File Coverage

lib/Maypole/Plugin/Authorization.pm

Criterion	Covered	Total	%
statement	57	57	100.0
branch	12	14	85.7
condition	40	54	74.0
subroutine	8	8	100.0
pod	3	3	100.0
total	120	136	88.2

package Maypole::Plugin::Authorization;
use strict;
use warnings;

# This module provides role-based authorization for Maypole

our $VERSION = '0.10';

# 2005-01-27 djh v0.03	Modified get_authorized_* to make them work and
#			accept arguments, and improved docs
# 2005-01-28 djh v0.04	Added arg checking to get_authorized_* and an
# 			example for get_authorized_methods. Thanks to
#			Josef Chladek.
# 2005-02-08 djh v0.05	Improved error checking in authorize.
# 2005-08-20 djh v0.06	Improved docs suggested by Kieren Diment.
# 2005-08-20 djh v0.07	Added config options from Peter Speltz.
# 2005-08-22 djh v0.08	Added user_class default from Kieren Diment
# 2005-08-22 djh v0.09	Default {} if no config->auth
# 2005-08-24 djh v0.10	Allow entity other than model_class as requested
#			by Kieren Diment & Peter Speltz


#=======================================================================
#
# Initialization

Maypole::Config->mk_accessors('auth') unless Maypole::Config->can('auth');


# Code references to database queries could be cached at load time,
# except that Maypole::Application doesn't call our import function!

# Authorization checking query for use by authorize()
my $_cdbi_class;
my $_check_authorization;

sub _init_authorization_query {
    my $r = shift;

    # Build a SQL query that checks whether a given user_id is
    # authorized to invoke a particular method in a model_class
    # and add it to a class that can run SQL queries for us
    my $conf     = $r->config->auth || {};
    my $p_table  = $conf->{permission_table}  || 'permissions';
    my $ra_table = $conf->{role_assign_table} || 'role_assignments';
    my $user_fk  = $conf->{user_fk}	      || 'user_id';
    $_cdbi_class = $conf->{user_class}        || (ref $r).'::User';

    $_cdbi_class->set_sql(check_authorization =>
	"SELECT p.id FROM $p_table AS p, $ra_table AS r
	  WHERE r.$user_fk  = ?
	  AND   p.model_class = ?
	  AND  (p.method = ? OR p.method = '*')
	  AND   p.auth_role_id = r.auth_role_id
	  LIMIT 1");

    $_check_authorization = $_cdbi_class->can('sql_check_authorization');
}


# Query to find lists of authorized methods for get_authorized_classes()
my $_get_authorized_classes;

sub _init_get_authorized_classes {
    my $r = shift;

    my $conf     = $r->config->auth || {};
    my $p_table  = $conf->{permission_table}  || 'permissions';
    my $ra_table = $conf->{role_assign_table} || 'role_assignments';
    my $user_fk  = $conf->{user_fk}	      || 'user_id';
    $_cdbi_class = $conf->{user_class}        || (ref $r).'::User';

    $_cdbi_class->set_sql(get_authorized_classes =>
	"SELECT DISTINCT p.model_class FROM $p_table AS p, $ra_table AS r
	  WHERE r.$user_fk = ?
	  AND   p.auth_role_id = r.auth_role_id");

    $_get_authorized_classes =
	$_cdbi_class->can('sql_get_authorized_classes');
}


# Query to find lists of authorized methods for get_authorized_methods()
my $_get_authorized_methods;

sub _init_get_authorized_methods {
    my $r = shift;

    my $conf     = $r->config->auth || {};
    my $p_table  = $conf->{permission_table}  || 'permissions';
    my $ra_table = $conf->{role_assign_table} || 'role_assignments';
    my $user_fk  = $conf->{user_fk}	      || 'user_id';
    $_cdbi_class = $conf->{user_class}        || (ref $r).'::User';

    $_cdbi_class->set_sql(get_authorized_methods =>
	"SELECT p.method FROM $p_table AS p, $ra_table AS r
	  WHERE r.$user_fk = ?
	  AND   p.model_class = ?
	  AND   p.auth_role_id = r.auth_role_id");

    $_get_authorized_methods =
	 $_cdbi_class->can('sql_get_authorized_methods');
}


#=======================================================================

# Main permission-checking method

sub authorize {
    my ($self, $r, $entity) = @_;

    # Validate and extract values for permission check
    $entity	 ||= $r->model_class;
    return undef unless $r->user and $entity;
    my $userid     = $r->user->id;
    my $method     = $r->action;

    # Make sure the SQL query has been prepared, then check the permissions
    _init_authorization_query($r) unless $_check_authorization;
    return $_cdbi_class->sql_check_authorization->
				select_val($userid, $entity, $method);
}


# Auxiliary method for finding list of authorized classes

sub get_authorized_classes {
    my ($r, $userid) = @_;

    # Validate and extract parameters
    return unless $r->user or $userid;
    $userid ||= $r->user->id;

    # Make sure the SQL query has been prepared, then run it
    _init_get_authorized_classes($r) unless $_get_authorized_classes;
    my $sth = $_cdbi_class->sql_get_authorized_classes;
    $sth->execute($userid);
    return map { $_->[0] } @{$sth->fetchall_arrayref};
}


# Auxiliary method for finding list of authorized methods

sub get_authorized_methods {
    my ($r, $userid, $class) = @_;

    # Validate and extract parameters
    return unless $r->user or $userid;
    $userid ||= $r->user->id;
    $class  ||= $r->model_class;
    return unless $class;

    # Make sure the SQL query has been prepared, then run it
    _init_get_authorized_methods($r) unless $_get_authorized_methods;
    my $sth = $_cdbi_class->sql_get_authorized_methods;
    $sth->execute($userid, $class);
    return map { $_->[0] } @{$sth->fetchall_arrayref};
}

1;

__END__