Context Navigation

source: Dev/branches/cakephp/cake/console/libs/acl.php @ 126

Last change on this file since 126 was 126, checked in by fpvanagthoven, 14 years ago
Cakephp branch.
File size: 18.2 KB

Line
1	<?php
2	/**
3	* Acl Shell provides Acl access in the CLI environment
4	*
5	* PHP versions 4 and 5
6	*
7	* CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
8	* Copyright 2005-2011, Cake Software Foundation, Inc. (http://cakefoundation.org)
9	*
10	* Licensed under The MIT License
11	* Redistributions of files must retain the above copyright notice.
12	*
13	* @copyright Copyright 2005-2011, Cake Software Foundation, Inc. (http://cakefoundation.org)
14	* @link http://cakephp.org CakePHP(tm) Project
15	* @package cake
16	* @subpackage cake.cake.console.libs
17	* @since CakePHP(tm) v 1.2.0.5012
18	* @license MIT License (http://www.opensource.org/licenses/mit-license.php)
19	*/
20	App::import('Component', 'Acl');
21	App::import('Model', 'DbAcl');
22
23	/**
24	* Shell for ACL management. This console is known to have issues with zend.ze1_compatibility_mode
25	* being enabled. Be sure to turn it off when using this shell.
26	*
27	* @package cake
28	* @subpackage cake.cake.console.libs
29	*/
30	class AclShell extends Shell {
31
32	/**
33	* Contains instance of AclComponent
34	*
35	* @var AclComponent
36	* @access public
37	*/
38	var $Acl;
39
40	/**
41	* Contains arguments parsed from the command line.
42	*
43	* @var array
44	* @access public
45	*/
46	var $args;
47
48	/**
49	* Contains database source to use
50	*
51	* @var string
52	* @access public
53	*/
54	var $connection = 'default';
55
56	/**
57	* Contains tasks to load and instantiate
58	*
59	* @var array
60	* @access public
61	*/
62	var $tasks = array('DbConfig');
63
64	/**
65	* Override startup of the Shell
66	*
67	* @access public
68	*/
69	function startup() {
70	if (isset($this->params['connection'])) {
71	$this->connection = $this->params['connection'];
72	}
73
74	if (!in_array(Configure::read('Acl.classname'), array('DbAcl', 'DB_ACL'))) {
75	$out = "--------------------------------------------------\n";
76	$out .= __("Error: Your current Cake configuration is set to", true) . "\n";
77	$out .= __("an ACL implementation other than DB. Please change", true) . "\n";
78	$out .= __("your core config to reflect your decision to use", true) . "\n";
79	$out .= __("DbAcl before attempting to use this script", true) . ".\n";
80	$out .= "--------------------------------------------------\n";
81	$out .= sprintf(__("Current ACL Classname: %s", true), Configure::read('Acl.classname')) . "\n";
82	$out .= "--------------------------------------------------\n";
83	$this->err($out);
84	$this->_stop();
85	}
86
87	if ($this->command && !in_array($this->command, array('help'))) {
88	if (!config('database')) {
89	$this->out(__("Your database configuration was not found. Take a moment to create one.", true), true);
90	$this->args = null;
91	return $this->DbConfig->execute();
92	}
93	require_once (CONFIGS.'database.php');
94
95	if (!in_array($this->command, array('initdb'))) {
96	$this->Acl =& new AclComponent();
97	$controller = null;
98	$this->Acl->startup($controller);
99	}
100	}
101	}
102
103	/**
104	* Override main() for help message hook
105	*
106	* @access public
107	*/
108	function main() {
109	$out = __("Available ACL commands:", true) . "\n";
110	$out .= "\t - create\n";
111	$out .= "\t - delete\n";
112	$out .= "\t - setParent\n";
113	$out .= "\t - getPath\n";
114	$out .= "\t - check\n";
115	$out .= "\t - grant\n";
116	$out .= "\t - deny\n";
117	$out .= "\t - inherit\n";
118	$out .= "\t - view\n";
119	$out .= "\t - initdb\n";
120	$out .= "\t - help\n\n";
121	$out .= __("For help, run the 'help' command. For help on a specific command, run 'help <command>'", true);
122	$this->out($out);
123	}
124
125	/**
126	* Creates an ARO/ACO node
127	*
128	* @access public
129	*/
130	function create() {
131	$this->_checkArgs(3, 'create');
132	$this->checkNodeType();
133	extract($this->__dataVars());
134
135	$class = ucfirst($this->args[0]);
136	$parent = $this->parseIdentifier($this->args[1]);
137
138	if (!empty($parent) && $parent != '/' && $parent != 'root') {
139	$parent = $this->_getNodeId($class, $parent);
140	} else {
141	$parent = null;
142	}
143
144	$data = $this->parseIdentifier($this->args[2]);
145	if (is_string($data) && $data != '/') {
146	$data = array('alias' => $data);
147	} elseif (is_string($data)) {
148	$this->error(__('/ can not be used as an alias!', true), __("\t/ is the root, please supply a sub alias", true));
149	}
150
151	$data['parent_id'] = $parent;
152	$this->Acl->{$class}->create();
153	if ($this->Acl->{$class}->save($data)) {
154	$this->out(sprintf(__("New %s '%s' created.\n", true), $class, $this->args[2]), true);
155	} else {
156	$this->err(sprintf(__("There was a problem creating a new %s '%s'.", true), $class, $this->args[2]));
157	}
158	}
159
160	/**
161	* Delete an ARO/ACO node.
