Package | system.web.auth |
---|---|
Inheritance | class CDbAuthManager » CAuthManager » CApplicationComponent » CComponent |
Implements | IAuthManager, IApplicationComponent |
Since | 1.0 |
Source Code | framework/web/auth/CDbAuthManager.php |
Property | Type | Description | Defined By |
---|---|---|---|
assignmentTable | string | the name of the table storing authorization item assignments. | CDbAuthManager |
authItems | array | Returns the authorization items of the specific type and user. | CDbAuthManager |
behaviors | array | the behaviors that should be attached to this component. | CApplicationComponent |
connectionID | string | the ID of the CDbConnection application component. | CDbAuthManager |
db | CDbConnection | the database connection. | CDbAuthManager |
defaultRoles | array | list of role names that are assigned to all users implicitly. | CAuthManager |
isInitialized | boolean | Checks if this application component has been initialized. | CApplicationComponent |
itemChildTable | string | the name of the table storing authorization item hierarchy. | CDbAuthManager |
itemTable | string | the name of the table storing authorization items. | CDbAuthManager |
operations | array | Returns operations. | CAuthManager |
roles | array | Returns roles. | CAuthManager |
showErrors | boolean | Enable error reporting for bizRules. | CAuthManager |
tasks | array | Returns tasks. | CAuthManager |
Property | Type | Description | Defined By |
---|---|---|---|
dbConnection | CDbConnection | the DB connection instance | CDbAuthManager |
Method | Description | Defined By |
---|---|---|
__call() | Calls the named method which is not a class method. | CComponent |
__get() | Returns a property value, an event handler list or a behavior based on its name. | CComponent |
__isset() | Checks if a property value is null. | CComponent |
__set() | Sets value of a component property. | CComponent |
__unset() | Sets a component property to be null. | CComponent |
addItemChild() | Adds an item as a child of another item. | CDbAuthManager |
asa() | Returns the named behavior object. | CComponent |
assign() | Assigns an authorization item to a user. | CDbAuthManager |
attachBehavior() | Attaches a behavior to this component. | CComponent |
attachBehaviors() | Attaches a list of behaviors to the component. | CComponent |
attachEventHandler() | Attaches an event handler to an event. | CComponent |
canGetProperty() | Determines whether a property can be read. | CComponent |
canSetProperty() | Determines whether a property can be set. | CComponent |
checkAccess() | Performs access check for the specified user. | CDbAuthManager |
clearAll() | Removes all authorization data. | CDbAuthManager |
clearAuthAssignments() | Removes all authorization assignments. | CDbAuthManager |
createAuthItem() | Creates an authorization item. | CDbAuthManager |
createOperation() | Creates an operation. | CAuthManager |
createRole() | Creates a role. | CAuthManager |
createTask() | Creates a task. | CAuthManager |
detachBehavior() | Detaches a behavior from the component. | CComponent |
detachBehaviors() | Detaches all behaviors from the component. | CComponent |
detachEventHandler() | Detaches an existing event handler. | CComponent |
disableBehavior() | Disables an attached behavior. | CComponent |
disableBehaviors() | Disables all behaviors attached to this component. | CComponent |
enableBehavior() | Enables an attached behavior. | CComponent |
enableBehaviors() | Enables all behaviors attached to this component. | CComponent |
evaluateExpression() | Evaluates a PHP expression or callback under the context of this component. | CComponent |
executeBizRule() | Executes the specified business rule. | CAuthManager |
getAuthAssignment() | Returns the item assignment information. | CDbAuthManager |
getAuthAssignments() | Returns the item assignments for the specified user. | CDbAuthManager |
getAuthItem() | Returns the authorization item with the specified name. | CDbAuthManager |
getAuthItems() | Returns the authorization items of the specific type and user. | CDbAuthManager |
getEventHandlers() | Returns the list of attached event handlers for an event. | CComponent |
getIsInitialized() | Checks if this application component has been initialized. | CApplicationComponent |
getItemChildren() | Returns the children of the specified item. | CDbAuthManager |
getOperations() | Returns operations. | CAuthManager |
getRoles() | Returns roles. | CAuthManager |
getTasks() | Returns tasks. | CAuthManager |
hasEvent() | Determines whether an event is defined. | CComponent |
hasEventHandler() | Checks whether the named event has attached handlers. | CComponent |
hasItemChild() | Returns a value indicating whether a child exists within a parent. | CDbAuthManager |
hasProperty() | Determines whether a property is defined. | CComponent |
init() | Initializes the application component. | CDbAuthManager |
isAssigned() | Returns a value indicating whether the item has been assigned to the user. | CDbAuthManager |
raiseEvent() | Raises an event. | CComponent |
removeAuthItem() | Removes the specified authorization item. | CDbAuthManager |
removeItemChild() | Removes a child from its parent. | CDbAuthManager |
revoke() | Revokes an authorization assignment from a user. | CDbAuthManager |
save() | Saves the authorization data to persistent storage. | CDbAuthManager |
saveAuthAssignment() | Saves the changes to an authorization assignment. | CDbAuthManager |
saveAuthItem() | Saves an authorization item to persistent storage. | CDbAuthManager |
Method | Description | Defined By |
---|---|---|
checkAccessRecursive() | Performs access check for the specified user. | CDbAuthManager |
checkItemChildType() | Checks the item types to make sure a child can be added to a parent. | CAuthManager |
detectLoop() | Checks whether there is a loop in the authorization item hierarchy. | CDbAuthManager |
getDbConnection() | Returns the DB connection instance | CDbAuthManager |
usingSqlite() | CDbAuthManager |
the name of the table storing authorization item assignments. Defaults to 'AuthAssignment'.
