AclSecurityHandler.php 9.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319
  1. <?php
  2. /*
  3. * This file is part of the Sonata Project package.
  4. *
  5. * (c) Thomas Rabaix <thomas.rabaix@sonata-project.org>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Sonata\AdminBundle\Security\Handler;
  11. use Sonata\AdminBundle\Admin\AdminInterface;
  12. use Symfony\Component\Security\Acl\Domain\ObjectIdentity;
  13. use Symfony\Component\Security\Acl\Domain\RoleSecurityIdentity;
  14. use Symfony\Component\Security\Acl\Domain\UserSecurityIdentity;
  15. use Symfony\Component\Security\Acl\Exception\AclNotFoundException;
  16. use Symfony\Component\Security\Acl\Exception\NotAllAclsFoundException;
  17. use Symfony\Component\Security\Acl\Model\AclInterface;
  18. use Symfony\Component\Security\Acl\Model\MutableAclProviderInterface;
  19. use Symfony\Component\Security\Acl\Model\ObjectIdentityInterface;
  20. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  21. use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
  22. use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
  23. use Symfony\Component\Security\Core\SecurityContextInterface;
  24. /**
  25. * @author Thomas Rabaix <thomas.rabaix@sonata-project.org>
  26. */
  27. class AclSecurityHandler implements AclSecurityHandlerInterface
  28. {
  29. /**
  30. * @var TokenStorageInterface|SecurityContextInterface
  31. */
  32. protected $tokenStorage;
  33. /**
  34. * @var AuthorizationCheckerInterface|SecurityContextInterface
  35. */
  36. protected $authorizationChecker;
  37. /**
  38. * @var MutableAclProviderInterface
  39. */
  40. protected $aclProvider;
  41. /**
  42. * @var array
  43. */
  44. protected $superAdminRoles;
  45. /**
  46. * @var array
  47. */
  48. protected $adminPermissions;
  49. /**
  50. * @var array
  51. */
  52. protected $objectPermissions;
  53. /**
  54. * @var string
  55. */
  56. protected $maskBuilderClass;
  57. /**
  58. * NEXT_MAJOR: Go back to signature class check when bumping requirements to SF 2.6+.
  59. *
  60. * @param TokenStorageInterface|SecurityContextInterface $tokenStorage
  61. * @param TokenStorageInterface|SecurityContextInterface $authorizationChecker
  62. * @param MutableAclProviderInterface $aclProvider
  63. * @param string $maskBuilderClass
  64. * @param array $superAdminRoles
  65. */
  66. public function __construct($tokenStorage, $authorizationChecker, MutableAclProviderInterface $aclProvider, $maskBuilderClass, array $superAdminRoles)
  67. {
  68. if (!$tokenStorage instanceof TokenStorageInterface && !$tokenStorage instanceof SecurityContextInterface) {
  69. throw new \InvalidArgumentException('Argument 1 should be an instance of Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface or Symfony\Component\Security\Core\SecurityContextInterface');
  70. }
  71. if (!$authorizationChecker instanceof AuthorizationCheckerInterface && !$authorizationChecker instanceof SecurityContextInterface) {
  72. throw new \InvalidArgumentException('Argument 2 should be an instance of Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface or Symfony\Component\Security\Core\SecurityContextInterface');
  73. }
  74. $this->tokenStorage = $tokenStorage;
  75. $this->authorizationChecker = $authorizationChecker;
  76. $this->aclProvider = $aclProvider;
  77. $this->maskBuilderClass = $maskBuilderClass;
  78. $this->superAdminRoles = $superAdminRoles;
  79. }
  80. /**
  81. * {@inheritdoc}
  82. */
  83. public function setAdminPermissions(array $permissions)
  84. {
  85. $this->adminPermissions = $permissions;
  86. }
  87. /**
  88. * {@inheritdoc}
  89. */
  90. public function getAdminPermissions()
  91. {
  92. return $this->adminPermissions;
  93. }
  94. /**
  95. * {@inheritdoc}
  96. */
  97. public function setObjectPermissions(array $permissions)
  98. {
  99. $this->objectPermissions = $permissions;
  100. }
  101. /**
  102. * {@inheritdoc}
  103. */
  104. public function getObjectPermissions()
  105. {
  106. return $this->objectPermissions;
  107. }
  108. /**
  109. * {@inheritdoc}
  110. */
  111. public function isGranted(AdminInterface $admin, $attributes, $object = null)
  112. {
  113. if (!is_array($attributes)) {
  114. $attributes = array($attributes);
  115. }
  116. try {
  117. return $this->authorizationChecker->isGranted($this->superAdminRoles) || $this->authorizationChecker->isGranted($attributes, $object);
  118. } catch (AuthenticationCredentialsNotFoundException $e) {
  119. return false;
  120. }
  121. }
  122. /**
  123. * {@inheritdoc}
  124. */
  125. public function getBaseRole(AdminInterface $admin)
  126. {
  127. return 'ROLE_'.str_replace('.', '_', strtoupper($admin->getCode())).'_%s';
  128. }
  129. /**
  130. * {@inheritdoc}
  131. */
  132. public function buildSecurityInformation(AdminInterface $admin)
  133. {
  134. $baseRole = $this->getBaseRole($admin);
  135. $results = array();
  136. foreach ($admin->getSecurityInformation() as $role => $permissions) {
  137. $results[sprintf($baseRole, $role)] = $permissions;
  138. }
  139. return $results;
  140. }
  141. /**
  142. * {@inheritdoc}
  143. */
  144. public function createObjectSecurity(AdminInterface $admin, $object)
  145. {
  146. // retrieving the ACL for the object identity
  147. $objectIdentity = ObjectIdentity::fromDomainObject($object);
  148. $acl = $this->getObjectAcl($objectIdentity);
  149. if (is_null($acl)) {
  150. $acl = $this->createAcl($objectIdentity);
  151. }
  152. // retrieving the security identity of the currently logged-in user
  153. $user = $this->tokenStorage->getToken()->getUser();
  154. $securityIdentity = UserSecurityIdentity::fromAccount($user);
  155. $this->addObjectOwner($acl, $securityIdentity);
  156. $this->addObjectClassAces($acl, $this->buildSecurityInformation($admin));
  157. $this->updateAcl($acl);
  158. }
  159. /**
  160. * {@inheritdoc}
  161. */
  162. public function deleteObjectSecurity(AdminInterface $admin, $object)
  163. {
  164. $objectIdentity = ObjectIdentity::fromDomainObject($object);
  165. $this->deleteAcl($objectIdentity);
  166. }
  167. /**
  168. * {@inheritdoc}
  169. */
  170. public function getObjectAcl(ObjectIdentityInterface $objectIdentity)
  171. {
  172. try {
  173. $acl = $this->aclProvider->findAcl($objectIdentity);
  174. } catch (AclNotFoundException $e) {
  175. return;
  176. }
  177. return $acl;
  178. }
  179. /**
  180. * {@inheritdoc}
  181. */
  182. public function findObjectAcls(\Traversable $oids, array $sids = array())
  183. {
  184. try {
  185. $acls = $this->aclProvider->findAcls(iterator_to_array($oids), $sids);
  186. } catch (NotAllAclsFoundException $e) {
  187. $acls = $e->getPartialResult();
  188. } catch (AclNotFoundException $e) { // if only one oid, this error is thrown
  189. $acls = new \SplObjectStorage();
  190. }
  191. return $acls;
  192. }
  193. /**
  194. * {@inheritdoc}
  195. */
  196. public function addObjectOwner(AclInterface $acl, UserSecurityIdentity $securityIdentity = null)
  197. {
  198. if (false === $this->findClassAceIndexByUsername($acl, $securityIdentity->getUsername())) {
  199. // only add if not already exists
  200. $acl->insertObjectAce($securityIdentity, constant("$this->maskBuilderClass::MASK_OWNER"));
  201. }
  202. }
  203. /**
  204. * {@inheritdoc}
  205. */
  206. public function addObjectClassAces(AclInterface $acl, array $roleInformation = array())
  207. {
  208. $builder = new $this->maskBuilderClass();
  209. foreach ($roleInformation as $role => $permissions) {
  210. $aceIndex = $this->findClassAceIndexByRole($acl, $role);
  211. $hasRole = false;
  212. foreach ($permissions as $permission) {
  213. // add only the object permissions
  214. if (in_array($permission, $this->getObjectPermissions())) {
  215. $builder->add($permission);
  216. $hasRole = true;
  217. }
  218. }
  219. if ($hasRole) {
  220. if ($aceIndex === false) {
  221. $acl->insertClassAce(new RoleSecurityIdentity($role), $builder->get());
  222. } else {
  223. $acl->updateClassAce($aceIndex, $builder->get());
  224. }
  225. $builder->reset();
  226. } elseif ($aceIndex !== false) {
  227. $acl->deleteClassAce($aceIndex);
  228. }
  229. }
  230. }
  231. /**
  232. * {@inheritdoc}
  233. */
  234. public function createAcl(ObjectIdentityInterface $objectIdentity)
  235. {
  236. return $this->aclProvider->createAcl($objectIdentity);
  237. }
  238. /**
  239. * {@inheritdoc}
  240. */
  241. public function updateAcl(AclInterface $acl)
  242. {
  243. $this->aclProvider->updateAcl($acl);
  244. }
  245. /**
  246. * {@inheritdoc}
  247. */
  248. public function deleteAcl(ObjectIdentityInterface $objectIdentity)
  249. {
  250. $this->aclProvider->deleteAcl($objectIdentity);
  251. }
  252. /**
  253. * {@inheritdoc}
  254. */
  255. public function findClassAceIndexByRole(AclInterface $acl, $role)
  256. {
  257. foreach ($acl->getClassAces() as $index => $entry) {
  258. if ($entry->getSecurityIdentity() instanceof RoleSecurityIdentity && $entry->getSecurityIdentity()->getRole() === $role) {
  259. return $index;
  260. }
  261. }
  262. return false;
  263. }
  264. /**
  265. * {@inheritdoc}
  266. */
  267. public function findClassAceIndexByUsername(AclInterface $acl, $username)
  268. {
  269. foreach ($acl->getClassAces() as $index => $entry) {
  270. if ($entry->getSecurityIdentity() instanceof UserSecurityIdentity && $entry->getSecurityIdentity()->getUsername() === $username) {
  271. return $index;
  272. }
  273. }
  274. return false;
  275. }
  276. }