, $access = 'full' )
     {
         $permissions = Utils::single_array( $permissions );
         // Use ids internally for all permissions
         $permissions = array_map(array('ACL', 'token_id'), $permissions);
-        // Merge the new permissions
-        $this->permissions_granted = $this->permissions_granted + $permissions;
-        // List each permission exactly once
-        $this->permissions_granted = array_unique($this->permissions_granted);
-        // Remove granted permissions from the denied list
-        $this->permissions_denied = array_diff($this->permissions_denied, $this->permissions_granted);
+
+        // Merge and grant the new permissions
+        foreach ( $permissions as $permission ) {
+            $this->permissions[$permission] = $access;
+            ACL::grant_group( $this->id, $permission, $access );
+        }
     }
 
@@ -228 +225 @@
     public function deny( $permissions )
     {
-        $permissions = Utils::single_array( $permissions );
-        // Use ids internally for all permissions
-        $permissions = array_map(array('ACL', 'permission_id'), $permissions);
-        // Merge the new permissions
-        $this->permissions_denied = $this->permissions_denied + $permissions;
-        // List each permission exactly once
-        $this->permissions_denied = array_unique($this->permissions_denied);
-        // Remove denied permissions from the granted list
-        $this->permissions_granted = array_diff($this->permissions_granted, $this->permissions_denied);
+        $this->grant( $permissions, 'deny' );
     }
 
@@ -247 +236 @@
         $permissions = Utils::single_array( $permissions );
         // Remove permissions from the granted list
-        $this->permissions_granted = array_diff($this->permissions_granted, $permissions);
-        // Remove permissions from the denied list
-        $this->permissions_denied = array_diff($this->permissions_denied, $permissions);
+        $this->permissions = array_diff_key( $this->permissions, $permissions );
+        foreach ( $permissions as $permission ) {
+            ACL::revoke_group_permission( $this->id, $permission );
+        }
     }
 
@@ -260 +250 @@
      * @see ACL::user_can()
     **/
-    public function can( $permission )
+    public function can( $permission, $access = 'full' )
     {
         $permission= ACL::token_id( $permission );
-        if ( in_array( $permission, $this->permissions_denied ) ) {
-            return false;
-        }
-        if ( in_array( $permission, $this->permissions_granted ) ) {
+        if ( isset( $this->permissions[$permission] ) && $this->permissions[$permission] == $access ) {
             return true;
         }