Public Member Functions
	addRole ($role, $parents=null)
	Adds a Role having an identifier unique to the registry.

	getRole ($role)
	Returns the identified Role.

	hasRole ($role)
	Returns true if and only if the Role exists in the registry.

	inheritsRole ($role, $inherit, $onlyParents=false)
	Returns true if and only if $role inherits from $inherit.

	removeRole ($role)
	Removes the Role from the registry.

	removeRoleAll ()
	Removes all Roles from the registry.

	addResource ($resource, $parent=null)
	Adds a Resource having an identifier unique to the ACL.

	add (Zend_Acl_Resource_Interface $resource, $parent=null)
	Adds a Resource having an identifier unique to the ACL.

	get ($resource)
	Returns the identified Resource.

	has ($resource)
	Returns true if and only if the Resource exists in the ACL.

	inherits ($resource, $inherit, $onlyParent=false)
	Returns true if and only if $resource inherits from $inherit.

	remove ($resource)
	Removes a Resource and all of its children.

	removeAll ()
	Removes all Resources.

	allow ($roles=null, $resources=null, $privileges=null, Zend_Acl_Assert_Interface $assert=null)
	Adds an "allow" rule to the ACL.

	deny ($roles=null, $resources=null, $privileges=null, Zend_Acl_Assert_Interface $assert=null)
	Adds a "deny" rule to the ACL.

	removeAllow ($roles=null, $resources=null, $privileges=null)
	Removes "allow" permissions from the ACL.

	removeDeny ($roles=null, $resources=null, $privileges=null)
	Removes "deny" restrictions from the ACL.

	setRule ($operation, $type, $roles=null, $resources=null, $privileges=null, Zend_Acl_Assert_Interface $assert=null)
	Performs operations on ACL rules.

	isAllowed ($role=null, $resource=null, $privilege=null)
	Returns true if and only if the Role has access to the Resource.

	getRegisteredRoles ()

	getRoles ()
	Returns an array of registered roles.

	getResources ()

Public Attributes
const	TYPE_ALLOW = 'TYPE_ALLOW'
	Rule type: allow.

const	TYPE_DENY = 'TYPE_DENY'
	Rule type: deny.

const	OP_ADD = 'OP_ADD'
	Rule operation: add.

const	OP_REMOVE = 'OP_REMOVE'
	Rule operation: remove.

Protected Member Functions
	_getRoleRegistry ()
	Returns the Role registry for this ACL.

	_roleDFSAllPrivileges (Zend_Acl_Role_Interface $role, Zend_Acl_Resource_Interface $resource=null)
	Performs a depth-first search of the Role DAG, starting at $role, in order to find a rule allowing/denying $role access to all privileges upon $resource.

	_roleDFSVisitAllPrivileges (Zend_Acl_Role_Interface $role, Zend_Acl_Resource_Interface $resource=null, &$dfs=null)
	Visits an $role in order to look for a rule allowing/denying $role access to all privileges upon $resource.

	_roleDFSOnePrivilege (Zend_Acl_Role_Interface $role, Zend_Acl_Resource_Interface $resource=null, $privilege=null)
	Performs a depth-first search of the Role DAG, starting at $role, in order to find a rule allowing/denying $role access to a $privilege upon $resource.

	_roleDFSVisitOnePrivilege (Zend_Acl_Role_Interface $role, Zend_Acl_Resource_Interface $resource=null, $privilege=null, &$dfs=null)
	Visits an $role in order to look for a rule allowing/denying $role access to a $privilege upon $resource.

	_getRuleType (Zend_Acl_Resource_Interface $resource=null, Zend_Acl_Role_Interface $role=null, $privilege=null)
	Returns the rule type associated with the specified Resource, Role, and privilege combination.

&	_getRules (Zend_Acl_Resource_Interface $resource=null, Zend_Acl_Role_Interface $role=null, $create=false)
	Returns the rules associated with a Resource and a Role, or null if no such rules exist.

Protected Attributes
	$_roleRegistry = null

	$_resources = array()

	$_isAllowedRole = null

	$_isAllowedResource = null

	$_isAllowedPrivilege = null

	$_rules

Member Function Documentation

_getRoleRegistry ( )

protected

Returns the Role registry for this ACL.

If no Role registry has been created yet, a new default Role registry is created and returned.

Returns: Zend_Acl_Role_Registry

& _getRules	(	Zend_Acl_Resource_Interface	$resource = `null`,
		Zend_Acl_Role_Interface	$role = `null`,
			$create = `false`
	)

protected

Returns the rules associated with a Resource and a Role, or null if no such rules exist.

If either $resource or $role is null, this means that the rules returned are for all Resources or all Roles, respectively. Both can be null to return the default rule set for all Resources and all Roles.

If the $create parameter is true, then a rule set is first created and then returned to the caller.

Parameters

Zend_Acl_Resource_Interface	$resource
Zend_Acl_Role_Interface	$role
boolean	$create

Returns: array|null

_getRuleType	(	Zend_Acl_Resource_Interface	$resource = `null`,
		Zend_Acl_Role_Interface	$role = `null`,
			$privilege = `null`
	)

protected

Returns the rule type associated with the specified Resource, Role, and privilege combination.