Returns the authorization items of the specific type and user.
the ID of the CDbConnection application component. Defaults to 'db'. The database must have the tables as declared in "framework/web/auth/*.sql".
the database connection. By default, this is initialized automatically as the application component whose ID is indicated as connectionID.
the DB connection instance
the name of the table storing authorization item hierarchy. Defaults to 'AuthItemChild'.
the name of the table storing authorization items. Defaults to 'AuthItem'.
public boolean addItemChild(string $itemName, string $childName)
| ||
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the item is added successfully |
public function addItemChild($itemName,$childName)
{
if($itemName===$childName)
throw new CException(Yii::t('yii','Cannot add "{name}" as a child of itself.',
array('{name}'=>$itemName)));
$rows=$this->db->createCommand()
->select()
->from($this->itemTable)
->where('name=:name1 OR name=:name2', array(
':name1'=>$itemName,
':name2'=>$childName
))
->queryAll();
if(count($rows)==2)
{
if($rows[0]['name']===$itemName)
{
$parentType=$rows[0]['type'];
$childType=$rows[1]['type'];
}
else
{
$childType=$rows[0]['type'];
$parentType=$rows[1]['type'];
}
$this->checkItemChildType($parentType,$childType);
if($this->detectLoop($itemName,$childName))
throw new CException(Yii::t('yii','Cannot add "{child}" as a child of "{name}". A loop has been detected.',
array('{child}'=>$childName,'{name}'=>$itemName)));
$this->db->createCommand()
->insert($this->itemChildTable, array(
'parent'=>$itemName,
'child'=>$childName,
));
return true;
}
else
throw new CException(Yii::t('yii','Either "{parent}" or "{child}" does not exist.',array('{child}'=>$childName,'{parent}'=>$itemName)));
}
Adds an item as a child of another item.
public CAuthAssignment assign(string $itemName, mixed $userId, string $bizRule=NULL, mixed $data=NULL)
| ||
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
$bizRule | string | the business rule to be executed when checkAccess is called for this particular authorization item. |
$data | mixed | additional data associated with this assignment |
{return} | CAuthAssignment | the authorization assignment information. |
public function assign($itemName,$userId,$bizRule=null,$data=null)
{
if($this->usingSqlite() && $this->getAuthItem($itemName)===null)
throw new CException(Yii::t('yii','The item "{name}" does not exist.',array('{name}'=>$itemName)));
$this->db->createCommand()
->insert($this->assignmentTable, array(
'itemname'=>$itemName,
'userid'=>$userId,
'bizrule'=>$bizRule,
'data'=>serialize($data)
));
return new CAuthAssignment($this,$itemName,$userId,$bizRule,$data);
}
Assigns an authorization item to a user.
public boolean checkAccess(string $itemName, mixed $userId, array $params=array (
))
| ||
$itemName | string | the name of the operation that need access check |
$userId | mixed | the user ID. This should can be either an integer and a string representing the unique identifier of a user. See IWebUser::getId. |
$params | array | name-value pairs that would be passed to biz rules associated
with the tasks and roles assigned to the user.
