-- ACL Tables
-- 表的結(jié)構(gòu) `aclresources`
DROP TABLE IF EXISTS `aclresources`;
CREATE TABLE IF NOT EXISTS `aclresources` (
`rsid` varchar(64) NOT NULL ,
`access` int(4) NOT NULL default 0,
`desc` varchar(240) NOT NULL default '',
`created_at` int(10) unsigned NOT NULL default 1,
`updated_at` int(10) unsigned NOT NULL default 0,
PRIMARY KEY (`rsid`)
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
-- 表的結(jié)構(gòu) `aclroles`
DROP TABLE IF EXISTS `aclroles`;
CREATE TABLE IF NOT EXISTS `aclroles` (
`id` int(10) unsigned NOT NULL auto_increment,
`rolename` varchar(32) NOT NULL ,
`desc` varchar(240) NOT NULL default '',
`created_at` int(10) unsigned NOT NULL default 1,
`updated_at` int(10) unsigned NOT NULL default 0,
PRIMARY KEY (`id`),
UNIQUE KEY `rolename` (`rolename`)
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
-- 表的結(jié)構(gòu) `ref_aclresources_aclroles`
DROP TABLE IF EXISTS `ref_aclresources_aclroles`;
CREATE TABLE IF NOT EXISTS `ref_aclresources_aclroles` (
`rsid` varchar(64) NOT NULL ,
`role_id` int(10) unsigned NOT NULL ,
PRIMARY KEY (`rsid`,`role_id`)
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
-- 表的結(jié)構(gòu) `ref_users_aclroles`
DROP TABLE IF EXISTS `ref_users_aclroles`;
CREATE TABLE IF NOT EXISTS `ref_users_aclroles` (
`user_id` int(10) unsigned NOT NULL auto_increment,
`role_id` int(10) unsigned NOT NULL ,
PRIMARY KEY (`user_id`,`role_id`)
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;
-- 表的結(jié)構(gòu) `users`
DROP TABLE IF EXISTS `users`;
CREATE TABLE `users` (
`id` int(10) unsigned NOT NULL auto_increment,
`email` varchar(128) NOT NULL,
`password` varchar(64) NOT NULL,
`nickname` varchar(32) NOT NULL default '',
`roles` varchar(240) NOT NULL default '',
`created_at` int(10) unsigned NOT NULL default 1,
`updated_at` int(10) unsigned NOT NULL default 0,
PRIMARY KEY (`id`),
UNIQUE KEY `user_email` (`email`)
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

<?php
/**
* 簡(jiǎn)單的 ACL 權(quán)限控制功能
*
* 表定義
*
* 1. 資源定義 (rsid,access,desc,created_at,updated_at)
* 2. 角色定義 (id,rolename,desc,created_at,updated_at)
* 3. 資源-角色關(guān)聯(lián) (rsid,role_id)
* 4. 用戶-角色關(guān)聯(lián) (user_id,role_id)
*
* 依賴db.php sqlobject.php
*
* @author vb2005xu.iteye.com
*/
class AclBase {
// --- ACL 訪問(wèn)授權(quán)

/**
* 不允許任何人訪問(wèn)
*/
const NOBODY = 0;

/**
* 允許任何人訪問(wèn)
*/
const EVERYONE = 1;

/**
* 允許 擁有角色的用戶訪問(wèn)
*/
const HAS_ROLE = 2;

/**
* 允許 不帶有角色的用戶訪問(wèn)
*/
const NO_ROLE = 3;
/**
* 在 資源-角色關(guān)聯(lián) 定義的 角色才能訪問(wèn)
*/
const ALLOCATE_ROLES = 4;

// 定義相關(guān)的 表名
public $tbResources = 'aclresources';
public $tbRoles = 'aclroles';
public $tbRefResourcesRoles = 'ref_aclresources_aclroles';
public $tbRefUsersRoles = 'ref_users_aclroles';

/**
* 格式化 資源的訪問(wèn)權(quán)限并返回
*
* @return int
*/
static function formatAccessValue($access){
static $arr = array(self::NOBODY,self::EVERYONE,self::HAS_ROLE,self::NO_ROLE,self::ALLOCATE_ROLES);
return in_array($access,$arr) ? $access : self::NOBODY;
}

/**
* 創(chuàng)建資源,返回資源記錄主鍵
*
* @param string $rsid
* @param int $access
* @param string $desc
*
* @return int
*/
function createResource($rsid,$access,$desc){
if (empty($rsid)) return false;