If a rule does not exist or its attached assertion fails, which means that the rule is not applicable, then this method returns null. Otherwise, the rule type applies and is returned as either TYPE_ALLOW or TYPE_DENY.

If $resource or $role is null, then this means that the rule must apply to all Resources or Roles, respectively.

If $privilege is null, then the rule must apply to all privileges.

If all three parameters are null, then the default ACL rule type is returned, based on whether its assertion method passes.

Parameters

Zend_Acl_Resource_Interface	$resource
Zend_Acl_Role_Interface	$role
string	$privilege

Returns: string|null

_roleDFSAllPrivileges	(	Zend_Acl_Role_Interface	$role,
		Zend_Acl_Resource_Interface	$resource = `null`
	)

protected

Performs a depth-first search of the Role DAG, starting at $role, in order to find a rule allowing/denying $role access to all privileges upon $resource.

This method returns true if a rule is found and allows access. If a rule exists and denies access, then this method returns false. If no applicable rule is found, then this method returns null.

Parameters

Zend_Acl_Role_Interface	$role
Zend_Acl_Resource_Interface	$resource

Returns: boolean|null

_roleDFSOnePrivilege	(	Zend_Acl_Role_Interface	$role,
		Zend_Acl_Resource_Interface	$resource = `null`,
			$privilege = `null`
	)

protected

Performs a depth-first search of the Role DAG, starting at $role, in order to find a rule allowing/denying $role access to a $privilege upon $resource.

This method returns true if a rule is found and allows access. If a rule exists and denies access, then this method returns false. If no applicable rule is found, then this method returns null.

Parameters

Zend_Acl_Role_Interface	$role
Zend_Acl_Resource_Interface	$resource
string	$privilege

Returns: boolean|null

Exceptions

Zend_Acl_Exception

See Also: Zend_Acl_Exception

_roleDFSVisitAllPrivileges	(	Zend_Acl_Role_Interface	$role,
		Zend_Acl_Resource_Interface	$resource = `null`,
		&	$dfs = `null`
	)

protected

Visits an $role in order to look for a rule allowing/denying $role access to all privileges upon $resource.

This method returns true if a rule is found and allows access. If a rule exists and denies access, then this method returns false. If no applicable rule is found, then this method returns null.

This method is used by the internal depth-first search algorithm and may modify the DFS data structure.

Parameters

Zend_Acl_Role_Interface	$role
Zend_Acl_Resource_Interface	$resource
array	$dfs

Returns: boolean|null

Exceptions

Zend_Acl_Exception

See Also: Zend_Acl_Exception

_roleDFSVisitOnePrivilege	(	Zend_Acl_Role_Interface	$role,
		Zend_Acl_Resource_Interface	$resource = `null`,
			$privilege = `null`,
		&	$dfs = `null`
	)

protected

Visits an $role in order to look for a rule allowing/denying $role access to a $privilege upon $resource.

This method returns true if a rule is found and allows access. If a rule exists and denies access, then this method returns false. If no applicable rule is found, then this method returns null.

This method is used by the internal depth-first search algorithm and may modify the DFS data structure.

Parameters

Zend_Acl_Role_Interface	$role
Zend_Acl_Resource_Interface	$resource
string	$privilege
array	$dfs

Returns: boolean|null

Exceptions

Zend_Acl_Exception

See Also: Zend_Acl_Exception; Zend_Acl_Exception

add	(	Zend_Acl_Resource_Interface	$resource,
			$parent = `null`
	)

Adds a Resource having an identifier unique to the ACL.

The $parent parameter may be a reference to, or the string identifier for, the existing Resource from which the newly added Resource will inherit.

Deprecated:: in version 1.9.1 and will be available till 2.0. New code should use addResource() instead.

Parameters

Zend_Acl_Resource_Interface	$resource
Zend_Acl_Resource_Interface \| string	$parent

Exceptions

Zend_Acl_Exception

Returns: Zend_Acl Provides a fluent interface

addResource	(	$resource,
		$parent = `null`
	)

Adds a Resource having an identifier unique to the ACL.

The $parent parameter may be a reference to, or the string identifier for, the existing Resource from which the newly added Resource will inherit.

Parameters

Zend_Acl_Resource_Interface \| string	$resource
Zend_Acl_Resource_Interface \| string	$parent

Exceptions

Zend_Acl_Exception

Returns: Zend_Acl Provides a fluent interface

addRole	(	$role,
		$parents = `null`
	)

Adds a Role having an identifier unique to the registry.

The $parents parameter may be a reference to, or the string identifier for, a Role existing in the registry, or $parents may be passed as an array of these - mixing string identifiers and objects is ok - to indicate the Roles from which the newly added Role will directly inherit.

In order to resolve potential ambiguities with conflicting rules inherited from different parents, the most recently added parent takes precedence over parents that were previously added. In other words, the first parent added will have the least priority, and the last parent added will have the highest priority.