162	*
163	* @access public
164	*/
165	function delete() {
166	$this->_checkArgs(2, 'delete');
167	$this->checkNodeType();
168	extract($this->__dataVars());
169
170	$identifier = $this->parseIdentifier($this->args[1]);
171	$nodeId = $this->_getNodeId($class, $identifier);
172
173	if (!$this->Acl->{$class}->delete($nodeId)) {
174	$this->error(__("Node Not Deleted", true), sprintf(__("There was an error deleting the %s. Check that the node exists", true), $class) . ".\n");
175	}
176	$this->out(sprintf(__("%s deleted", true), $class) . ".\n", true);
177	}
178
179	/**
180	* Set parent for an ARO/ACO node.
181	*
182	* @access public
183	*/
184	function setParent() {
185	$this->_checkArgs(3, 'setParent');
186	$this->checkNodeType();
187	extract($this->__dataVars());
188	$target = $this->parseIdentifier($this->args[1]);
189	$parent = $this->parseIdentifier($this->args[2]);
190
191	$data = array(
192	$class => array(
193	'id' => $this->_getNodeId($class, $target),
194	'parent_id' => $this->_getNodeId($class, $parent)
195	)
196	);
197	$this->Acl->{$class}->create();
198	if (!$this->Acl->{$class}->save($data)) {
199	$this->out(__("Error in setting new parent. Please make sure the parent node exists, and is not a descendant of the node specified.", true), true);
200	} else {
201	$this->out(sprintf(__("Node parent set to %s", true), $this->args[2]) . "\n", true);
202	}
203	}
204
205	/**
206	* Get path to specified ARO/ACO node.
207	*
208	* @access public
209	*/
210	function getPath() {
211	$this->_checkArgs(2, 'getPath');
212	$this->checkNodeType();
213	extract($this->__dataVars());
214	$identifier = $this->parseIdentifier($this->args[1]);
215
216	$id = $this->_getNodeId($class, $identifier);
217	$nodes = $this->Acl->{$class}->getPath($id);
218
219	if (empty($nodes)) {
220	$this->error(
221	sprintf(__("Supplied Node '%s' not found", true), $this->args[1]),
222	__("No tree returned.", true)
223	);
224	}
225	$this->out(__('Path:', true));
226	$this->hr();
227	for ($i = 0; $i < count($nodes); $i++) {
228	$this->_outputNode($class, $nodes[$i], $i);
229	}
230	}
231
232	/**
233	* Outputs a single node, Either using the alias or Model.key
234	*
235	* @param string $class Class name that is being used.
236	* @param array $node Array of node information.
237	* @param integer $indent indent level.
238	* @return void
239	* @access protected
240	*/
241	function _outputNode($class, $node, $indent) {
242	$indent = str_repeat(' ', $indent);
243	$data = $node[$class];
244	if ($data['alias']) {
245	$this->out($indent . "[" . $data['id'] . "] " . $data['alias']);
246	} else {
247	$this->out($indent . "[" . $data['id'] . "] " . $data['model'] . '.' . $data['foreign_key']);
248	}
249	}
250
251	/**
252	* Check permission for a given ARO to a given ACO.