Since version 1.1.11 a param with name 'userId' is added to this array, which holds the value of $userId . |
{return} | boolean | whether the operations can be performed by the user. |
public function checkAccess($itemName,$userId,$params=array())
{
$assignments=$this->getAuthAssignments($userId);
return $this->checkAccessRecursive($itemName,$userId,$params,$assignments);
}
Performs access check for the specified user.
protected boolean checkAccessRecursive(string $itemName, mixed $userId, array $params, array $assignments)
| ||
$itemName | string | the name of the operation that need access check |
$userId | mixed | the user ID. This should can be either an integer and a string representing the unique identifier of a user. See IWebUser::getId. |
$params | array | name-value pairs that would be passed to biz rules associated
with the tasks and roles assigned to the user.
Since version 1.1.11 a param with name 'userId' is added to this array, which holds the value of $userId . |
$assignments | array | the assignments to the specified user |
{return} | boolean | whether the operations can be performed by the user. |
protected function checkAccessRecursive($itemName,$userId,$params,$assignments)
{
if(($item=$this->getAuthItem($itemName))===null)
return false;
Yii::trace('Checking permission "'.$item->getName().'"','system.web.auth.CDbAuthManager');
if(!isset($params['userId']))
$params['userId'] = $userId;
if($this->executeBizRule($item->getBizRule(),$params,$item->getData()))
{
if(in_array($itemName,$this->defaultRoles))
return true;
if(isset($assignments[$itemName]))
{
$assignment=$assignments[$itemName];
if($this->executeBizRule($assignment->getBizRule(),$params,$assignment->getData()))
return true;
}
$parents=$this->db->createCommand()
->select('parent')
->from($this->itemChildTable)
->where('child=:name', array(':name'=>$itemName))
->queryColumn();
foreach($parents as $parent)
{
if($this->checkAccessRecursive($parent,$userId,$params,$assignments))
return true;
}
}
return false;
}
Performs access check for the specified user. This method is internally called by checkAccess.
public void clearAll()
|
public function clearAll()
{
$this->clearAuthAssignments();
$this->db->createCommand()->delete($this->itemChildTable);
$this->db->createCommand()->delete($this->itemTable);
}
Removes all authorization data.
public void clearAuthAssignments()
|
public function clearAuthAssignments()
{
$this->db->createCommand()->delete($this->assignmentTable);
}
Removes all authorization assignments.
public CAuthItem createAuthItem(string $name, integer $type, string $description='', string $bizRule=NULL, mixed $data=NULL)
| ||
$name | string | the item name. This must be a unique identifier. |
$type | integer | the item type (0: operation, 1: task, 2: role). |
$description | string | description of the item |
$bizRule | string | business rule associated with the item. This is a piece of PHP code that will be executed when checkAccess is called for the item. |
$data | mixed | additional data associated with the item. |
{return} | CAuthItem | the authorization item |
public function createAuthItem($name,$type,$description='',$bizRule=null,$data=null)
{
$this->db->createCommand()
->insert($this->itemTable, array(
'name'=>$name,
'type'=>$type,
'description'=>$description,
'bizrule'=>$bizRule,
'data'=>serialize($data)
));
return new CAuthItem($this,$name,$type,$description,$bizRule,$data);
}
Creates an authorization item. An authorization item represents an action permission (e.g. creating a post). It has three types: operation, task and role. Authorization items form a hierarchy. Higher level items inherit permissions representing by lower level items.
protected boolean detectLoop(string $itemName, string $childName)
| ||
$itemName | string | parent item name |
$childName | string | the name of the child item that is to be added to the hierarchy |
{return} | boolean | whether a loop exists |
protected function detectLoop($itemName,$childName)
{
if($childName===$itemName)
return true;
foreach($this->getItemChildren($childName) as $child)
{
if($this->detectLoop($itemName,$child->getName()))
return true;
}
return false;
}
Checks whether there is a loop in the authorization item hierarchy.
public CAuthAssignment getAuthAssignment(string $itemName, mixed $userId)
| ||
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | CAuthAssignment | the item assignment information. Null is returned if the item is not assigned to the user. |
public function getAuthAssignment($itemName,$userId)
{
$row=$this->db->createCommand()
->select()
->from($this->assignmentTable)
->where('itemname=:itemname AND userid=:userid', array(
':itemname'=>$itemName,
':userid'=>$userId))
->queryRow();
if($row!==false)
{
if(($data=@unserialize($row['data']))===false)
$data=null;
return new CAuthAssignment($this,$row['itemname'],$row['userid'],$row['bizrule'],$data);
}
else
return null;
}
Returns the item assignment information.
