AdminAclManipulator.php 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118
  1. <?php
  2. /*
  3. * This file is part of the Sonata Project package.
  4. *
  5. * (c) Thomas Rabaix <thomas.rabaix@sonata-project.org>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Sonata\AdminBundle\Util;
  11. use Sonata\AdminBundle\Admin\AdminInterface;
  12. use Sonata\AdminBundle\Security\Handler\AclSecurityHandlerInterface;
  13. use Symfony\Component\Console\Output\OutputInterface;
  14. use Symfony\Component\Security\Acl\Domain\ObjectIdentity;
  15. use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;
  16. use Symfony\Component\Security\Acl\Model\AclInterface;
  17. /**
  18. * @author Thomas Rabaix <thomas.rabaix@sonata-project.org>
  19. */
  20. class AdminAclManipulator implements AdminAclManipulatorInterface
  21. {
  22. /**
  23. * @var string
  24. */
  25. protected $maskBuilderClass;
  26. /**
  27. * @param string $maskBuilderClass
  28. */
  29. public function __construct($maskBuilderClass)
  30. {
  31. $this->maskBuilderClass = $maskBuilderClass;
  32. }
  33. /**
  34. * {@inheritdoc}
  35. */
  36. public function configureAcls(OutputInterface $output, AdminInterface $admin)
  37. {
  38. $securityHandler = $admin->getSecurityHandler();
  39. if (!$securityHandler instanceof AclSecurityHandlerInterface) {
  40. $output->writeln(sprintf('Admin `%s` is not configured to use ACL : <info>ignoring</info>', $admin->getCode()));
  41. return;
  42. }
  43. $objectIdentity = ObjectIdentity::fromDomainObject($admin);
  44. $newAcl = false;
  45. if (is_null($acl = $securityHandler->getObjectAcl($objectIdentity))) {
  46. $acl = $securityHandler->createAcl($objectIdentity);
  47. $newAcl = true;
  48. }
  49. // create admin ACL
  50. $output->writeln(sprintf(' > install ACL for %s', $admin->getCode()));
  51. $configResult = $this->addAdminClassAces($output, $acl, $securityHandler, $securityHandler->buildSecurityInformation($admin));
  52. if ($configResult) {
  53. $securityHandler->updateAcl($acl);
  54. } else {
  55. $output->writeln(sprintf(' - %s , no roles and permissions found', ($newAcl ? 'skip' : 'removed')));
  56. $securityHandler->deleteAcl($objectIdentity);
  57. }
  58. }
  59. /**
  60. * {@inheritdoc}
  61. */
  62. public function addAdminClassAces(OutputInterface $output, AclInterface $acl, AclSecurityHandlerInterface $securityHandler, array $roleInformation = array())
  63. {
  64. if (count($securityHandler->getAdminPermissions()) > 0) {
  65. $builder = new $this->maskBuilderClass();
  66. foreach ($roleInformation as $role => $permissions) {
  67. $aceIndex = $securityHandler->findClassAceIndexByRole($acl, $role);
  68. $roleAdminPermissions = array();
  69. foreach ($permissions as $permission) {
  70. // add only the admin permissions
  71. if (in_array($permission, $securityHandler->getAdminPermissions())) {
  72. $builder->add($permission);
  73. $roleAdminPermissions[] = $permission;
  74. }
  75. }
  76. if (count($roleAdminPermissions) > 0) {
  77. if ($aceIndex === false) {
  78. $acl->insertClassAce(new RoleSecurityIdentity($role), $builder->get());
  79. $action = 'add';
  80. } else {
  81. $acl->updateClassAce($aceIndex, $builder->get());
  82. $action = 'update';
  83. }
  84. if (!is_null($output)) {
  85. $output->writeln(sprintf(' - %s role: %s, permissions: %s', $action, $role, json_encode($roleAdminPermissions)));
  86. }
  87. $builder->reset();
  88. } elseif ($aceIndex !== false) {
  89. $acl->deleteClassAce($aceIndex);
  90. if (!is_null($output)) {
  91. $output->writeln(sprintf(' - remove role: %s', $role));
  92. }
  93. }
  94. }
  95. return true;
  96. }
  97. return false;
  98. }
  99. }