253	*
254	* @access public
255	*/
256	function check() {
257	$this->_checkArgs(3, 'check');
258	extract($this->__getParams());
259
260	if ($this->Acl->check($aro, $aco, $action)) {
261	$this->out(sprintf(__("%s is allowed.", true), $aroName), true);
262	} else {
263	$this->out(sprintf(__("%s is not allowed.", true), $aroName), true);
264	}
265	}
266
267	/**
268	* Grant permission for a given ARO to a given ACO.
269	*
270	* @access public
271	*/
272	function grant() {
273	$this->_checkArgs(3, 'grant');
274	extract($this->__getParams());
275
276	if ($this->Acl->allow($aro, $aco, $action)) {
277	$this->out(__("Permission granted.", true), true);
278	} else {
279	$this->out(__("Permission was not granted.", true), true);
280	}
281	}
282
283	/**
284	* Deny access for an ARO to an ACO.
285	*
286	* @access public
287	*/
288	function deny() {
289	$this->_checkArgs(3, 'deny');
290	extract($this->__getParams());
291
292	if ($this->Acl->deny($aro, $aco, $action)) {
293	$this->out(__("Permission denied.", true), true);
294	} else {
295	$this->out(__("Permission was not denied.", true), true);
296	}
297	}
298
299	/**
300	* Set an ARO to inhermit permission to an ACO.
301	*
302	* @access public
303	*/
304	function inherit() {
305	$this->_checkArgs(3, 'inherit');
306	extract($this->__getParams());
307
308	if ($this->Acl->inherit($aro, $aco, $action)) {
309	$this->out(__("Permission inherited.", true), true);
310	} else {
311	$this->out(__("Permission was not inherited.", true), true);
312	}
313	}
314
315	/**
316	* Show a specific ARO/ACO node.
317	*
318	* @access public
319	*/
320	function view() {
321	$this->_checkArgs(1, 'view');
322	$this->checkNodeType();
323	extract($this->__dataVars());
324
325	if (isset($this->args[1])) {
326	$identity = $this->parseIdentifier($this->args[1]);
327
328	$topNode = $this->Acl->{$class}->find('first', array(
329	'conditions' => array($class . '.id' => $this->_getNodeId($class, $identity))
330	));
331
332	$nodes = $this->Acl->{$class}->find('all', array(
333	'conditions' => array(
334	$class . '.lft >=' => $topNode[$class]['lft'],
335	$class . '.lft <=' => $topNode[$class]['rght']
336	),
337	'order' => $class . '.lft ASC'
338	));
339	} else {
340	$nodes = $this->Acl->{$class}->find('all', array('order' => $class . '.lft ASC'));
341	}
342
343	if (empty($nodes)) {
344	if (isset($this->args[1])) {
345	$this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
346	} elseif (isset($this->args[0])) {
347	$this->error(sprintf(__("%s not found", true), $this->args[0]), __("No tree returned.", true));
348	}
349	}
350	$this->out($class . " tree:");
351	$this->hr();
352
353	$stack = array();
354	$last = null;
355
356	foreach ($nodes as $n) {
357	$stack[] = $n;
358	if (!empty($last)) {
359	$end = end($stack);
360	if ($end[$class]['rght'] > $last) {
361	foreach ($stack as $k => $v) {
362	$end = end($stack);
363	if ($v[$class]['rght'] < $end[$class]['rght']) {
364	unset($stack[$k]);
365	}
366	}
367	}
368	}
369	$last = $n[$class]['rght'];
370	$count = count($stack);
371
372	$this->_outputNode($class, $n, $count);
373	}
374	$this->hr();
375	}
376
377	/**
378	* Initialize ACL database.
379	*
380	* @access public
381	*/
382	function initdb() {
383	$this->Dispatch->args = array('schema', 'create', 'DbAcl');
384	$this->Dispatch->dispatch();
385	}
386
387	/**
388	* Show help screen.
389	*
390	* @access public
391	*/
392	function help() {
393	$head = "-----------------------------------------------\n";
394	$head .= __("Usage: cake acl <command> <arg1> <arg2>...", true) . "\n";
395	$head .= "-----------------------------------------------\n";
396	$head .= __("Commands:", true) . "\n";
397
398	$commands = array(
399	'create' => "create aro\|aco <parent> <node>\n" .
400	"\t" . __("Creates a new ACL object <node> under the parent", true) . "\n" .
