264 lines
7.5 KiB
PHP
264 lines
7.5 KiB
PHP
<?php
|
|
/**
|
|
* This file is part of the Piko user module
|
|
*
|
|
* @copyright 2020 Sylvain PHILIP.
|
|
* @license LGPL-3.0; see LICENSE.txt
|
|
* @link https://github.com/piko-framework/piko-user
|
|
*/
|
|
namespace app\modules\user;
|
|
|
|
use PDO;
|
|
|
|
/**
|
|
* Rbac utility class
|
|
*
|
|
* @author Sylvain PHILIP <contact@sphilip.com>
|
|
*/
|
|
class Rbac
|
|
{
|
|
public static PDO $db;
|
|
|
|
/**
|
|
* Create a role
|
|
*
|
|
* @param string $name The role name
|
|
* @param string $description The role description
|
|
* @return int The role Id
|
|
*/
|
|
public static function createRole($name, $description = '')
|
|
{
|
|
$query = 'INSERT INTO `auth_role` (`name`, `description`) VALUES (?, ?)';
|
|
|
|
static::$db->beginTransaction();
|
|
$st = static::$db->prepare($query);
|
|
$st->execute([$name, $description]);
|
|
static::$db->commit();
|
|
|
|
return static::$db->lastInsertId();
|
|
}
|
|
|
|
/**
|
|
* Check if the role exists
|
|
*
|
|
* @param string $name The role name
|
|
* @return boolean
|
|
*/
|
|
public static function roleExists($name)
|
|
{
|
|
$st = static::$db->prepare('SELECT COUNT(`id`) FROM `auth_role` WHERE `name` = :name');
|
|
$st->execute(['name' => $name]);
|
|
|
|
return ((int) $st->fetchColumn() > 0) ? true : false;
|
|
}
|
|
|
|
/**
|
|
* Get the role Id
|
|
*
|
|
* @param string $name The role name
|
|
* @return int The role Id (0 if the role is not found)
|
|
*/
|
|
public static function getRoleId($name)
|
|
{
|
|
$st = static::$db->prepare('SELECT `id` FROM `auth_role` WHERE `name` = :name');
|
|
$st->execute(['name' => $name]);
|
|
|
|
return (int) $st->fetchColumn();
|
|
}
|
|
|
|
/**
|
|
* Assign a role to an user
|
|
*
|
|
* @param int $userId The user Id
|
|
* @param string $roleName The role name
|
|
* @throws \RuntimeException If the role doesn't exists
|
|
*/
|
|
public static function assignRole($userId, $roleName)
|
|
{
|
|
$roleId = static::getRoleId($roleName);
|
|
|
|
if (!$roleId) {
|
|
throw new \RuntimeException("Role $roleName doesn't exists");
|
|
}
|
|
|
|
$query = 'INSERT INTO `auth_assignment` (`role_id`, `user_id`) VALUES (?, ?)';
|
|
|
|
static::$db->beginTransaction();
|
|
$st = static::$db->prepare($query);
|
|
$st->execute([$roleId, $userId]);
|
|
static::$db->commit();
|
|
}
|
|
|
|
/**
|
|
* Get user roles
|
|
*
|
|
* @param int $userId The user Id
|
|
* @return array An array containing user roles
|
|
*/
|
|
public static function getUserRoles($userId)
|
|
{
|
|
$query = 'SELECT `auth_role`.`name` FROM `auth_role` '
|
|
. 'INNER JOIN `auth_assignment` ON `auth_assignment`.`role_id` = `auth_role`.`id` '
|
|
. 'WHERE `auth_assignment`.`user_id` = :user_id '
|
|
. 'GROUP BY role_id';
|
|
$st = static::$db->prepare($query);
|
|
$st->execute(['user_id' => $userId]);
|
|
|
|
return $st->fetchAll(\PDO::FETCH_COLUMN);
|
|
}
|
|
|
|
/**
|
|
* Get user roles ids
|
|
*
|
|
* @param int $userId The user Id
|
|
* @return array An array containing user role ids
|
|
*/
|
|
public static function getUserRoleIds($userId)
|
|
{
|
|
$query = 'SELECT role_id FROM `auth_assignment` WHERE user_id = :user_id';
|
|
$sth = static::$db->prepare($query);
|
|
$sth->execute(['user_id' => $userId]);
|
|
|
|
return $sth->fetchAll(\PDO::FETCH_COLUMN);
|
|
}
|
|
|
|
/**
|
|
* Get user permissions
|
|
*
|
|
* @param int $userId The user Id
|
|
* @return array An array containing user permissions
|
|
*/
|
|
public static function getUserPermissions($userId)
|
|
{
|
|
$query = 'SELECT p.`name` FROM `auth_permission` AS p '
|
|
. 'INNER JOIN `auth_role_has_permission` AS ap ON ap.`permission_id` = p.`id` '
|
|
. 'INNER JOIN `auth_assignment` AS aa ON aa.`role_id` = ap.`role_id` '
