Skip to content

Commit 1a6973f

Browse files
rjmackayrjmackay
committed
Refactor ACL
- Replace PermissionAccess trait with AclTrait. This *only* handles injecting the ACL - Move enabling/disabling custom roles into Acl implementation - Add default roles+permissions into Acl
1 parent 65b9cdf commit 1a6973f

File tree

17 files changed

+111
-96
lines changed

17 files changed

+111
-96
lines changed

‎application/classes/Ushahidi/Repository/Form/Stage.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@
1818
use Ushahidi\Core\Traits\UserContext;
1919

2020
use Ushahidi\Core\Traits\AdminAccess;
21-
use Ushahidi\Core\Traits\PermissionAccess;
21+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2222

2323
class Ushahidi_Repository_Form_Stage extends Ushahidi_Repository implements
2424
FormStageRepository
2525
{
2626
use UserContext;
2727

28-
// Provides `hasPermission`
29-
use PermissionAccess;
28+
// Provides `acl`
29+
use AclTrait;
3030

3131
use PostValueRestrictions;
3232

‎application/classes/Ushahidi/Repository/Post.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
use Ushahidi\Core\Usecase\Set\SetPostRepository;
2626
use Ushahidi\Core\Traits\UserContext;
2727
use Ushahidi\Core\Traits\Permissions\ManagePosts;
28-
use Ushahidi\Core\Traits\PermissionAccess;
28+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2929
use Ushahidi\Core\Traits\AdminAccess;
3030
use Ushahidi\Core\Tool\Permissions\Permissionable;
3131
use Ushahidi\Core\Traits\PostValueRestrictions;
@@ -48,8 +48,8 @@ class Ushahidi_Repository_Post extends Ushahidi_Repository implements
4848
// Use the JSON transcoder to encode properties
4949
use Ushahidi_JsonTranscodeRepository;
5050

51-
// Provides `hasPermission`
52-
use PermissionAccess;
51+
// Provides `acl`
52+
use AclTrait;
5353

5454
// Checks if user is Admin
5555
use AdminAccess;
@@ -492,7 +492,7 @@ protected function setSearchConditions(SearchData $search)
492492
if (!$user->id) {
493493
$query->where("$table.status", '=', 'published');
494494
} elseif (!$this->isUserAdmin($user) and
495-
!$this->hasPermission($user, Permission::MANAGE_POSTS)) {
495+
!$this->acl->hasPermission($user, Permission::MANAGE_POSTS)) {
496496
$query
497497
->and_where_open()
498498
->where("$table.status", '=', 'published')

‎application/classes/Ushahidi/Validator/Post/Create.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
use Ushahidi\Core\Entity\PostSearchData;
2121
use Ushahidi\Core\Tool\Validator;
2222
use Ushahidi\Core\Traits\UserContext;
23-
use Ushahidi\Core\Traits\PermissionAccess;
23+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2424
use Ushahidi\Core\Traits\AdminAccess;
2525
use Ushahidi\Core\Traits\Permissions\ManagePosts;
2626
use Ushahidi\Core\Usecase\Post\UpdatePostRepository;
@@ -30,8 +30,8 @@ class Ushahidi_Validator_Post_Create extends Validator
3030
{
3131
use UserContext;
3232

33-
// Provides `hasPermission`
34-
use PermissionAccess;
33+
// Provides `acl`
34+
use AclTrait;
3535

3636
// Checks if user is Admin
3737
use AdminAccess;
@@ -189,7 +189,7 @@ public function checkApprovalRequired (Validation $validation, $status, $fullDat
189189

190190
$user = $this->getUser();
191191
// Do we have permission to publish this post?
192-
$userCanChangeStatus = ($this->isUserAdmin($user) or $this->hasPermission($user, Permission::MANAGE_POSTS));
192+
$userCanChangeStatus = ($this->isUserAdmin($user) or $this->acl->hasPermission($user, Permission::MANAGE_POSTS));
193193
// .. if yes, any status is ok.
194194
if ($userCanChangeStatus) {
195195
return;

‎src/App/Acl.php

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,73 @@
1313

1414
use Ushahidi\Core\Tool\Permissions\Acl as AclInterface;
1515
use Ushahidi\Core\Entity\User;
16+
use Ushahidi\Core\Entity\Permission;
1617
use Ushahidi\Core\Entity\RoleRepository;
1718

1819
class Acl implements AclInterface
1920
{
2021
protected $role_repo;
22+
protected $roles_enabled = false;
23+
const DEFAULT_ROLES = [
24+
'user' => [Permission::EDIT_OWN_POSTS]
25+
];
2126

2227
public function setRoleRepo(RoleRepository $role_repo)
2328
{
2429
$this->role_repo = $role_repo;
2530
}
2631

32+
public function setRolesEnabled($roles_enabled)
33+
{
34+
$this->roles_enabled = $roles_enabled;
35+
}
36+
37+
/**
38+
* Check if custom roles are enabled for this deployment
39+
* @return boolean
40+
*/
41+
protected function hasRolesEnabled()
42+
{
43+
return (bool) $this->roles_enabled;
44+
}
45+
2746
// Acl interface
2847
public function hasPermission(User $user, $permission)
2948
{
49+
// If the user has no role, they have no permissions
3050
if (!$user->role) {
3151
return false;
3252
}
3353

54+
// Don't check for permissions if we don't have the
55+
// roles feature enabled
56+
if ($this->hasRolesEnabled()) {
57+
return $this->customRoleHasPermission($user, $permission);
58+
} else {
59+
return $this->defaultHasPermission($user, $permission);
60+
}
61+
}
62+
63+
protected function customRoleHasPermission(User $user, $permission)
64+
{
3465
$role = $this->role_repo->getByName($user->role);
3566

3667
// Does the user have the permission?
3768
return in_array($permission, $role->permissions);
3869
}
70+
71+
protected function defaultHasPermission(User $user, $permission)
72+
{
73+
// Admin has all permissions
74+
// This is probably never actually run, but here just in case
75+
if ($user->role === 'admin') {
76+
return true;
77+
}
78+
79+
$defaultRoles = static::DEFAULT_ROLES;
80+
$rolePermissions = isset($defaultRoles[$user->role]) ? $defaultRoles[$user->role] : [];
81+
82+
// Does the user have the permission?
83+
return in_array($permission, $rolePermissions);
84+
}
3985
}

‎src/App/Init.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
// Helpers, tools, etc
1111
$di->set('tool.acl', $di->lazyNew('Ushahidi\App\Acl'));
1212
$di->setter['Ushahidi\App\Acl']['setRoleRepo'] = $di->lazyGet('repository.role');
13+
$di->setter['Ushahidi\App\Acl']['setRolesEnabled'] = $di->lazyGet('roles.enabled');
1314

1415
$di->set('tool.hasher.password', $di->lazyNew('Ushahidi\App\Hasher\Password'));
1516
$di->set('tool.authenticator.password', $di->lazyNew('Ushahidi\App\Authenticator\Password'));

‎src/Core/Tool/Authorizer/CSVAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
use Ushahidi\Core\Traits\AdminAccess;
1919
use Ushahidi\Core\Traits\UserContext;
2020
use Ushahidi\Core\Traits\PrivAccess;
21-
use Ushahidi\Core\Traits\PermissionAccess;
21+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2222
use Ushahidi\Core\Traits\DataImportAccess;
2323

2424
class CSVAuthorizer implements Authorizer
@@ -33,7 +33,7 @@ class CSVAuthorizer implements Authorizer
3333

3434
// Check that the user has the necessary permissions
3535
// if roles are available for this deployment.
36-
use PermissionAccess;
36+
use AclTrait;
3737

3838
// Check if the user can import data
3939
use DataImportAccess;
@@ -50,7 +50,7 @@ public function isAllowed(Entity $entity, $privilege)
5050
$user = $this->getUser();
5151

5252
// Allow role with the right permissions
53-
if ($this->hasPermission($user, Permission::DATA_IMPORT)) {
53+
if ($this->acl->hasPermission($user, Permission::DATA_IMPORT)) {
5454
return true;
5555
}
5656

‎src/Core/Tool/Authorizer/ConfigAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
use Ushahidi\Core\Traits\AdminAccess;
2121
use Ushahidi\Core\Traits\UserContext;
2222
use Ushahidi\Core\Traits\PrivAccess;
23-
use Ushahidi\Core\Traits\PermissionAccess;
23+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2424

2525
// The `ConfigAuthorizer` class is responsible for access checks on `Config` Entities
2626
class ConfigAuthorizer implements Authorizer
@@ -36,7 +36,7 @@ class ConfigAuthorizer implements Authorizer
3636

3737
// Check that the user has the necessary permissions
3838
// if roles are available for this deployment.
39-
use PermissionAccess;
39+
use AclTrait;
4040

4141
/**
4242
* Public config groups
@@ -62,7 +62,7 @@ public function isAllowed(Entity $entity, $privilege)
6262
}
6363

6464
// Allow role with the right permissions to do everything else
65-
if ($this->hasPermission($user, Permission::MANAGE_SETTINGS)) {
65+
if ($this->acl->hasPermission($user, Permission::MANAGE_SETTINGS)) {
6666
return true;
6767
}
6868

‎src/Core/Tool/Authorizer/DataProviderAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
use Ushahidi\Core\Traits\UserContext;
1818
use Ushahidi\Core\Traits\AdminAccess;
1919
use Ushahidi\Core\Traits\PrivAccess;
20-
use Ushahidi\Core\Traits\PermissionAccess;
20+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2121

2222
// The `DataProviderAuthorizer` class is responsible for access checks on `DataProvider` Entities
2323
class DataProviderAuthorizer implements Authorizer
@@ -33,7 +33,7 @@ class DataProviderAuthorizer implements Authorizer
3333

3434
// Check that the user has the necessary permissions
3535
// if roles are available for this deployment.
36-
use PermissionAccess;
36+
use AclTrait;
3737

3838
// Authorizer
3939
public function isAllowed(Entity $entity, $privilege)
@@ -42,7 +42,7 @@ public function isAllowed(Entity $entity, $privilege)
4242
$user = $this->getUser();
4343

4444
// Allow role with the right permissions
45-
if ($this->hasPermission($user, Permission::MANAGE_SETTINGS)) {
45+
if ($this->acl->hasPermission($user, Permission::MANAGE_SETTINGS)) {
4646
return true;
4747
}
4848

‎src/Core/Tool/Authorizer/FormAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
use Ushahidi\Core\Traits\ParentAccess;
2222
use Ushahidi\Core\Traits\PrivAccess;
2323
use Ushahidi\Core\Traits\PrivateDeployment;
24-
use Ushahidi\Core\Traits\PermissionAccess;
24+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2525

2626
// The `FormAuthorizer` class is responsible for access checks on `Forms`
2727
class FormAuthorizer implements Authorizer
@@ -41,7 +41,7 @@ class FormAuthorizer implements Authorizer
4141
use PrivateDeployment;
4242

4343
// Check that the user has the necessary permissions
44-
use PermissionAccess;
44+
use AclTrait;
4545

4646
// It requires a `FormRepository` to load parent posts too.
4747
protected $form_repo;
@@ -66,7 +66,7 @@ public function isAllowed(Entity $entity, $privilege)
6666
}
6767

6868
// Allow role with the right permissions
69-
if ($this->hasPermission($user, Permission::MANAGE_SETTINGS)) {
69+
if ($this->acl->hasPermission($user, Permission::MANAGE_SETTINGS)) {
7070
return true;
7171
}
7272

‎src/Core/Tool/Authorizer/PostAuthorizer.php

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
use Ushahidi\Core\Traits\PrivAccess;
2626
use Ushahidi\Core\Traits\UserContext;
2727
use Ushahidi\Core\Traits\PrivateDeployment;
28-
use Ushahidi\Core\Traits\PermissionAccess;
28+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2929

3030
// The `PostAuthorizer` class is responsible for access checks on `Post` Entities
3131
class PostAuthorizer implements Authorizer
@@ -47,7 +47,7 @@ class PostAuthorizer implements Authorizer
4747

4848
// Check that the user has the necessary permissions
4949
// if roles are available for this deployment.
50-
use PermissionAccess;
50+
use AclTrait;
5151

5252
/**
5353
* Get a list of all possible privilges.
@@ -87,7 +87,7 @@ public function isAllowed(Entity $entity, $privilege)
8787
}
8888

