CPhpAuthManager
CPhpAuthManager represents an authorization manager that stores authorization information in terms of a PHP script file.
The authorization data will be saved to and loaded from a file specified by
authFile, which defaults to 'protected/data/auth.php'.
CPhpAuthManager is mainly suitable for authorization data that is not too big (for example, the authorization data for a personal blog system). Use
CDbAuthManager for more complex authorization data.
Protected Methods
Method |
Description |
Defined By |
checkItemChildType() | Checks the item types to make sure a child can be added to a parent. | CAuthManager |
detectLoop() | Checks whether there is a loop in the authorization item hierarchy. | CPhpAuthManager |
loadFromFile() | Loads the authorization data from a PHP script file. | CPhpAuthManager |
saveToFile() | Saves the authorization data to a PHP script file. | CPhpAuthManager |
Property Details
public string $authFile;
the path of the PHP script that contains the authorization data. If not set, it will be using 'protected/data/auth.php' as the data file. Make sure this file is writable by the Web server process if the authorization needs to be changed.
public array getAuthItems(integer $type=NULL, mixed $userId=NULL)
Returns the authorization items of the specific type and user.
Method Details
public boolean addItemChild(string $itemName, string $childName) |
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the item is added successfully |
Source Code: framework/web/auth/CPhpAuthManager.php#100 (
show)
public function addItemChild($itemName,$childName)
{
if(!isset($this->_items[$childName],$this->_items[$itemName]))
throw new CException(Yii::t('yii','Either "{parent}" or "{child}" does not exist.',array('{child}'=>$childName,'{parent}'=>$itemName)));
$child=$this->_items[$childName];
$item=$this->_items[$itemName];
$this->checkItemChildType($item->getType(),$child->getType());
if($this->detectLoop($itemName,$childName))
throw new CException(Yii::t('yii','Cannot add "{child}" as a child of "{parent}". A loop has been detected.',
array('{child}'=>$childName,'{parent}'=>$itemName)));
if(isset($this->_children[$itemName][$childName]))
throw new CException(Yii::t('yii','The item "{parent}" already has a child "{child}".',
array('{child}'=>$childName,'{parent}'=>$itemName)));
$this->_children[$itemName][$childName]=$this->_items[$childName];
return true;
}
Adds an item as a child of another item.
public CAuthAssignment assign(string $itemName, mixed $userId, string $bizRule=NULL, mixed $data=NULL) |
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
$bizRule | string | the business rule to be executed when checkAccess is called for this particular authorization item. |
$data | mixed | additional data associated with this assignment |
{return} | CAuthAssignment | the authorization assignment information. |
Source Code: framework/web/auth/CPhpAuthManager.php#176 (
show)
public function assign($itemName,$userId,$bizRule=null,$data=null)
{
if(!isset($this->_items[$itemName]))
throw new CException(Yii::t('yii','Unknown authorization item "{name}".',array('{name}'=>$itemName)));
elseif(isset($this->_assignments[$userId][$itemName]))
throw new CException(Yii::t('yii','Authorization item "{item}" has already been assigned to user "{user}".',
array('{item}'=>$itemName,'{user}'=>$userId)));
else
return $this->_assignments[$userId][$itemName]=new CAuthAssignment($this,$itemName,$userId,$bizRule,$data);
}
Assigns an authorization item to a user.
public boolean checkAccess(string $itemName, mixed $userId, array $params=array ( )) |
$itemName | string | the name of the operation that need access check |
$userId | mixed | the user ID. This can be either an integer or a string representing the unique identifier of a user. See IWebUser::getId. |
$params | array | name-value pairs that would be passed to biz rules associated with the tasks and roles assigned to the user. Since version 1.1.11 a param with name 'userId' is added to this array, which holds the value of $userId . |
{return} | boolean | whether the operations can be performed by the user. |
Source Code: framework/web/auth/CPhpAuthManager.php#66 (
show)
public function checkAccess($itemName,$userId,$params=array())
{
if(!isset($this->_items[$itemName]))
return false;
$item=$this->_items[$itemName];
Yii::trace('Checking permission "'.$item->getName().'"','system.web.auth.CPhpAuthManager');
if(!isset($params['userId']))
$params['userId'] = $userId;
if($this->executeBizRule($item->getBizRule(),$params,$item->getData()))
{
if(in_array($itemName,$this->defaultRoles))
return true;
if(isset($this->_assignments[$userId][$itemName]))
{
$assignment=$this->_assignments[$userId][$itemName];
if($this->executeBizRule($assignment->getBizRule(),$params,$assignment->getData()))
return true;
}
foreach($this->_children as $parentName=>$children)
{
if(isset($children[$itemName]) && $this->checkAccess($parentName,$userId,$params))
return true;
}
}
return false;
}
Performs access check for the specified user.
Removes all authorization data.
public void clearAuthAssignments() |
Removes all authorization assignments.
public CAuthItem createAuthItem(string $name, integer $type, string $description='', string $bizRule=NULL, mixed $data=NULL) |
$name | string | the item name. This must be a unique identifier. |
$type | integer | the item type (0: operation, 1: task, 2: role). |
$description | string | description of the item |
$bizRule | string | business rule associated with the item. This is a piece of PHP code that will be executed when checkAccess is called for the item. |
$data | mixed | additional data associated with the item. |
{return} | CAuthItem | the authorization item |
Source Code: framework/web/auth/CPhpAuthManager.php#286 (
show)
public function createAuthItem($name,$type,$description='',$bizRule=null,$data=null)
{
if(isset($this->_items[$name]))
throw new CException(Yii::t('yii','Unable to add an item whose name is the same as an existing item.'));
return $this->_items[$name]=new CAuthItem($this,$name,$type,$description,$bizRule,$data);
}
Creates an authorization item. An authorization item represents an action permission (e.g. creating a post). It has three types: operation, task and role. Authorization items form a hierarchy. Higher level items inherit permissions representing by lower level items.
protected boolean detectLoop(string $itemName, string $childName) |
$itemName | string | parent item name |
$childName | string | the name of the child item that is to be added to the hierarchy |
{return} | boolean | whether a loop exists |
Source Code: framework/web/auth/CPhpAuthManager.php#468 (
show)
protected function detectLoop($itemName,$childName)
{
if($childName===$itemName)
return true;
if(!isset($this->_children[$childName], $this->_items[$itemName]))
return false;
foreach($this->_children[$childName] as $child)
{
if($this->detectLoop($itemName,$child->getName()))
return true;
}
return false;
}
Checks whether there is a loop in the authorization item hierarchy.
public CAuthAssignment getAuthAssignment(string $itemName, mixed $userId) |
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | CAuthAssignment | the item assignment information. Null is returned if the item is not assigned to the user. |
Returns the item assignment information.
public array getAuthAssignments(mixed $userId) |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | array | the item assignment information for the user. An empty array will be returned if there is no item assigned to the user. |
Returns the item assignments for the specified user.
public CAuthItem getAuthItem(string $name) |
$name | string | the name of the item |
{return} | CAuthItem | the authorization item. Null if the item cannot be found. |
Returns the authorization item with the specified name.
public array getAuthItems(integer $type=NULL, mixed $userId=NULL) |
$type | integer | the item type (0: operation, 1: task, 2: role). Defaults to null, meaning returning all items regardless of their type. |
$userId | mixed | the user ID. Defaults to null, meaning returning all items even if they are not assigned to a user. |
{return} | array | the authorization items of the specific type. |
Source Code: framework/web/auth/CPhpAuthManager.php#246 (
show)
public function getAuthItems($type=null,$userId=null)
{
if($type===null && $userId===null)
return $this->_items;
$items=array();
if($userId===null)
{
foreach($this->_items as $name=>$item)
{
if($item->getType()==$type)
$items[$name]=$item;
}
}
elseif(isset($this->_assignments[$userId]))
{
foreach($this->_assignments[$userId] as $assignment)
{
$name=$assignment->getItemName();
if(isset($this->_items[$name]) && ($type===null || $this->_items[$name]->getType()==$type))
$items[$name]=$this->_items[$name];
}
}
return $items;
}
Returns the authorization items of the specific type and user.
public array getItemChildren(mixed $names) |
$names | mixed | the parent item name. This can be either a string or an array. The latter represents a list of item names. |
{return} | array | all child items of the parent |
Source Code: framework/web/auth/CPhpAuthManager.php#152 (
show)
public function getItemChildren($names)
{
if(is_string($names))
return isset($this->_children[$names]) ? $this->_children[$names] : array();
$children=array();
foreach($names as $name)
{
if(isset($this->_children[$name]))
$children=array_merge($children,$this->_children[$name]);
}
return $children;
}
Returns the children of the specified item.
public boolean hasItemChild(string $itemName, string $childName) |
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the child exists |
Returns a value indicating whether a child exists within a parent.
Initializes the application component. This method overrides parent implementation by loading the authorization data from PHP script.
public boolean isAssigned(string $itemName, mixed $userId) |
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | boolean | whether the item has been assigned to the user. |
Returns a value indicating whether the item has been assigned to the user.
Source Code: framework/web/auth/CPhpAuthManager.php#415 (
show)
public function load()
{
$this->clearAll();
$items=$this->loadFromFile($this->authFile);
foreach($items as $name=>$item)
$this->_items[$name]=new CAuthItem($this,$name,$item['type'],$item['description'],$item['bizRule'],$item['data']);
foreach($items as $name=>$item)
{
if(isset($item['children']))
{
foreach($item['children'] as $childName)
{
if(isset($this->_items[$childName]))
$this->_children[$name][$childName]=$this->_items[$childName];
}
}
if(isset($item['assignments']))
{
foreach($item['assignments'] as $userId=>$assignment)
{
$this->_assignments[$userId][$name]=new CAuthAssignment($this,$name,$userId,$assignment['bizRule'],$assignment['data']);
}
}
}
}
Loads authorization data.
protected array loadFromFile(string $file) |
$file | string | the file path. |
{return} | array | the authorization data |
Loads the authorization data from a PHP script file.
public boolean removeAuthItem(string $name) |
$name | string | the name of the item to be removed |
{return} | boolean | whether the item exists in the storage and has been removed |
Source Code: framework/web/auth/CPhpAuthManager.php#298 (
show)
public function removeAuthItem($name)
{
if(isset($this->_items[$name]))
{
foreach($this->_children as &$children)
unset($children[$name]);
foreach($this->_assignments as &$assignments)
unset($assignments[$name]);
unset($this->_items[$name]);
return true;
}
else
return false;
}
Removes the specified authorization item.
public boolean removeItemChild(string $itemName, string $childName) |
$itemName | string | the parent item name |
$childName | string | the child item name |
{return} | boolean | whether the removal is successful |
Source Code: framework/web/auth/CPhpAuthManager.php#124 (
show)
public function removeItemChild($itemName,$childName)
{
if(isset($this->_children[$itemName][$childName]))
{
unset($this->_children[$itemName][$childName]);
return true;
}
else
return false;
}
Removes a child from its parent. Note, the child item is not deleted. Only the parent-child relationship is removed.
public boolean revoke(string $itemName, mixed $userId) |
$itemName | string | the item name |
$userId | mixed | the user ID (see IWebUser::getId) |
{return} | boolean | whether removal is successful |
Source Code: framework/web/auth/CPhpAuthManager.php#193 (
show)
public function revoke($itemName,$userId)
{
if(isset($this->_assignments[$userId][$itemName]))
{
unset($this->_assignments[$userId][$itemName]);
return true;
}
else
return false;
}
Revokes an authorization assignment from a user.
Source Code: framework/web/auth/CPhpAuthManager.php#377 (
show)
public function save()
{
$items=array();
foreach($this->_items as $name=>$item)
{
$items[$name]=array(
'type'=>$item->getType(),
'description'=>$item->getDescription(),
'bizRule'=>$item->getBizRule(),
'data'=>$item->getData(),
);
if(isset($this->_children[$name]))
{
foreach($this->_children[$name] as $child)
$items[$name]['children'][]=$child->getName();
}
}
foreach($this->_assignments as $userId=>$assignments)
{
foreach($assignments as $name=>$assignment)
{
if(isset($items[$name]))
{
$items[$name]['assignments'][$userId]=array(
'bizRule'=>$assignment->getBizRule(),
'data'=>$assignment->getData(),
);
}
}
}
$this->saveToFile($items,$this->authFile);
}
Saves authorization data into persistent storage. If any change is made to the authorization data, please make sure you call this method to save the changed data into persistent storage.
Saves the changes to an authorization assignment.
public void saveAuthItem(CAuthItem $item, string $oldName=NULL) |
$item | CAuthItem | the item to be saved. |
$oldName | string | the old item name. If null, it means the item name is not changed. |
Source Code: framework/web/auth/CPhpAuthManager.php#329 (
show)
public function saveAuthItem($item,$oldName=null)
{
if($oldName!==null && ($newName=$item->getName())!==$oldName) // name changed
{
if(isset($this->_items[$newName]))
throw new CException(Yii::t('yii','Unable to change the item name. The name "{name}" is already used by another item.',array('{name}'=>$newName)));
if(isset($this->_items[$oldName]) && $this->_items[$oldName]===$item)
{
unset($this->_items[$oldName]);
$this->_items[$newName]=$item;
if(isset($this->_children[$oldName]))
{
$this->_children[$newName]=$this->_children[$oldName];
unset($this->_children[$oldName]);
}
foreach($this->_children as &$children)
{
if(isset($children[$oldName]))
{
$children[$newName]=$children[$oldName];
unset($children[$oldName]);
}
}
foreach($this->_assignments as &$assignments)
{
if(isset($assignments[$oldName]))
{
$assignments[$newName]=$assignments[$oldName];
unset($assignments[$oldName]);
}
}
}
}
}
Saves an authorization item to persistent storage.
protected void saveToFile(array $data, string $file) |
$data | array | the authorization data |
$file | string | the file path. |
Saves the authorization data to a PHP script file.