public array getAuthAssignments(mixed $userId)
| ||
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | array | the item assignment information for the user. An empty array will be returned if there is no item assigned to the user. |
public function getAuthAssignments($userId)
{
$rows=$this->db->createCommand()
->select()
->from($this->assignmentTable)
->where('userid=:userid', array(':userid'=>$userId))
->queryAll();
$assignments=array();
foreach($rows as $row)
{
if(($data=@unserialize($row['data']))===false)
$data=null;
$assignments[$row['itemname']]=new CAuthAssignment($this,$row['itemname'],$row['userid'],$row['bizrule'],$data);
}
return $assignments;
}
Returns the item assignments for the specified user.
public CAuthItem getAuthItem(string $name)
| ||
$name | string | the name of the item |
{return} | CAuthItem | the authorization item. Null if the item cannot be found. |
public function getAuthItem($name)
{
$row=$this->db->createCommand()
->select()
->from($this->itemTable)
->where('name=:name', array(':name'=>$name))
->queryRow();
if($row!==false)
{
if(($data=@unserialize($row['data']))===false)
$data=null;
return new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data);
}
else
return null;
}
Returns the authorization item with the specified name.
public array getAuthItems(integer $type=NULL, mixed $userId=NULL)
| ||
$type | integer | the item type (0: operation, 1: task, 2: role). Defaults to null, meaning returning all items regardless of their type. |
$userId | mixed | the user ID. Defaults to null, meaning returning all items even if they are not assigned to a user. |
{return} | array | the authorization items of the specific type. |
public function getAuthItems($type=null,$userId=null)
{
if($type===null && $userId===null)
{
$command=$this->db->createCommand()
->select()
->from($this->itemTable);
}
elseif($userId===null)
{
$command=$this->db->createCommand()
->select()
->from($this->itemTable)
->where('type=:type', array(':type'=>$type));
}
elseif($type===null)
{
$command=$this->db->createCommand()
->select('name,type,description,t1.bizrule,t1.data')
->from(array(
$this->itemTable.' t1',
$this->assignmentTable.' t2'
))
->where('name=itemname AND userid=:userid', array(':userid'=>$userId));
}
else
{
$command=$this->db->createCommand()
->select('name,type,description,t1.bizrule,t1.data')
->from(array(
$this->itemTable.' t1',
$this->assignmentTable.' t2'
))
->where('name=itemname AND type=:type AND userid=:userid', array(
':type'=>$type,
':userid'=>$userId
));
}
$items=array();
foreach($command->queryAll() as $row)
{
if(($data=@unserialize($row['data']))===false)
$data=null;
$items[$row['name']]=new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data);
}
return $items;
}
Returns the authorization items of the specific type and user.
protected CDbConnection getDbConnection()
| ||
{return} | CDbConnection | the DB connection instance |
protected function getDbConnection()
{
if($this->db!==null)
return $this->db;
elseif(($this->db=Yii::app()->getComponent($this->connectionID)) instanceof CDbConnection)
return $this->db;
else
throw new CException(Yii::t('yii','CDbAuthManager.connectionID "{id}" is invalid. Please make sure it refers to the ID of a CDbConnection application component.',
array('{id}'=>$this->connectionID)));
}
public array getItemChildren(mixed $names)
| ||
$names | mixed | the parent item name. This can be either a string or an array. The latter represents a list of item names. |
{return} | array | all child items of the parent |
public function getItemChildren($names)
{
if(is_string($names))
$condition='parent='.$this->db->quoteValue($names);
elseif(is_array($names) && $names!==array())
{
foreach($names as &$name)
$name=$this->db->quoteValue($name);
$condition='parent IN ('.implode(', ',$names).')';
}
$rows=$this->db->createCommand()
->select('name, type, description, bizrule, data')
->from(array(
$this->itemTable,
$this->itemChildTable
))
->where($condition.' AND name=child')
->queryAll();
$children=array();
foreach($rows as $row)
{
if(($data=@unserialize($row['data']))===false)
$data=null;
$children[$row['name']]=new CAuthItem($this,$row['name'],$row['type'],$row['description'],$row['bizrule'],$data);
}
return $children;
}
Returns the children of the specified item.
public boolean hasItemChild(string $itemName, string $childName)
| ||
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the child exists |
public function hasItemChild($itemName,$childName)
{
return $this->db->createCommand()
->select('parent')
->from($this->itemChildTable)
->where('parent=:parent AND child=:child', array(
':parent'=>$itemName,
':child'=>$childName))
->queryScalar() !== false;
}
Returns a value indicating whether a child exists within a parent.