401	"\t" . __("specified by <parent>, an id/alias.", true) . "\n" .
402	"\t" . __("The <parent> and <node> references can be", true) . "\n" .
403	"\t" . __("in one of the following formats:", true) . "\n\n" .
404	"\t\t- " . __("<model>.<id> - The node will be bound to a", true) . "\n" .
405	"\t\t" . __("specific record of the given model.", true) . "\n\n" .
406	"\t\t- " . __("<alias> - The node will be given a string alias,", true) . "\n" .
407	"\t\t" . __(" (or path, in the case of <parent>)", true) . "\n" .
408	"\t\t " . __("i.e. 'John'. When used with <parent>,", true) . "\n" .
409	"\t\t" . __("this takes the form of an alias path,", true) . "\n" .
410	"\t\t " . __("i.e. <group>/<subgroup>/<parent>.", true) . "\n\n" .
411	"\t" . __("To add a node at the root level,", true) . "\n" .
412	"\t" . __("enter 'root' or '/' as the <parent> parameter.", true) . "\n",
413
414	'delete' => "delete aro\|aco <node>\n" .
415	"\t" . __("Deletes the ACL object with the given <node> reference", true) . "\n" .
416	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
417	"\t" . __("see help for the 'create' command.", true),
418
419	'setparent' => "setParent aro\|aco <node> <parent node>\n" .
420	"\t" . __("Moves the ACL object specified by <node> beneath", true) . "\n" .
421	"\t" . __("the parent ACL object specified by <parent>.", true) . "\n" .
422	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
423	"\t" . __("see help for the 'create' command.", true),
424
425	'getpath' => "getPath aro\|aco <node>\n" .
426	"\t" . __("Returns the path to the ACL object specified by <node>. This command", true) . "\n" .
427	"\t" . __("is useful in determining the inhertiance of permissions for a certain", true) . "\n" .
428	"\t" . __("object in the tree.", true) . "\n" .
429	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
430	"\t" . __("see help for the 'create' command.", true),
431
432	'check' => "check <node> <node> [<aco_action>] " . __("or", true) . " all\n" .
433	"\t" . __("Use this command to check ACL permissions.", true) . "\n" .
434	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
435	"\t" . __("see help for the 'create' command.", true),
436
437	'grant' => "grant <aronode> <aconode> [<aco_action>] " . __("or", true) . " all\n" .
438	"\t" . __("Use this command to grant ACL permissions. Once executed, the ARO", true) . "\n" .
439	"\t" . __("specified (and its children, if any) will have ALLOW access to the", true) . "\n" .
440	"\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
441	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
442	"\t" . __("see help for the 'create' command.", true),
443
444	'deny' => "deny <aronode> <aconode> [<aco_action>]" . __("or", true) . " all\n" .
445	"\t" . __("Use this command to deny ACL permissions. Once executed, the ARO", true) . "\n" .
446	"\t" . __("specified (and its children, if any) will have DENY access to the", true) . "\n" .
447	"\t" . __("specified ACO action (and the ACO's children, if any).", true) . "\n" .
448	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
449	"\t" . __("see help for the 'create' command.", true),
450
451	'inherit' => "inherit <aronode> <aconode> [<aco_action>]" . __("or", true) . " all\n" .
452	"\t" . __("Use this command to force a child ARO object to inherit its", true) . "\n" .
453	"\t" . __("permissions settings from its parent.", true) . "\n" .
454	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
455	"\t" . __("see help for the 'create' command.", true),
456
457	'view' => "view aro\|aco [<node>]\n" .
458	"\t" . __("The view command will return the ARO or ACO tree.", true) . "\n" .
459	"\t" . __("The optional node parameter allows you to return", true) . "\n" .
460	"\t" . __("only a portion of the requested tree.", true) . "\n" .
461	"\t" . __("For more detailed parameter usage info,", true) . "\n" .
462	"\t" . __("see help for the 'create' command.", true),
463
464	'initdb' => "initdb\n".
465	"\t" . __("Uses this command : cake schema run create DbAcl", true),
466
467	'help' => "help [<command>]\n" .
