<?php

/**

 * Zend Framework

 *

 * LICENSE

 *

 * This source file is subject to the new BSD license that is bundled

 * with this package in the file LICENSE.txt.

 * It is also available through the world-wide-web at this URL:

 * http://framework.zend.com/license/new-bsd

 * If you did not receive a copy of the license and are unable to

 * obtain it through the world-wide-web, please send an email

 * to license@zend.com so we can send you a copy immediately.

 *

 * @category   Zend

 * @package    Zend_Acl

 * @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 * @version    $Id: Acl.php 23358 2010-11-18 16:19:31Z ralph $

 */

/**

 * @see Zend_Acl_Resource_Interface

 */

require_once 'Zend/Acl/Resource/Interface.php';

/**

 * @see Zend_Acl_Role_Registry

 */

require_once 'Zend/Acl/Role/Registry.php';

/**

 * @see Zend_Acl_Assert_Interface

 */

require_once 'Zend/Acl/Assert/Interface.php';

/**

 * @see Zend_Acl_Role

 */

require_once 'Zend/Acl/Role.php';

/**

 * @see Zend_Acl_Resource

 */

require_once 'Zend/Acl/Resource.php';

/**

 * @category   Zend

 * @package    Zend_Acl

 * @copyright  Copyright (c) 2005-2010 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 */

class Zend_Acl

{

    /**

     * Rule type: allow

     */

    const TYPE_ALLOW = 'TYPE_ALLOW';

    /**

     * Rule type: deny

     */

    const TYPE_DENY  = 'TYPE_DENY';

    /**

     * Rule operation: add

     */

    const OP_ADD = 'OP_ADD';

    /**

     * Rule operation: remove

     */

    const OP_REMOVE = 'OP_REMOVE';

    /**

     * Role registry

     *

     * @var Zend_Acl_Role_Registry

     */

    protected $_roleRegistry = null;

    /**

     * Resource tree

     *

     * @var array

     */

    protected $_resources = array();

    /**

     * @var Zend_Acl_Role_Interface

     */

    protected $_isAllowedRole     = null;

    /**

     * @var Zend_Acl_Resource_Interface

     */

    protected $_isAllowedResource = null;

    /**

     * @var String

     */

    protected $_isAllowedPrivilege = null;

    /**

     * ACL rules; whitelist (deny everything to all) by default

     *

     * @var array

     */

    protected $_rules = array(

        'allResources' => array(

            'allRoles' => array(

                'allPrivileges' => array(

                    'type'   => self::TYPE_DENY,

                    'assert' => null

                    ),

                'byPrivilegeId' => array()

                ),

            'byRoleId' => array()

            ),

        'byResourceId' => array()

        );

    /**

     * Adds a Role having an identifier unique to the registry

     *

     * The $parents parameter may be a reference to, or the string identifier for,

     * a Role existing in the registry, or $parents may be passed as an array of

     * these - mixing string identifiers and objects is ok - to indicate the Roles

     * from which the newly added Role will directly inherit.

     *

     * In order to resolve potential ambiguities with conflicting rules inherited

     * from different parents, the most recently added parent takes precedence over

     * parents that were previously added. In other words, the first parent added

     * will have the least priority, and the last parent added will have the

     * highest priority.

     *

     * @param  Zend_Acl_Role_Interface              $role

     * @param  Zend_Acl_Role_Interface|string|array $parents

     * @uses   Zend_Acl_Role_Registry::add()

     * @return Zend_Acl Provides a fluent interface

     */

    public function addRole($role, $parents = null)

    {

        if (is_string($role)) {

            $role = new Zend_Acl_Role($role);

        }

        if (!$role instanceof Zend_Acl_Role_Interface) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception('addRole() expects $role to be of type Zend_Acl_Role_Interface');

        }

        $this->_getRoleRegistry()->add($role, $parents);

        return $this;

    }

    /**

     * Returns the identified Role

     *

     * The $role parameter can either be a Role or Role identifier.

     *

     * @param  Zend_Acl_Role_Interface|string $role

     * @uses   Zend_Acl_Role_Registry::get()

     * @return Zend_Acl_Role_Interface

     */

    public function getRole($role)

    {

        return $this->_getRoleRegistry()->get($role);

    }

    /**

     * Returns true if and only if the Role exists in the registry

     *

     * The $role parameter can either be a Role or a Role identifier.

     *

     * @param  Zend_Acl_Role_Interface|string $role

     * @uses   Zend_Acl_Role_Registry::has()

     * @return boolean

     */

    public function hasRole($role)

    {

        return $this->_getRoleRegistry()->has($role);

    }

    /**

     * Returns true if and only if $role inherits from $inherit

     *

     * Both parameters may be either a Role or a Role identifier. If

     * $onlyParents is true, then $role must inherit directly from

     * $inherit in order to return true. By default, this method looks

     * through the entire inheritance DAG to determine whether $role

     * inherits from $inherit through its ancestor Roles.

     *

     * @param  Zend_Acl_Role_Interface|string $role

     * @param  Zend_Acl_Role_Interface|string $inherit

     * @param  boolean                        $onlyParents

     * @uses   Zend_Acl_Role_Registry::inherits()

     * @return boolean

     */

    public function inheritsRole($role, $inherit, $onlyParents = false)

    {

        return $this->_getRoleRegistry()->inherits($role, $inherit, $onlyParents);

    }

    /**

     * Removes the Role from the registry

     *

     * The $role parameter can either be a Role or a Role identifier.

     *

     * @param  Zend_Acl_Role_Interface|string $role

     * @uses   Zend_Acl_Role_Registry::remove()

     * @return Zend_Acl Provides a fluent interface

     */

    public function removeRole($role)

    {

        $this->_getRoleRegistry()->remove($role);

        if ($role instanceof Zend_Acl_Role_Interface) {

            $roleId = $role->getRoleId();

        } else {

            $roleId = $role;

        }

        foreach ($this->_rules['allResources']['byRoleId'] as $roleIdCurrent => $rules) {

            if ($roleId === $roleIdCurrent) {

                unset($this->_rules['allResources']['byRoleId'][$roleIdCurrent]);

            }

        }

        foreach ($this->_rules['byResourceId'] as $resourceIdCurrent => $visitor) {

            if (array_key_exists('byRoleId', $visitor)) {

                foreach ($visitor['byRoleId'] as $roleIdCurrent => $rules) {

                    if ($roleId === $roleIdCurrent) {

                        unset($this->_rules['byResourceId'][$resourceIdCurrent]['byRoleId'][$roleIdCurrent]);

                    }

                }

            }

        }

        return $this;

    }

    /**

     * Removes all Roles from the registry

     *

     * @uses   Zend_Acl_Role_Registry::removeAll()

     * @return Zend_Acl Provides a fluent interface

     */

    public function removeRoleAll()

    {

        $this->_getRoleRegistry()->removeAll();

        foreach ($this->_rules['allResources']['byRoleId'] as $roleIdCurrent => $rules) {

            unset($this->_rules['allResources']['byRoleId'][$roleIdCurrent]);

        }

        foreach ($this->_rules['byResourceId'] as $resourceIdCurrent => $visitor) {

            foreach ($visitor['byRoleId'] as $roleIdCurrent => $rules) {

                unset($this->_rules['byResourceId'][$resourceIdCurrent]['byRoleId'][$roleIdCurrent]);

            }

        }

        return $this;

    }

    /**

     * Adds a Resource having an identifier unique to the ACL

     *

     * The $parent parameter may be a reference to, or the string identifier for,

     * the existing Resource from which the newly added Resource will inherit.

     *

     * @param  Zend_Acl_Resource_Interface|string $resource

     * @param  Zend_Acl_Resource_Interface|string $parent

     * @throws Zend_Acl_Exception

     * @return Zend_Acl Provides a fluent interface

     */

    public function addResource($resource, $parent = null)

    {

        if (is_string($resource)) {

            $resource = new Zend_Acl_Resource($resource);

        }

        if (!$resource instanceof Zend_Acl_Resource_Interface) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception('addResource() expects $resource to be of type Zend_Acl_Resource_Interface');

        }

        $resourceId = $resource->getResourceId();

        if ($this->has($resourceId)) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception("Resource id '$resourceId' already exists in the ACL");

        }

        $resourceParent = null;

        if (null !== $parent) {

            try {

                if ($parent instanceof Zend_Acl_Resource_Interface) {

                    $resourceParentId = $parent->getResourceId();

                } else {

                    $resourceParentId = $parent;

                }

                $resourceParent = $this->get($resourceParentId);