public void init()
|
public function init()
{
parent::init();
$this->_usingSqlite=!strncmp($this->getDbConnection()->getDriverName(),'sqlite',6);
}
Initializes the application component. This method overrides the parent implementation by establishing the database connection.
public boolean isAssigned(string $itemName, mixed $userId)
| ||
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | boolean | whether the item has been assigned to the user. |
public function isAssigned($itemName,$userId)
{
return $this->db->createCommand()
->select('itemname')
->from($this->assignmentTable)
->where('itemname=:itemname AND userid=:userid', array(
':itemname'=>$itemName,
':userid'=>$userId))
->queryScalar() !== false;
}
Returns a value indicating whether the item has been assigned to the user.
public boolean removeAuthItem(string $name)
| ||
$name | string | the name of the item to be removed |
{return} | boolean | whether the item exists in the storage and has been removed |
public function removeAuthItem($name)
{
if($this->usingSqlite())
{
$this->db->createCommand()
->delete($this->itemChildTable, 'parent=:name1 OR child=:name2', array(
':name1'=>$name,
':name2'=>$name
));
$this->db->createCommand()
->delete($this->assignmentTable, 'itemname=:name', array(
':name'=>$name,
));
}
return $this->db->createCommand()
->delete($this->itemTable, 'name=:name', array(
':name'=>$name
)) > 0;
}
Removes the specified authorization item.
public boolean removeItemChild(string $itemName, string $childName)
| ||
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the removal is successful |
public function removeItemChild($itemName,$childName)
{
return $this->db->createCommand()
->delete($this->itemChildTable, 'parent=:parent AND child=:child', array(
':parent'=>$itemName,
':child'=>$childName
)) > 0;
}
Removes a child from its parent. Note, the child item is not deleted. Only the parent-child relationship is removed.
public boolean revoke(string $itemName, mixed $userId)
| ||
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | boolean | whether removal is successful |
public function revoke($itemName,$userId)
{
return $this->db->createCommand()
->delete($this->assignmentTable, 'itemname=:itemname AND userid=:userid', array(
':itemname'=>$itemName,
':userid'=>$userId
)) > 0;
}
Revokes an authorization assignment from a user.
public void save()
|
Saves the authorization data to persistent storage.
public void saveAuthAssignment(CAuthAssignment $assignment)
| ||
$assignment | CAuthAssignment | the assignment that has been changed. |
public function saveAuthAssignment($assignment)
{
$this->db->createCommand()
->update($this->assignmentTable, array(
'bizrule'=>$assignment->getBizRule(),
'data'=>serialize($assignment->getData()),
), 'itemname=:itemname AND userid=:userid', array(
'itemname'=>$assignment->getItemName(),
'userid'=>$assignment->getUserId()
));
}
Saves the changes to an authorization assignment.
public void saveAuthItem(CAuthItem $item, string $oldName=NULL)
| ||
$item | CAuthItem | the item to be saved. |
$oldName | string | the old item name. If null, it means the item name is not changed. |
public function saveAuthItem($item,$oldName=null)
{
if($this->usingSqlite() && $oldName!==null && $item->getName()!==$oldName)
{
$this->db->createCommand()
->update($this->itemChildTable, array(
'parent'=>$item->getName(),
), 'parent=:whereName', array(
':whereName'=>$oldName,
));
$this->db->createCommand()
->update($this->itemChildTable, array(
'child'=>$item->getName(),
), 'child=:whereName', array(
':whereName'=>$oldName,
));
$this->db->createCommand()
->update($this->assignmentTable, array(
'itemname'=>$item->getName(),
), 'itemname=:whereName', array(
':whereName'=>$oldName,
));
}
$this->db->createCommand()
->update($this->itemTable, array(
'name'=>$item->getName(),
'type'=>$item->getType(),
'description'=>$item->getDescription(),
'bizrule'=>$item->getBizRule(),
'data'=>serialize($item->getData()),
), 'name=:whereName', array(
':whereName'=>$oldName===null?$item->getName():$oldName,
));
}
Saves an authorization item to persistent storage.
protected boolean usingSqlite()
| ||
{return} | boolean | whether the database is a SQLite database |
protected function usingSqlite()
{
return $this->_usingSqlite;
}
Signup or Login in order to comment.