|
|
. 'WHERE aa.`user_id` = :user_id '
|
|
. 'GROUP BY permission_id';
|
|
|
|
$st = static::$db->prepare($query);
|
|
$st->execute(['user_id' => $userId]);
|
|
|
|
return $st->fetchAll(\PDO::FETCH_COLUMN);
|
|
}
|
|
|
|
/**
|
|
* Get role permissions
|
|
*
|
|
* @param string $roleName The role name
|
|
* @return array An array of permissions as string
|
|
*/
|
|
public static function getRolePermissions($roleName): array
|
|
{
|
|
$roleId = static::getRoleId($roleName);
|
|
|
|
if (!$roleId) {
|
|
throw new \RuntimeException("Role $roleName doesn't exists");
|
|
}
|
|
|
|
$query = 'SELECT p.`name` FROM `auth_permission` AS p '
|
|
. 'INNER JOIN `auth_role_has_permission` AS ap ON ap.`permission_id` = p.`id` '
|
|
. 'WHERE ap.`role_id` = :role_id '
|
|
. 'GROUP BY permission_id';
|
|
$st = static::$db->prepare($query);
|
|
$st->execute(['role_id' => $roleId]);
|
|
|
|
return $st->fetchAll(\PDO::FETCH_COLUMN);
|
|
}
|
|
|
|
/**
|
|
* Get role permission ids
|
|
*
|
|
* @param string $roleName The role name
|
|
* @return array An array of permission ids
|
|
*/
|
|
public static function getRolePermissionIds($roleName)
|
|
{
|
|
$roleId = static::getRoleId($roleName);
|
|
|
|
if (!$roleId) {
|
|
throw new \RuntimeException("Role $roleName doesn't exists");
|
|
}
|
|
|
|
$query = 'SELECT permission_id FROM `auth_role_has_permission` WHERE role_id = :role_id';
|
|
$sth = static::$db->prepare($query);
|
|
$sth->execute(['role_id' => $roleId]);
|
|
|
|
return $sth->fetchAll(\PDO::FETCH_COLUMN);
|
|
}
|
|
|
|
/**
|
|
* Create a permission
|
|
*
|
|
* @param string $name The permission name
|
|
* @return int The permission id
|
|
*/
|
|
public static function createPermission($name): int
|
|
{
|
|
$query = 'INSERT INTO `auth_permission` (`name`) VALUES (?)';
|
|
|
|
static::$db->beginTransaction();
|
|
$st = static::$db->prepare($query);
|
|
$st->execute([$name]);
|
|
static::$db->commit();
|
|
|
|
return (int) static::$db->lastInsertId();
|
|
}
|
|
|
|
/**
|
|
* Check if the permission exists
|
|
*
|
|
* @param string $name The permission name
|
|
* @return boolean
|
|
*/
|
|
public static function permissionExists($name): bool
|
|
{
|
|
$st = static::$db->prepare('SELECT COUNT(`id`) FROM `auth_permission` WHERE `name` = :name');
|
|
$st->execute(['name' => $name]);
|
|
|
|
return ((int) $st->fetchColumn() > 0) ? true : false;
|
|
}
|
|
|
|
/**
|
|
* Get the permission Id
|
|
*
|
|
* @param string $name The permission name
|
|
* @return int The permission id (0 if the permission is not found)
|
|
*/
|
|
public static function getPermissionId($name): int
|
|
{
|
|
$st = static::$db->prepare('SELECT `id` FROM `auth_permission` WHERE `name` = :name');
|
|
$st->execute(['name' => $name]);
|
|
|
|
return (int) $st->fetchColumn();
|
|
}
|
|
|
|
/**
|
|
* Assign a permission to a role
|
|
*
|
|
* @param string $roleName The role name
|
|
* @param string $permissionName The permission name
|
|
* @throws \RuntimeException If the role or the permission doesn't exists
|
|
*/
|
|
public static function assignPermission($roleName, $permissionName): void
|
|
{
|
|
$roleId = static::getRoleId($roleName);
|
|
$permissionId = static::getPermissionId($permissionName);
|
|
|
|
if (!$roleId) {
|
|
throw new \RuntimeException("Role $roleName doesn't exists");
|
|
}
|
|
|
|
if (!$permissionId) {
|
|
throw new \RuntimeException("Permission $permissionName doesn't exists");
|
|
}
|
|
|
|
$query = 'INSERT INTO `auth_role_has_permission` (`role_id`, `permission_id`) VALUES (?, ?)';
|
|
|
|
static::$db->beginTransaction();
|
|
$st = static::$db->prepare($query);
|
|
$st->execute([$roleId, $permissionId]);
|
|
static::$db->commit();
|
|
}
|
|
}
|