            } catch (Zend_Acl_Exception $e) {

                require_once 'Zend/Acl/Exception.php';

                throw new Zend_Acl_Exception("Parent Resource id '$resourceParentId' does not exist", 0, $e);

            }

            $this->_resources[$resourceParentId]['children'][$resourceId] = $resource;

        }

        $this->_resources[$resourceId] = array(

            'instance' => $resource,

            'parent'   => $resourceParent,

            'children' => array()

            );

        return $this;

    }

    /**

     * Adds a Resource having an identifier unique to the ACL

     *

     * The $parent parameter may be a reference to, or the string identifier for,

     * the existing Resource from which the newly added Resource will inherit.

     *

     * @deprecated in version 1.9.1 and will be available till 2.0.  New code

     *             should use addResource() instead.

     *

     * @param  Zend_Acl_Resource_Interface        $resource

     * @param  Zend_Acl_Resource_Interface|string $parent

     * @throws Zend_Acl_Exception

     * @return Zend_Acl Provides a fluent interface

     */

    public function add(Zend_Acl_Resource_Interface $resource, $parent = null)

    {

        return $this->addResource($resource, $parent);

    }

    /**

     * Returns the identified Resource

     *

     * The $resource parameter can either be a Resource or a Resource identifier.

     *

     * @param  Zend_Acl_Resource_Interface|string $resource

     * @throws Zend_Acl_Exception

     * @return Zend_Acl_Resource_Interface

     */

    public function get($resource)

    {

        if ($resource instanceof Zend_Acl_Resource_Interface) {

            $resourceId = $resource->getResourceId();

        } else {

            $resourceId = (string) $resource;

        }

        if (!$this->has($resource)) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception("Resource '$resourceId' not found");

        }

        return $this->_resources[$resourceId]['instance'];

    }

    /**

     * Returns true if and only if the Resource exists in the ACL

     *

     * The $resource parameter can either be a Resource or a Resource identifier.

     *

     * @param  Zend_Acl_Resource_Interface|string $resource

     * @return boolean

     */

    public function has($resource)

    {

        if ($resource instanceof Zend_Acl_Resource_Interface) {

            $resourceId = $resource->getResourceId();

        } else {

            $resourceId = (string) $resource;

        }

        return isset($this->_resources[$resourceId]);

    }

    /**

     * Returns true if and only if $resource inherits from $inherit

     *

     * Both parameters may be either a Resource or a Resource identifier. If

     * $onlyParent is true, then $resource must inherit directly from

     * $inherit in order to return true. By default, this method looks

     * through the entire inheritance tree to determine whether $resource

     * inherits from $inherit through its ancestor Resources.

     *

     * @param  Zend_Acl_Resource_Interface|string $resource

     * @param  Zend_Acl_Resource_Interface|string $inherit

     * @param  boolean                            $onlyParent

     * @throws Zend_Acl_Resource_Registry_Exception

     * @return boolean

     */

    public function inherits($resource, $inherit, $onlyParent = false)

    {

        try {

            $resourceId     = $this->get($resource)->getResourceId();

            $inheritId = $this->get($inherit)->getResourceId();

        } catch (Zend_Acl_Exception $e) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception($e->getMessage(), $e->getCode(), $e);

        }

        if (null !== $this->_resources[$resourceId]['parent']) {

            $parentId = $this->_resources[$resourceId]['parent']->getResourceId();

            if ($inheritId === $parentId) {

                return true;

            } else if ($onlyParent) {

                return false;

            }

        } else {

            return false;

        }

        while (null !== $this->_resources[$parentId]['parent']) {

            $parentId = $this->_resources[$parentId]['parent']->getResourceId();

            if ($inheritId === $parentId) {

                return true;

            }

        }

        return false;

    }

    /**

     * Removes a Resource and all of its children

     *

     * The $resource parameter can either be a Resource or a Resource identifier.

     *

     * @param  Zend_Acl_Resource_Interface|string $resource

     * @throws Zend_Acl_Exception

     * @return Zend_Acl Provides a fluent interface

     */

    public function remove($resource)

    {

        try {

            $resourceId = $this->get($resource)->getResourceId();

        } catch (Zend_Acl_Exception $e) {

            require_once 'Zend/Acl/Exception.php';

            throw new Zend_Acl_Exception($e->getMessage(), $e->getCode(), $e);