source: trunk/bin/acl.cli.php @ 171

#!/usr/local/bin/php
<?php
/*
* acl.cli.php
* Code by Strangecode :: www.strangecode.com :: This document contains copyrighted information.
* @author   Quinn Comendant <quinn@strangecode.com>
* @version  1.0
* @since    14 Jun 2006 23:10:45
*/


/********************************************************************
* STARTUP
********************************************************************/

// Give them a fighting chance. Show the help message. ;P
if ($_SERVER['argc'] <= 1) {
    help();
}

// Make sure necessary files exist.
define('COMMON_BASE', realpath('.'));
$db_quth_file = COMMON_BASE . '/global/db_auth.inc.php';
if (!file_exists($db_quth_file)) {
    die(sprintf("%s error: the current directory must be common site directory (i.e. the parent directory of the document root) AND the global/db_auth.inc.php file must exist.\n", $_SERVER['argv'][0]));
}

if (fileowner($db_quth_file) != getmyuid()) {
    die(sprintf("%s error: you must execute this script as the owner of the web files.\n", $_SERVER['argv'][0]));
}

// Set include path.
ini_set('include_path', get_include_path()
    . PATH_SEPARATOR . COMMON_BASE
);


/********************************************************************
* CONFIG
********************************************************************/

// Include core libraries.
require_once 'codebase/lib/App.inc.php';
require_once 'codebase/lib/Utilities.inc.php';

$app =& App::getInstance('module_maker');
$app->setParam(array(
    'site_name' => 'ACL cli',
    'site_email' => 'codebase@strangecode.com',
    'enable_session' => false,
    'enable_db' => true,
    'db_always_debug' => false,
    'db_debug' => true,
    'db_die_on_failure' => true,
    'display_errors' => true,
    'error_reporting' => E_ALL,
    'log_file_priority' => LOG_DEBUG,
    'log_screen_priority' => LOG_NOTICE,
    'log_directory' => COMMON_BASE . '/log',
    'log_filename' => 'site_log',
));
require_once 'global/db_auth.inc.php';

// Start application-based functionality: database, session, environment, ini setup, etc.
// Most configuration parameters must be set before starting the App.
$app->start();

// Global DB object. Automatically pre-configured by $app->start().
$db =& DB::getInstance();

// ACL!
require_once 'codebase/lib/ACL.inc.php';
$acl =& ACL::getInstance();


/********************************************************************
* MAIN
********************************************************************/

$op = $_SERVER['argv'][1];
switch ($op) {
case 'list' :
$type = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
if (isset($type)) {
    listACL('root', $type);
} else {

    echo "\n_______________________Access Request Objects________________________\n\n";
    listACL('root', 'aro');                               
    echo "\n_______________________Access Control Objects________________________\n\n";
    listACL('root', 'aco');                               
    echo "\n______________________Access eXtension Objects_______________________\n\n";
    listACL('root', 'axo');
}
break;

case 'addaro' :
case 'addaco' :
case 'addaxo' :
    $object = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
    $parent = isset($_SERVER['argv'][3]) ? $_SERVER['argv'][3] : null;
    if (!isset($object)) {
        echo "'add*' commands require at least one argument. Try 'help' if you are lost.\n";
    }
    echo $acl->add($object, $parent, str_replace('add', '', $op)) ? "Ok\n" : "Error!\n";
    break;

case 'rmaro' :
case 'rmaco' :
case 'rmaxo' :
    $object = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
    if (!isset($object)) {
        echo "'add*' commands require at least one argument. Try 'help' if you are lost.\n";
    }
    echo $acl->remove($object, str_replace('rm', '', $op)) ? "Ok\n" : "Error!\n";
    break;

case 'grant' :
    $aro = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
    $aco = isset($_SERVER['argv'][3]) ? $_SERVER['argv'][3] : null;
    $axo = isset($_SERVER['argv'][4]) ? $_SERVER['argv'][4] : null;
    if (!isset($aro)) {
        echo "'grant' command require at least one argument. Try 'help' if you are lost.\n";
    }
    echo $acl->grant($aro, $aco, $axo) ? "Ok\n" : "Error!\n";
    break;

case 'revoke' :
    $aro = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
    $aco = isset($_SERVER['argv'][3]) ? $_SERVER['argv'][3] : null;
    $axo = isset($_SERVER['argv'][4]) ? $_SERVER['argv'][4] : null;
    if (!isset($aro)) {
        echo "'revoke' command require at least one argument. Try 'help' if you are lost.\n";
    }
    echo $acl->revoke($aro, $aco, $axo) ? "Ok\n" : "Error!\n";
    break;