$resource = array(
'rsid' => $rsid,
'access' => self::formatAccessValue($access),
'desc' => $desc,
'created_at' => CURRENT_TIMESTAMP
);

return SingleTableCRUD::insert($this->tbResources,$resource);
}

/**
* 修改資源,返回成功狀態(tài)
*
* @param array $resource
* @return int
*/
function updateResource(array $resource){
if (!isset($resource['rsid'])) return false;

$resource['updated_at'] = CURRENT_TIMESTAMP;

return SingleTableCRUD::update($this->tbResources,$resource,'rsid');
}

/**
* 刪除資源
*
* @param string $rsid
* @return int
*/
function deleteResource($rsid){
if (empty($rsid)) return false;
return SingleTableCRUD::delete($this->tbResources,array('rsid'=>$rsid));
}

/**
* 創(chuàng)建角色,返回角色記錄主鍵
*
* @param string $rolename
* @param string $desc
*
* @return int
*/
function createRole($rolename,$desc){
if (empty($rolename)) return false;

$role = array(
'rolename' => $rolename,
'desc' => $desc,
'created_at' => CURRENT_TIMESTAMP
);

return SingleTableCRUD::insert($this->tbRoles,$role);
}

/**
* 修改角色,返回成功狀態(tài)
*
* @param array $role
* @return int
*/
function updateRole(array $role){
if (!isset($role['id'])) return false;

if (isset($role['rolename'])) unset($role['rolename']);
$role['updated_at'] = CURRENT_TIMESTAMP;

return SingleTableCRUD::update($this->tbRoles,$role,'id');
}

/**
* 刪除角色
*
* @param int $role_id
* @return int
*/
function deleteRole($role_id){
if (empty($role_id)) return false;
return SingleTableCRUD::delete($this->tbRoles,array('role_id'=>(int) $role_id));
}

/**
* 為資源指定角色,每次均先全部移除表中相關(guān)記錄再插入
*
* @param int $rsid
* @param mixed $roleIds
* @param boolean $setNull 當(dāng)角色id不存在時(shí),是否將資源從關(guān)聯(lián)表中清空
*/
function allocateRolesForResource($rsid,$roleIds,$setNull=false,$defaultAccess=-1){
if (empty($rsid)) return false;

$roleIds = normalize($roleIds,',');
if (empty($roleIds)){
if ($setNull){
SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid));

if ($defaultAccess != -1){
$defaultAccess = self::formatAccessValue($defaultAccess);
$this->updateResource(array('rsid'=>$rsid,'access'=>$defaultAccess));
}
return true;
}
return false;
}

SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid));

$roleIds = array_unique($roleIds);

foreach ($roleIds as $role_id){
SingleTableCRUD::insert($this->tbRefResourcesRoles,array('rsid'=>$rsid,'role_id'=>(int)$role_id));
}
return true;
}

function cleanRolesForResource($rsid){
if (empty($rsid)) return false;
return SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid));
}

function cleanResourcesForRole($role_id){
if (empty($role_id)) return false;
return SingleTableCRUD::delete($this->tbRefResourcesRoles,array('role_id'=>(int) $role_id));
}

/**
* 為角色分配資源,每次均先全部移除表中相關(guān)記錄再插入
*
* @param int $role_id
* @param mixed $rsids
*
* @return boolean
*/
function allocateResourcesForRole($role_id,$rsids){
if (empty($role_id)) return false;

$role_id = (int) $role_id;
$rsids = normalize($rsids,',');
if (empty($rsids)){
return false;
}

SingleTableCRUD::delete($this->tbRefResourcesRoles,array('role_id'=>$role_id));

$rsids = array_unique($rsids);

foreach ($rsids as $rsid){
SingleTableCRUD::insert($this->tbRefResourcesRoles,array('rsid'=>$rsid,'role_id'=>$role_id));
}
return true;
}

/**
* 為用戶指派角色,每次均先全部移除表中相關(guān)記錄再插入
*
* 此處在用戶很多的時(shí)候可能會(huì)有性能問(wèn)題 ... 后面再想怎么優(yōu)化
*
* @param int $user_id
* @param mixed $roleIds
*
* @return boolean
*/
function allocateRolesForUser($user_id,$roleIds){
if (empty($user_id)) return false;

$user_id = (int) $user_id;
$roleIds = normalize($roleIds,',');
if (empty($roleIds)){
return false;
}

SingleTableCRUD::delete($this->tbRefUsersRoles,array('user_id'=>$user_id));

$roleIds = array_unique($roleIds);

foreach ($roleIds as $roleId){
SingleTableCRUD::insert($this->tbRefUsersRoles,array('user_id'=>$user_id,'role_id'=>$role_id));
}
return true;
}

/**
* 清除用戶的角色信息
*
* @param int $user_id
*
* @return boolean
*/
function cleanRolesForUser($user_id){
if (empty($user_id)) return false;
return SingleTableCRUD::delete($this->tbRefUsersRoles,array('user_id'=>(int) $user_id));
}

