From 065d58732af3a4dcb9bb5c9f5f063045f52e1ee3 Mon Sep 17 00:00:00 2001 From: Nikola Posa Date: Sun, 28 Jun 2015 13:45:58 +0200 Subject: [PATCH 1/2] Created Proprietary interface applicable to Resources and Roles. Created Ownership assertion implementation. --- src/Assertion/OwnershipAssertion.php | 38 ++++++++++++++ src/ProprietaryInterface.php | 24 +++++++++ test/Assertion/OwnershipAssertionTest.php | 64 +++++++++++++++++++++++ test/TestAsset/UseCase2/Acl.php | 32 ++++++++++++ test/TestAsset/UseCase2/Author1.php | 17 ++++++ test/TestAsset/UseCase2/Author2.php | 17 ++++++ test/TestAsset/UseCase2/BlogPost.php | 32 ++++++++++++ test/TestAsset/UseCase2/Comment.php | 23 ++++++++ test/TestAsset/UseCase2/User.php | 30 +++++++++++ 9 files changed, 277 insertions(+) create mode 100644 src/Assertion/OwnershipAssertion.php create mode 100644 src/ProprietaryInterface.php create mode 100644 test/Assertion/OwnershipAssertionTest.php create mode 100644 test/TestAsset/UseCase2/Acl.php create mode 100644 test/TestAsset/UseCase2/Author1.php create mode 100644 test/TestAsset/UseCase2/Author2.php create mode 100644 test/TestAsset/UseCase2/BlogPost.php create mode 100644 test/TestAsset/UseCase2/Comment.php create mode 100644 test/TestAsset/UseCase2/User.php diff --git a/src/Assertion/OwnershipAssertion.php b/src/Assertion/OwnershipAssertion.php new file mode 100644 index 0000000..53a6a7e --- /dev/null +++ b/src/Assertion/OwnershipAssertion.php @@ -0,0 +1,38 @@ + + */ +class OwnershipAssertion implements AssertionInterface +{ + public function assert(Acl $acl, RoleInterface $role = null, ResourceInterface $resource = null, $privilege = null) + { + //Assert passes if role or resource is not proprietary + if (!$role instanceof ProprietaryInterface || !$resource instanceof ProprietaryInterface) { + return true; + } + + //Assert passes if resources does not have an owner + if ($resource->getOwnerId() === null) { + return true; + } + + return ($resource->getOwnerId() === $role->getOwnerId()); + } +} diff --git a/src/ProprietaryInterface.php b/src/ProprietaryInterface.php new file mode 100644 index 0000000..8da8f3b --- /dev/null +++ b/src/ProprietaryInterface.php @@ -0,0 +1,24 @@ + + */ +interface ProprietaryInterface +{ + /** + * @return mixed + */ + public function getOwnerId(); +} diff --git a/test/Assertion/OwnershipAssertionTest.php b/test/Assertion/OwnershipAssertionTest.php new file mode 100644 index 0000000..a672d81 --- /dev/null +++ b/test/Assertion/OwnershipAssertionTest.php @@ -0,0 +1,64 @@ +assertTrue($acl->isAllowed('guest', 'blogPost', 'view')); + $this->assertFalse($acl->isAllowed('guest', 'blogPost', 'delete')); + } + + public function testAssertPassesIfResourceIsNotProprietary() + { + $acl = new UseCase2\Acl(); + + $author = new UseCase2\Author1(); + + $this->assertTrue($acl->isAllowed($author, 'comment', 'view')); + $this->assertFalse($acl->isAllowed($author, 'comment', 'delete')); + } + + public function testAssertPassesIfResourceDoesNotHaveOwner() + { + $acl = new UseCase2\Acl(); + + $author = new UseCase2\Author1(); + + $blogPost = new UseCase2\BlogPost(); + $blogPost->author = null; + + $this->assertTrue($acl->isAllowed($author, 'blogPost', 'write')); + $this->assertTrue($acl->isAllowed($author, $blogPost, 'edit')); + } + + public function testAssertFailsIfResourceHasOwnerOtherThanRoleOwner() + { + $acl = new UseCase2\Acl(); + + $author1 = new UseCase2\Author1(); + $author2 = new UseCase2\Author2(); + + $blogPost = new UseCase2\BlogPost(); + $blogPost->author = $author1; + + $this->assertTrue($acl->isAllowed($author2, 'blogPost', 'write')); + $this->assertFalse($acl->isAllowed($author2, $blogPost, 'edit')); + } +} diff --git a/test/TestAsset/UseCase2/Acl.php b/test/TestAsset/UseCase2/Acl.php new file mode 100644 index 0000000..9074ab5 --- /dev/null +++ b/test/TestAsset/UseCase2/Acl.php @@ -0,0 +1,32 @@ +addRole('guest'); + $this->addRole('member', 'guest'); + $this->addRole('author', 'member'); + $this->addRole('admin'); + + $this->addResource(new BlogPost()); + $this->addResource(new Comment()); + + $this->allow('guest', 'blogPost', 'view'); + $this->allow('guest', 'comment', array('view', 'submit')); + $this->allow('author', 'blogPost', 'write'); + $this->allow('author', 'blogPost', 'edit', new OwnershipAssertion()); + $this->allow('admin'); + } +} diff --git a/test/TestAsset/UseCase2/Author1.php b/test/TestAsset/UseCase2/Author1.php new file mode 100644 index 0000000..d3fea05 --- /dev/null +++ b/test/TestAsset/UseCase2/Author1.php @@ -0,0 +1,17 @@ +author === null) { + return null; + } + + return $this->author->getOwnerId(); + } +} diff --git a/test/TestAsset/UseCase2/Comment.php b/test/TestAsset/UseCase2/Comment.php new file mode 100644 index 0000000..7efeda6 --- /dev/null +++ b/test/TestAsset/UseCase2/Comment.php @@ -0,0 +1,23 @@ + + */ +class Comment implements Resource\ResourceInterface +{ + public function getResourceId() + { + return 'comment'; + } +} diff --git a/test/TestAsset/UseCase2/User.php b/test/TestAsset/UseCase2/User.php new file mode 100644 index 0000000..0ee9b0d --- /dev/null +++ b/test/TestAsset/UseCase2/User.php @@ -0,0 +1,30 @@ +role; + } + + public function getOwnerId() + { + return $this->id; + } +} From ba2f5649a688f59c3ea37db471f89b50a7b8b440 Mon Sep 17 00:00:00 2001 From: Nikola Posa Date: Sun, 28 Jun 2015 14:52:59 +0200 Subject: [PATCH 2/2] Coding style fixes. --- test/Assertion/OwnershipAssertionTest.php | 128 +++++++++++----------- test/TestAsset/UseCase2/Acl.php | 64 +++++------ test/TestAsset/UseCase2/Author1.php | 34 +++--- test/TestAsset/UseCase2/Author2.php | 34 +++--- test/TestAsset/UseCase2/BlogPost.php | 64 +++++------ test/TestAsset/UseCase2/User.php | 60 +++++----- 6 files changed, 192 insertions(+), 192 deletions(-) diff --git a/test/Assertion/OwnershipAssertionTest.php b/test/Assertion/OwnershipAssertionTest.php index a672d81..e523cec 100644 --- a/test/Assertion/OwnershipAssertionTest.php +++ b/test/Assertion/OwnershipAssertionTest.php @@ -1,64 +1,64 @@ -assertTrue($acl->isAllowed('guest', 'blogPost', 'view')); - $this->assertFalse($acl->isAllowed('guest', 'blogPost', 'delete')); - } - - public function testAssertPassesIfResourceIsNotProprietary() - { - $acl = new UseCase2\Acl(); - - $author = new UseCase2\Author1(); - - $this->assertTrue($acl->isAllowed($author, 'comment', 'view')); - $this->assertFalse($acl->isAllowed($author, 'comment', 'delete')); - } - - public function testAssertPassesIfResourceDoesNotHaveOwner() - { - $acl = new UseCase2\Acl(); - - $author = new UseCase2\Author1(); - - $blogPost = new UseCase2\BlogPost(); - $blogPost->author = null; - - $this->assertTrue($acl->isAllowed($author, 'blogPost', 'write')); - $this->assertTrue($acl->isAllowed($author, $blogPost, 'edit')); - } - - public function