Snaha o zprovoznění ACL

Ahoj,
přihlašování a autorizaci uživatelů v Nette potřebuji až nyní a rozhodl jsem se pro dynamickou správu rolí a zdrojů. A $user->isAllowed() mi zkrátka nevrací to, co bych očekával.

Pro jistotu jsem postnu kód, do kterého jsem mírně sahal:

<?php

class Acl extends Permission
{

    const ACL_TABLE = 'users_acl';
    const PRIVILEGES_TABLE = 'users_privileges';
    const RESOURCES_TABLE = 'users_resources';
    const ROLES_TABLE = 'users_roles';

    /**
     * Access Control List constructor
     */
    public function __construct()
    {
        $this->init();
    }

    /**
     * Builds ACL rules list from database
     */
    private function init()
    {
        $roles = dibi::fetchAll('
            SELECT r.name AS role_name, rp.name AS parent_role
            FROM [::' . self::ROLES_TABLE . '] r LEFT JOIN [::' . self::ROLES_TABLE . '] rp ON r.parent_id = rp.id
            ORDER BY r.parent_id ASC;');

        foreach ($roles as $r) {
            if ($r['parent_role'] !== NULL) {
                $parents = $this->getRoleParents($r['parent_role']);
                $parents[] = $r['parent_role'];
            } else $parents = $r['parent_role']; // or $parents = NULL

            $this->addRole($r['role_name'], $parents);
        }

        $resources = dibi::query('SELECT name AS resource FROM [::' . self::RESOURCES_TABLE . '] ORDER BY id ASC;');
        $resources = $resources->fetchAll();

        foreach ($resources as $r) $this->addResource($r['resource']);

        $rules = dibi::fetchAll('
            (SELECT  ro.name AS role,
                     pr.name AS privilege,
                     re.name AS resource,
                     a.allowed AS allowed
             FROM [::' . self::ACL_TABLE . '] a
                 JOIN [::' . self::ROLES_TABLE . '] ro ON a.role_id = ro.id
                 JOIN [::' . self::PRIVILEGES_TABLE . '] pr ON a.privilege_id = pr.id
                 JOIN [::' . self::RESOURCES_TABLE . '] re ON a.resource_id = re.id
             ORDER BY ro.id ASC)
            UNION
            (SELECT  ro.name AS role,
                     NULL AS privilege,
                     NULL AS resource,
                     a.allowed AS allowed
             FROM [::' . self::ACL_TABLE . '] a
                 JOIN [::' . self::ROLES_TABLE . '] ro ON a.role_id = ro.id
             WHERE
                 a.privilege_id IS NULL
                 AND
                 a.resource_id IS NULL
             ORDER BY ro.id ASC);'
        );

        foreach ($rules as $r) {
            // NOTE: allowed column can be nullable, because NULL means 'all'
            if ($r['allowed'] == '1') $this->allow($r['role'], $r['resource'], $r['privilege']);
            elseif ($r['allowed'] == '0') $this->deny($r['role'], $r['resource'], $r['privilege']);
            // administrator has allowed all [::' . self::PRIVILEGES_TABLE . '] to all [::' . self::RESOURCES_TABLE . ']
            elseif ($r['privilege'] === NULL && $r['resource'] === NULL) $this->allow($r['role']);
        }
    }
}

Config.ini:

service.Nette-Security-IAuthorizator = Acl
service.Nette-Security-IAuthenticator = Authenticator

<?php

class Authenticator extends Object implements IAuthenticator
{
    const USERS_TABLE = 'users';

    public function authenticate(array $credentials)
    {
        $username = $credentials[self::USERNAME];
        $password = MyTools::passwordEncode($credentials[self::PASSWORD], $credentials[self::USERNAME]);

        $row = dibi::fetch('SELECT u.name, u.password, r.name AS role
                            FROM [::' . self::USERS_TABLE . '] u
                            JOIN [::' . Acl::ROLES_TABLE . '] r ON (u.role_id = r.id)
                            WHERE u.login=%s', $username, ' AND u.is_deleted=0
                            ORDER BY u.id DESC LIMIT 0,1');

        //user not found
        if ($row == null) throw new AuthenticationException('User ' . $username . ' not found.', self::IDENTITY_NOT_FOUND);

        //passwords don't match
        if ($row->password !== $password) throw new AuthenticationException('Invalid password.', self::INVALID_CREDENTIAL);

        return new Identity($row->name, $row->role);
    }

}

V databázových tabulkách mám tato data:

CREATE TABLE `users` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `role_id` bigint(20) NOT NULL,
  `name` tinytext COLLATE utf8_czech_ci NOT NULL,
  `email` tinytext COLLATE utf8_czech_ci NOT NULL,
  `login` tinytext COLLATE utf8_czech_ci NOT NULL,
  `password` tinytext COLLATE utf8_czech_ci NOT NULL,
  `is_deleted` tinyint(1) NOT NULL DEFAULT '0',
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

INSERT INTO `users` VALUES ('1', '2', 'Ondřej Mirtes', 'ondrej@mirtes.cz', 'lasthunter', '***', '0');

CREATE TABLE `users_acl` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `role_id` bigint(20) NOT NULL,
  `privilege_id` bigint(20) DEFAULT NULL,
  `resource_id` bigint(20) DEFAULT NULL,
  `allowed` tinyint(1) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

INSERT INTO `users_acl` VALUES ('1', '1', '1', NULL, '1');

CREATE TABLE `users_privileges` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `name` tinytext COLLATE utf8_czech_ci NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

INSERT INTO `users_privileges` VALUES ('1', 'default');

CREATE TABLE `users_resources` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `name` tinytext COLLATE utf8_czech_ci NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

INSERT INTO `users_resources` VALUES ('1', 'Default');

CREATE TABLE `users_roles` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `parent_id` bigint(20) DEFAULT NULL,
  `name` tinytext COLLATE utf8_czech_ci NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=3 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

INSERT INTO `users_roles` VALUES ('1', NULL, 'guest'), ('2', '1', 'registered');

A v BasePresenteru v rámci testování mám ve startupu tento kód:

$user = Environment::getUser();
$user->authenticate('lasthunter','***');
$user->signOut();
Debug::dump($user->isAllowed('Default'));

I když signOut zakomentuji a i když ne (user má pak střídavě roli guest a registered), tak mi dump vyhazuje stále false.

Kde mám chybu? :) Je toho hodně k analyzování, tak se s ním snad někdo poperete :) Díky moc.

Editoval LastHunter (23. 6. 2009 14:03)