case 'check' :
    $aro = isset($_SERVER['argv'][2]) ? $_SERVER['argv'][2] : null;
    $aco = isset($_SERVER['argv'][3]) ? $_SERVER['argv'][3] : null;
    $axo = isset($_SERVER['argv'][4]) ? $_SERVER['argv'][4] : null;
    if (!isset($aro)) {
        echo "'check' command require at least one argument. Try 'help' if you are lost.\n";
    }
    echo $acl->check($aro, $aco, $axo) ? "allow\n" : "deny\n";
    break;

case 'help' :
    help();
    break;

default :
    echo "'$op' is not an understood command. Try 'help' if you are lost.\n";
    break;
}


/********************************************************************
* FUNCTIONS
********************************************************************/

function help()
{
    ?>
Access Control List command line tool.

This script must be run in the common site directory (i.e. the parent
directory of the document root). DB credentials are retrieved from:
global/db_auth.inc.php so this file must exist. Further more this script
must be executed as the owner of the db_auth.inc.php file.

Three types of objects are managed by this interface: ARO - Access
Request Objects, ACO - Access Control Objects, and AXO - Access eXtention
Objects. These are most often used as a USER -> ACTION -> OBJECT model,
but can just as easily be SPICES -> CUISINES -> DISHES A privilege is
allowed if a user (ARO) can perform an action (ACO) on something (AXO).
For example, Bob can edit article 4. If the AXO if omitted, this becomes
"Bob can edit" (period).

Each access object is stored as a node in hierarchial tree structures. A
premission granted to a node is applied to all its children. If a child
node is specified a different permission that is more specific that
anything on the branch it will take precidence. If no permission is
specified, root is used for that object. Root, in this case, means
"anything" since it is at the top of all branches.

Usage: <?php echo $_SERVER['argv'][0]; ?> <command> [args]


<?php echo $_SERVER['argv'][0]; ?> list [aro | aco | axo]
<?php echo $_SERVER['argv'][0]; ?> addaro <aro_object> [parent]
<?php echo $_SERVER['argv'][0]; ?> addaco <aco_object> [parent]
<?php echo $_SERVER['argv'][0]; ?> addaxo <axo_object> [parent]
<?php echo $_SERVER['argv'][0]; ?> rmaro <aro_object>
<?php echo $_SERVER['argv'][0]; ?> rmaco <aco_object>
<?php echo $_SERVER['argv'][0]; ?> rmaxo <axo_object>
<?php echo $_SERVER['argv'][0]; ?> grant <aro_object> [aco_object] [axo_object]
<?php echo $_SERVER['argv'][0]; ?> revoke <aro_object> [aco_object] [axo_object]

For the add*, grant, and revoke commands, if any of the optional 
args are not provided, 'root' is assumed.

Strangecode :: www.strangecode.com
<?php
    die;
}


function listACL($root, $type)
{
    $app =& App::getInstance();
    $db =& DB::getInstance();
    
    switch ($type) {
    case 'aro' :
        $tbl = 'aro_tbl';
        break;
    case 'aco' :
        $tbl = 'aco_tbl';
        break;
    case 'axo' :
        $tbl = 'axo_tbl';
        break;
    default :
        $app->logMsg(sprintf('Invalid access object type: %s', $type), LOG_ERR, __FILE__, __LINE__);
        return false;
        break;
    }
    
    // Retrieve the left and right value of the $root node.
    $qid = $db->query("SELECT lft, rgt FROM $tbl WHERE name = '" . $db->escapeString($root) . "'");
    list($lft, $rgt) = mysql_fetch_row($qid);
    
    $depth = array();
    
    // Retrieve all descendants of the root node
    $qid = $db->query("SELECT name, lft, rgt, added_datetime FROM $tbl WHERE lft BETWEEN $lft AND $rgt ORDER BY lft ASC");
    while (list($name, $lft, $rgt, $added_datetime) = mysql_fetch_row($qid)) {
        // If the last element of $depth is less than the current rgt it means we finished with a set of children nodes.
        while (sizeof($depth) > 0 && end($depth) < $rgt) {
            array_pop($depth);
        }
    
        // Display indented node title.
        printf("%-20s %-5s %-5s %s\n", str_repeat('    ', sizeof($depth)) . $name, $lft, $rgt, $added_datetime);
        
        // Add this node to the stack.
        $depth[] = $rgt;
    }
}


?>