/**
* 清除角色的用戶關(guān)聯(lián)
*
* @param int $role_id
*
* @return boolean
*/
function cleanUsersForRole($role_id){
if (empty($role_id)) return false;
return SingleTableCRUD::delete($this->tbRefUsersRoles,array('role_id'=>(int) $role_id));
}

}

/**
* 對(duì)資源進(jìn)行acl校驗(yàn)
*
* @param string $rsid 資源標(biāo)識(shí)
* @param array $user 特定用戶,不指定則校驗(yàn)當(dāng)前用戶
*
* @return boolean
*/
function aclVerity($rsid ,array $user = null){

if (empty($rsid)) return false;
if (!CoreApp::$defaultAcl) {
CoreApp::$defaultAcl = new AclFlat();
}

$rsRow = aclGetResource($rsid);

// 未定義資源的缺省訪問(wèn)策略
if (!$rsRow) return false;

CoreApp::writeLog($rsRow,'test');

$rsRow['access'] = AclBase::formatAccessValue($rsRow['access']);

// 允許任何人訪問(wèn)
if (AclBase::EVERYONE == $rsRow['access']) return true;

// 不允許任何人訪問(wèn)
if (AclBase::NOBODY == $rsRow['access']) return false;

// 獲取用戶信息
if (empty($user)) $user = isset($_SESSION['SI-SysUser']) ? $_SESSION['SI-SysUser'] : null;

// 用戶未登錄,則當(dāng)成無(wú)訪問(wèn)權(quán)限
if (empty($user)) return false;

$user['roles'] = empty($user['roles']) ? null : normalize($user['roles'],';');

$userHasRoles = !empty($user['roles']);

/**
* 允許 不帶有角色的用戶訪問(wèn)
*/
if (AclBase::NO_ROLE == $rsRow['access']) return $userHasRoles ? false : true;

/**
* 允許 帶有角色的用戶訪問(wèn)
*/
if (AclBase::HAS_ROLE == $rsRow['access']) return $userHasRoles ? true : false;

// --- 對(duì)用戶進(jìn)行 資源 <-> 角色 校驗(yàn)
if ($userHasRoles){
foreach ($user['roles'] as $role_id){
if ( aclGetRefResourcesRoles($rsid,$role_id) )
return true;
}
dump($user);
}
return false;
}

/**
* 對(duì)資源進(jìn)行acl校驗(yàn)
*
* @param string $rsid 資源標(biāo)識(shí)
* @param array $user 特定用戶,不指定則校驗(yàn)當(dāng)前用戶
*
* @return boolean
*/
function aclVerity($rsid ,array $user = null){

if (empty($rsid)) return false;
if (!CoreApp::$defaultAcl) {
CoreApp::$defaultAcl = new AclFlat();
}

$rsRow = aclGetResource($rsid);

// 未定義資源的缺省訪問(wèn)策略
if (!$rsRow) return false;

CoreApp::writeLog($rsRow,'test');

/*
* 校驗(yàn)步驟如下:
*
* 1. 先校驗(yàn) 資源本身 access 屬性
* EVERYONE => true,NOBODY => false * 其它的屬性在下面繼續(xù)校驗(yàn)
* 2. 從 session(或者 用戶session表)中獲取角色id集合
* 3. 如果 用戶擁有角色 則 HAS_ROLE => true , NO_ROLE => false;反之亦然
* 4. 如果資源 access == ALLOCATE_ROLES
* 1. 從緩存(或者 $tbRefResourcesRoles)中獲取 資源對(duì)應(yīng)的角色id集合
* 2. 將用戶擁有的角色id集合 與 資源對(duì)應(yīng)的角色id集合求交集
* 3. 存在交集 => true;否則 => false
*/

$rsRow['access'] = AclBase::formatAccessValue($rsRow['access']);

// 允許任何人訪問(wèn)
if (AclBase::EVERYONE == $rsRow['access']) return true;

// 不允許任何人訪問(wèn)
if (AclBase::NOBODY == $rsRow['access']) return false;

// 獲取用戶信息
if (empty($user)) $user = isset($_SESSION['SI-SysUser']) ? $_SESSION['SI-SysUser'] : null;

// 用戶未登錄,則當(dāng)成無(wú)訪問(wèn)權(quán)限
if (empty($user)) return false;

$user['roles'] = empty($user['roles']) ? null : normalize($user['roles'],';');

$userHasRoles = !empty($user['roles']);

/**
* 允許 不帶有角色的用戶訪問(wèn)
*/
if (AclBase::NO_ROLE == $rsRow['access']) return $userHasRoles ? false : true;