468	"\t" . __("Displays this help message, or a message on a specific command.", true)
469	);
470
471	$this->out($head);
472	if (!isset($this->args[0])) {
473	foreach ($commands as $cmd) {
474	$this->out("{$cmd}\n\n");
475	}
476	} elseif (isset($commands[strtolower($this->args[0])])) {
477	$this->out($commands[strtolower($this->args[0])] . "\n\n");
478	} else {
479	$this->out(sprintf(__("Command '%s' not found", true), $this->args[0]));
480	}
481	}
482
483	/**
484	* Check that first argument specifies a valid Node type (ARO/ACO)
485	*
486	* @access public
487	*/
488	function checkNodeType() {
489	if (!isset($this->args[0])) {
490	return false;
491	}
492	if ($this->args[0] != 'aco' && $this->args[0] != 'aro') {
493	$this->error(sprintf(__("Missing/Unknown node type: '%s'", true), $this->args[0]), __('Please specify which ACL object type you wish to create. Either "aro" or "aco"', true));
494	}
495	}
496
497	/**
498	* Checks that given node exists
499	*
500	* @param string $type Node type (ARO/ACO)
501	* @param integer $id Node id
502	* @return boolean Success
503	* @access public
504	*/
505	function nodeExists() {
506	if (!$this->checkNodeType() && !isset($this->args[1])) {
507	return false;
508	}
509	extract($this->__dataVars($this->args[0]));
510	$key = is_numeric($this->args[1]) ? $secondary_id : 'alias';
511	$conditions = array($class . '.' . $key => $this->args[1]);
512	$possibility = $this->Acl->{$class}->find('all', compact('conditions'));
513	if (empty($possibility)) {
514	$this->error(sprintf(__("%s not found", true), $this->args[1]), __("No tree returned.", true));
515	}
516	return $possibility;
517	}
518
519	/**
520	* Parse an identifier into Model.foriegnKey or an alias.
521	* Takes an identifier determines its type and returns the result as used by other methods.
522	*
523	* @param string $identifier Identifier to parse
524	* @return mixed a string for aliases, and an array for model.foreignKey
525	*/
526	function parseIdentifier($identifier) {
527	if (preg_match('/^([\w]+)\.(.*)$/', $identifier, $matches)) {
528	return array(
529	'model' => $matches[1],
530	'foreign_key' => $matches[2],
531	);
532	}
533	return $identifier;
534	}
535
536	/**
537	* Get the node for a given identifier. $identifier can either be a string alias
538	* or an array of properties to use in AcoNode::node()
539	*
540	* @param string $class Class type you want (Aro/Aco)
541	* @param mixed $identifier A mixed identifier for finding the node.
542	* @return int Integer of NodeId. Will trigger an error if nothing is found.
543	*/
544	function _getNodeId($class, $identifier) {
545	$node = $this->Acl->{$class}->node($identifier);
546	if (empty($node)) {
547	if (is_array($identifier)) {
548	$identifier = var_export($identifier, true);
549	}
550	$this->error(sprintf(__('Could not find node using reference "%s"', true), $identifier));
551	}
552	return Set::extract($node, "0.{$class}.id");
553	}
554
555	/**
556	* get params for standard Acl methods
557	*
558	* @return array aro, aco, action
559	* @access private
560	*/
561	function __getParams() {
562	$aro = is_numeric($this->args[0]) ? intval($this->args[0]) : $this->args[0];
563	$aco = is_numeric($this->args[1]) ? intval($this->args[1]) : $this->args[1];
564	$aroName = $aro;
565	$acoName = $aco;
566
567	if (is_string($aro)) {
568	$aro = $this->parseIdentifier($aro);
569	}
570	if (is_string($aco)) {
571	$aco = $this->parseIdentifier($aco);
572	}
573	$action = null;
574	if (isset($this->args[2])) {
575	$action = $this->args[2];
576	if ($action == '' \|\| $action == 'all') {
577	$action = '*';
578	}
579	}
580	return compact('aro', 'aco', 'action', 'aroName', 'acoName');
581	}
582
583	/**
584	* Build data parameters based on node type
585	*
586	* @param string $type Node type (ARO/ACO)
587	* @return array Variables
588	* @access private
589	*/
590	function __dataVars($type = null) {
591	if ($type == null) {
592	$type = $this->args[0];
593	}
594	$vars = array();
595	$class = ucwords($type);
596	$vars['secondary_id'] = (strtolower($class) == 'aro') ? 'foreign_key' : 'object_id';
597	$vars['data_name'] = $type;
598	$vars['table_name'] = $type . 's';
599	$vars['class'] = $class;
600	return $vars;
601	}
602	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: