php - Creating Dynamic Acl in Zend - Framework (check list for acl)
I am trying to build a group based acl in the zend framework. Basically there will be three roles: admin, guest and user. And there will be different groups for the user role. How it will work is I have a check list of modules/controllers and action using the check list admin will be allowed to create group. Group could be something like editor (role will be user for editor aswell ). This group will be saved in database in a table group (group_id, group_name) and the resources selected will be saved in a table resource (resource_id, resource, group_id). resource will be saved in a format somewhat like module:controller:action (eg : user:user:login)
What I want to know is, Is what I am trying to do is the correct way or not if it has overhead or any suggestion you could post.
class App_AccessCheck extends Zend_Controller_Plugin_Abstract{
public function preDispatch(Zend_Controller_Request_Abstract $request)
{
if(!$this->_acl->isAllowed(Zend_Registry::get('role'),"Controller","Action")){
$request->setModuleName('user')
->setControllerName('user')
->setActionName('login');
}
}
class App_Acl extends Zend_Acl
{
public function __construct()
{
$this->addRole(new Zend_Acl_Role('guest'));
$this->addRole(new Zend_Acl_Role('user'));
$this->addRole(new Zend_Acl_Role('admin'));
$this->add(new Zend_Acl_Resource('Controller'))
->add(new Zend_Acl_Resource('Controller'), 'Action');
$resource = new App_Resource();
$params = $resource->getResource();
$this->allow('user', 'Controller', 'Action', new App_ActionAssertion($params));
}
public function isAllowed($role = null, $resource = null, $privilege = null)
{
// by default, undefined resources are allowed to all
if (!$this->has($resource)) {
$resource = 'nullresources';
}
return parent::isAllowed($role, $resource, $privilege);
}
}
class App_Resource extends Zend_Controller_Request_Abstract{
protected $params;
public function preDispatch(Zend_Controller_Request_Abstract $request)
{
$module = $request->getModuleName();
$controller = $request->getControllerName();
$action = $request->getActionName();
$params = $module.":".$controller":".$action;
$this->setParams($params);
}
public function getParams()
{
return $params;
// String representing current module:controller:action
}
}
class App_ActionAssertion implements Zend_Acl_Assert_Interface
{
//this class will check the access of the group to the particular resource in the database table: resource based on the params passed
//admin will be allowed all privilege
//return true/false
}