/**
* 允許 帶有角色的用戶訪問(wèn)
*/
if (AclBase::HAS_ROLE == $rsRow['access']) return $userHasRoles ? true : false;

// --- 對(duì)用戶進(jìn)行 資源 <-> 角色 校驗(yàn)
if ($userHasRoles){
foreach ($user['roles'] as $role_id){
if ( aclGetRefResourcesRoles($rsid,$role_id) )
return true;
}
dump($user);
}
return false;
}
/**
* 重新生成 角色資源訪問(wèn)控制表
*
* @param string $actTable ACL表名稱
* @param boolean $return 是否返回重新生成的列表
*
* @return mixed
*/
function aclRebuildACT($actTable ,$return = false){
if (empty($actTable)) return false;

global $globalConf;
$rst = null;
$cacheId = null;

switch($actTable){
case CoreApp::$defaultAcl->tbResources:
$cacheId = 'acl-resources';
$rst = SingleTableCRUD::findAll(CoreApp::$defaultAcl->tbResources);
// 轉(zhuǎn)成 哈希表結(jié)構(gòu)
if ($rst){
$rst = array_to_hashmap($rst,'rsid');
}
break;
case CoreApp::$defaultAcl->tbRoles:
$cacheId = 'acl-roles';
$rst = SingleTableCRUD::findAll(CoreApp::$defaultAcl->tbRoles);
// 轉(zhuǎn)成 哈希表結(jié)構(gòu)
if ($rst){
$rst = array_to_hashmap($rst,'id');
}
break;
case CoreApp::$defaultAcl->tbRefResourcesRoles:
$cacheId = 'acl-roles_has_resources';
$rst = SingleTableCRUD::findAll(CoreApp::$defaultAcl->tbRefResourcesRoles);
if ($rst){
$_ = array();
foreach ($rst as $row) {
$ref_id = "{$row['rsid']}<-|->{$row['role_id']}";
$_[$ref_id] = $row;
}
unset($rst);
$rst = $_;
}
break;
}

if ($cacheId)
writeCache($globalConf['runtime']['cacheDir'] ,$cacheId ,$rst ,true);

if ($return) return $rst;
}
/**
* 獲取 角色資源訪問(wèn)控制表 數(shù)據(jù)
*
* @param string $actTable ACL表名稱
*
* @return mixed
*/
function aclGetACT($actTable){
if (empty($actTable)) return false;

static $rst = array();

$cacheId = null;

switch($actTable){
case CoreApp::$defaultAcl->tbResources:
$cacheId = 'acl-resources';
break;
case CoreApp::$defaultAcl->tbRoles:
$cacheId = 'acl-roles';
break;
case CoreApp::$defaultAcl->tbRefResourcesRoles:
$cacheId = 'acl-roles_has_resources';
break;

}

if (!$cacheId) return null;

if (isset($rst[$cacheId])) return $rst[$cacheId];

global $globalConf;
// 900
$rst[$cacheId] = getCache($globalConf['runtime']['cacheDir'],$cacheId,0);
if ( !$rst[$cacheId] ){
$rst[$cacheId] = aclRebuildACT($actTable,true);
}

return $rst[$cacheId];
}
/**
* 獲取 資源 記錄
*
* @param string $rsid
*
* @return array
*/
function aclGetResource($rsid){
static $rst = null;
if (!$rst){
$rst = aclGetACT(CoreApp::$defaultAcl->tbResources);
if (!$rst) $rst = array();
}
return isset($rst[$rsid]) ? $rst[$rsid] : null;
}
/**
* 獲取 角色 記錄
*
* @param int $role_id
*
* @return array
*/
function aclGetRole($role_id){
static $rst = null;
if (!$rst){
$rst = aclGetACT(CoreApp::$defaultAcl->tbRoles);
if (!$rst) $rst = array();
}
return isset($rst[$role_id]) ? $rst[$role_id] : null;
}
/**
* 獲取 用戶角色關(guān)聯(lián) 記錄,此方法可以校驗(yàn)資源是否可被此角色調(diào)用
*
* @param string $rsid
* @param int $role_id
*
* @return array
*/
function aclGetRefResourcesRoles($rsid,$role_id){
static $rst = null;
if (!$rst){
$rst = aclGetACT(CoreApp::$defaultAcl->tbRefResourcesRoles);
if (!$rst) $rst = array();
}
$ref_id = "{$rsid}<-|->{$role_id}";
CoreApp::writeLog(isset($rst[$ref_id])?$rst[$ref_id]:'nodata',$ref_id);
return isset($rst[$ref_id]) ? $rst[$ref_id] : null;
}