106 lines
3.1 KiB
PHP
106 lines
3.1 KiB
PHP
<?php
|
|
|
|
namespace App\Lib\PolicySystem;
|
|
|
|
use App\Models\User;
|
|
use App\Lib\PolicySystem\StaticRules as SR;
|
|
use Illuminate\Auth\Access\Response;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Support\Facades\Log;
|
|
|
|
class RootPolicy
|
|
{
|
|
|
|
protected $policy = null;
|
|
|
|
protected $policies = null;
|
|
|
|
public function __construct()
|
|
{
|
|
$cls = \explode('\\', \get_called_class());
|
|
$this->policy = \strtolower(\str_replace('Policy', '', \end($cls)));
|
|
}
|
|
|
|
protected function actionPolicy(string $method, string $policy, User $user, Model $model = null)
|
|
{
|
|
$this->setPolicies($user, $model);
|
|
$ctx = [$policy, $user, $model];
|
|
|
|
if (!$this->hasPolicy($policy)) {
|
|
$m = __('Unhandled policy ":policy"', ['policy' => $policy]);
|
|
Log::critical($m, $ctx);
|
|
return $this->deny($m);
|
|
}
|
|
|
|
if (!is_array($this->policies[$policy])) {
|
|
$m = __('Policy ":policy" has to be array', ['policy' => $policy]);
|
|
Log::critical($m, $ctx);
|
|
return $this->deny($m);
|
|
}
|
|
|
|
// Policy method exists
|
|
if (!array_key_exists($method, $this->policies[$policy])) {
|
|
$m = __('Unhandled policy ":policy" for action ":action"', ['policy' => $policy, 'action' => $method]);
|
|
Log::critical($m, $ctx);
|
|
return $this->deny($m);
|
|
}
|
|
|
|
// Call policy method
|
|
if (Sr::handle($this->policies[$policy][$method], $user, $model)) {
|
|
return $this->allow();
|
|
} else {
|
|
$m = __('Policy ":policy" for action ":action" denied :onmodel', [
|
|
'policy' => $policy,
|
|
'action' => $method,
|
|
'onmodel' => $model ? get_class($model) : ''
|
|
]);
|
|
if (config('app.policyDebug')) {
|
|
Log::debug(sprintf("%s user => %s model => %s", $m, $user, $model), $ctx);
|
|
}
|
|
return $this->deny($m);
|
|
}
|
|
|
|
$m = __('Unhandled policy case on resource ":method"', ['method' => $method]);
|
|
Log::critical($m, $ctx);
|
|
return $this->deny();
|
|
}
|
|
|
|
/**
|
|
** Do the magic calling Root policy from any policy
|
|
*/
|
|
public function __call($method, $args)
|
|
{
|
|
return call_user_func_array([$this, 'actionPolicy'], array_merge([$method, $this->policy], $args));
|
|
}
|
|
|
|
private function hasPolicy(string $policy)
|
|
{
|
|
return array_key_exists($policy, $this->policies);
|
|
}
|
|
|
|
/**
|
|
* Allow action for the user
|
|
*
|
|
* @param string|null $message
|
|
* @return \Illuminate\Auth\Access\Response
|
|
*/
|
|
protected function allow(?string $message = null)
|
|
{
|
|
return Response::allow($message);
|
|
}
|
|
|
|
/**
|
|
* Deny action for the user
|
|
*
|
|
* @param string|null $message
|
|
* @param mixed $code
|
|
* @return \Illuminate\Auth\Access\Response
|
|
*/
|
|
protected function deny(?string $message = null, $code = null)
|
|
{
|
|
if (!$message) {
|
|
$message = __('This action is not allowed to you for this resource.');
|
|
}
|
|
return Response::deny($message, $code);
|
|
}
|
|
}
|