testAssertFailsIfResourceHasOwnerOtherThanRoleOwner() - { - $acl = new UseCase2\Acl(); - - $author1 = new UseCase2\Author1(); - $author2 = new UseCase2\Author2(); - - $blogPost = new UseCase2\BlogPost(); - $blogPost->author = $author1; - - $this->assertTrue($acl->isAllowed($author2, 'blogPost', 'write')); - $this->assertFalse($acl->isAllowed($author2, $blogPost, 'edit')); - } -} +assertTrue($acl->isAllowed('guest', 'blogPost', 'view')); + $this->assertFalse($acl->isAllowed('guest', 'blogPost', 'delete')); + } + + public function testAssertPassesIfResourceIsNotProprietary() + { + $acl = new UseCase2\Acl(); + + $author = new UseCase2\Author1(); + + $this->assertTrue($acl->isAllowed($author, 'comment', 'view')); + $this->assertFalse($acl->isAllowed($author, 'comment', 'delete')); + } + + public function testAssertPassesIfResourceDoesNotHaveOwner() + { + $acl = new UseCase2\Acl(); + + $author = new UseCase2\Author1(); + + $blogPost = new UseCase2\BlogPost(); + $blogPost->author = null; + + $this->assertTrue($acl->isAllowed($author, 'blogPost', 'write')); + $this->assertTrue($acl->isAllowed($author, $blogPost, 'edit')); + } + + public function testAssertFailsIfResourceHasOwnerOtherThanRoleOwner() + { + $acl = new UseCase2\Acl(); + + $author1 = new UseCase2\Author1(); + $author2 = new UseCase2\Author2(); + + $blogPost = new UseCase2\BlogPost(); + $blogPost->author = $author1; + + $this->assertTrue($acl->isAllowed($author2, 'blogPost', 'write')); + $this->assertFalse($acl->isAllowed($author2, $blogPost, 'edit')); + } +} diff --git a/test/TestAsset/UseCase2/Acl.php b/test/TestAsset/UseCase2/Acl.php index 9074ab5..66139fb 100644 --- a/test/TestAsset/UseCase2/Acl.php +++ b/test/TestAsset/UseCase2/Acl.php @@ -1,32 +1,32 @@ -addRole('guest'); - $this->addRole('member', 'guest'); - $this->addRole('author', 'member'); - $this->addRole('admin'); - - $this->addResource(new BlogPost()); - $this->addResource(new Comment()); - - $this->allow('guest', 'blogPost', 'view'); - $this->allow('guest', 'comment', array('view', 'submit')); - $this->allow('author', 'blogPost', 'write'); - $this->allow('author', 'blogPost', 'edit', new OwnershipAssertion()); - $this->allow('admin'); - } -} +addRole('guest'); + $this->addRole('member', 'guest'); + $this->addRole('author', 'member'); + $this->addRole('admin'); + + $this->addResource(new BlogPost()); + $this->addResource(new Comment()); + + $this->allow('guest', 'blogPost', 'view'); + $this->allow('guest', 'comment', array('view', 'submit')); + $this->allow('author', 'blogPost', 'write'); + $this->allow('author', 'blogPost', 'edit', new OwnershipAssertion()); + $this->allow('admin'); + } +} diff --git a/test/TestAsset/UseCase2/Author1.php b/test/TestAsset/UseCase2/Author1.php index d3fea05..fe9e7f9 100644 --- a/test/TestAsset/UseCase2/Author1.php +++ b/test/TestAsset/UseCase2/Author1.php @@ -1,17 +1,17 @@ -author === null) { - return null; - } - - return $this->author->getOwnerId(); - } -} +author === null) { + return null; + } + + return $this->author->getOwnerId(); + } +} diff --git a/test/TestAsset/UseCase2/User.php b/test/TestAsset/UseCase2/User.php index 0ee9b0d..b0311e6 100644 --- a/test/TestAsset/UseCase2/User.php +++ b/test/TestAsset/UseCase2/User.php @@ -1,30 +1,30 @@ -role; - } - - public function getOwnerId() - { - return $this->id; - } -} +role; + } + + public function getOwnerId() + { + return $this->id; + } +}