8989
// First check whether there is a role with the right permissions
90-
if ($this->hasPermission($user, Permission::MANAGE_POSTS)) {
90+
if ($this->acl->hasPermission($user, Permission::MANAGE_POSTS)) {
9191
return true;
9292
}
9393

@@ -150,7 +150,7 @@ public function isAllowed(Entity $entity, $privilege)
150150
// ownership but those are already checked above
151151
if ($this->isUserOwner($entity, $user)
152152
&& in_array($privilege, ['update', 'delete'])
153-
&& $this->hasPermission($user, Permission::EDIT_OWN_POSTS)) {
153+
&& $this->acl->hasPermission($user, Permission::EDIT_OWN_POSTS)) {
154154
return true;
155155
}
156156

‎src/Core/Tool/Authorizer/SetAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
use Ushahidi\Core\Traits\UserContext;
2222
use Ushahidi\Core\Traits\PrivAccess;
2323
use Ushahidi\Core\Traits\PrivateDeployment;
24-
use Ushahidi\Core\Traits\PermissionAccess;
24+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2525

2626
// The `SetAuthorizer` class is responsible for access checks on `Sets`
2727
class SetAuthorizer implements Authorizer
@@ -42,7 +42,7 @@ class SetAuthorizer implements Authorizer
4242

4343
// Check that the user has the necessary permissions
4444
// if roles are available for this deployment.
45-
use PermissionAccess;
45+
use AclTrait;
4646

4747
protected function isVisibleToUser(Set $entity, $user)
4848
{
@@ -66,7 +66,7 @@ public function isAllowed(Entity $entity, $privilege)
6666
}
6767

6868
// First check whether there is a role with the right permissions
69-
if ($this->hasPermission($user, Permission::MANAGE_POSTS)) {
69+
if ($this->acl->hasPermission($user, Permission::MANAGE_POSTS)) {
7070
return true;
7171
}
7272

‎src/Core/Tool/Authorizer/TagAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
use Ushahidi\Core\Traits\UserContext;
2121
use Ushahidi\Core\Traits\PrivAccess;
2222
use Ushahidi\Core\Traits\PrivateDeployment;
23-
use Ushahidi\Core\Traits\PermissionAccess;
23+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2424

2525
// The `TagAuthorizer` class is responsible for access checks on `Tags`
2626
class TagAuthorizer implements Authorizer
@@ -39,7 +39,7 @@ class TagAuthorizer implements Authorizer
3939

4040
// Check that the user has the necessary permissions
4141
// if roles are available for this deployment.
42-
use PermissionAccess;
42+
use AclTrait;
4343

4444
protected function isUserOfRole(Tag $entity, $user)
4545
{
@@ -63,7 +63,7 @@ public function isAllowed(Entity $entity, $privilege)
6363
}
6464

6565
// First check whether there is a role with the right permissions
66-
if ($this->hasPermission($user, Permission::MANAGE_SETTINGS)) {
66+
if ($this->acl->hasPermission($user, Permission::MANAGE_SETTINGS)) {
6767
return true;
6868
}
6969

‎src/Core/Tool/Authorizer/UserAuthorizer.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
use Ushahidi\Core\Traits\UserContext;
2020
use Ushahidi\Core\Traits\PrivAccess;
2121
use Ushahidi\Core\Traits\PrivateDeployment;
22-
use Ushahidi\Core\Traits\PermissionAccess;
22+
use Ushahidi\Core\Tool\Permissions\AclTrait;
2323

2424
// The `UserAuthorizer` class is responsible for access checks on `Users`
2525
class UserAuthorizer implements Authorizer
@@ -37,7 +37,7 @@ class UserAuthorizer implements Authorizer
3737
use PrivateDeployment;
3838

3939
// Check that the user has the necessary permissions
40-
use PermissionAccess;
40+
use AclTrait;
4141

4242
/**
4343
* Get a list of all possible privilges.
@@ -66,7 +66,7 @@ public function isAllowed(Entity $entity, $privilege)
6666
}
6767

6868
// Role with the Manage Users permission can manage all users
69-
if ($this->hasPermission($user, Permission::MANAGE_USERS)) {
69+
if ($this->acl->hasPermission($user, Permission::MANAGE_USERS)) {
7070
return true;
7171
}
7272

0 commit comments

Comments
 (0)