Parameters

Zend_Acl_Role_Interface \| string	$role
Zend_Acl_Role_Interface \| string \| array	$parents	Zend_Acl_Role_Registry::add()

Returns: Zend_Acl Provides a fluent interface

allow	(		$roles = `null`,
			$resources = `null`,
			$privileges = `null`,
		Zend_Acl_Assert_Interface	$assert = `null`
	)

Adds an "allow" rule to the ACL.

Parameters

Zend_Acl_Role_Interface \| string \| array	$roles
Zend_Acl_Resource_Interface \| string \| array	$resources
string \| array	$privileges
Zend_Acl_Assert_Interface	$assert	Zend_Acl::setRule()

Returns: Zend_Acl Provides a fluent interface

deny	(		$roles = `null`,
			$resources = `null`,
			$privileges = `null`,
		Zend_Acl_Assert_Interface	$assert = `null`
	)

Adds a "deny" rule to the ACL.

Parameters

Zend_Acl_Role_Interface \| string \| array	$roles
Zend_Acl_Resource_Interface \| string \| array	$resources
string \| array	$privileges
Zend_Acl_Assert_Interface	$assert	Zend_Acl::setRule()

Returns: Zend_Acl Provides a fluent interface

get ( $resource )

Returns the identified Resource.

The $resource parameter can either be a Resource or a Resource identifier.

Parameters

Zend_Acl_Resource_Interface | string $resource

Exceptions

Zend_Acl_Exception

Returns: Zend_Acl_Resource_Interface

getRegisteredRoles ( )

Returns: array of registered roles (Deprecated)

Deprecated:: Deprecated since version 1.10 (December 2009)

getResources ( )

Returns: array of registered resources

getRole ( $role )

Returns the identified Role.

The $role parameter can either be a Role or Role identifier.

Parameters

Zend_Acl_Role_Interface | string $role Zend_Acl_Role_Registry::get()

Returns: Zend_Acl_Role_Interface

getRoles ( )

Returns an array of registered roles.

Note that this method does not return instances of registered roles, but only the role identifiers.

Returns: array of registered roles

has ( $resource )

Returns true if and only if the Resource exists in the ACL.

The $resource parameter can either be a Resource or a Resource identifier.

Parameters

Zend_Acl_Resource_Interface | string $resource

Returns: boolean

hasRole ( $role )

Returns true if and only if the Role exists in the registry.

The $role parameter can either be a Role or a Role identifier.

Parameters

Zend_Acl_Role_Interface | string $role Zend_Acl_Role_Registry::has()

Returns: boolean

inherits	(	$resource,
		$inherit,
		$onlyParent = `false`
	)

Returns true if and only if $resource inherits from $inherit.

Both parameters may be either a Resource or a Resource identifier. If $onlyParent is true, then $resource must inherit directly from $inherit in order to return true. By default, this method looks through the entire inheritance tree to determine whether $resource inherits from $inherit through its ancestor Resources.

Parameters

Zend_Acl_Resource_Interface \| string	$resource
Zend_Acl_Resource_Interface \| string	$inherit
boolean	$onlyParent

Exceptions

Zend_Acl_Resource_Registry_Exception

Returns: boolean

inheritsRole	(	$role,
		$inherit,
		$onlyParents = `false`
	)

Returns true if and only if $role inherits from $inherit.

Both parameters may be either a Role or a Role identifier. If $onlyParents is true, then $role must inherit directly from $inherit in order to return true. By default, this method looks through the entire inheritance DAG to determine whether $role inherits from $inherit through its ancestor Roles.

Parameters

Zend_Acl_Role_Interface \| string	$role
Zend_Acl_Role_Interface \| string	$inherit
boolean	$onlyParents	Zend_Acl_Role_Registry::inherits()

Returns: boolean

isAllowed	(	$role = `null`,
		$resource = `null`,
		$privilege = `null`
	)

Returns true if and only if the Role has access to the Resource.

The $role and $resource parameters may be references to, or the string identifiers for, an existing Resource and Role combination.

If either $role or $resource is null, then the query applies to all Roles or all Resources, respectively. Both may be null to query whether the ACL has a "blacklist" rule (allow everything to all). By default, Zend_Acl creates a "whitelist" rule (deny everything to all), and this method would return false unless this default has been overridden (i.e., by executing $acl->allow()).

If a $privilege is not provided, then this method returns false if and only if the Role is denied access to at least one privilege upon the Resource. In other words, this method returns true if and only if the Role is allowed all privileges on the Resource.

This method checks Role inheritance using a depth-first traversal of the Role registry. The highest priority parent (i.e., the parent most recently added) is checked first, and its respective parents are checked similarly before the lower-priority parents of the Role are checked.

Parameters

Zend_Acl_Role_Interface \| string	$role
Zend_Acl_Resource_Interface \| string	$resource
string	$privilege	Zend_Acl::get() Zend_Acl_Role_Registry::get()

Returns: boolean

remove ( $resource )

Removes a Resource and all of its children.

The $resource parameter can either be a Resource or a Resource identifier.

Parameters

Zend_Acl_Resource_Interface | string $resource

Exceptions

Zend_Acl_Exception

Returns: Zend_Acl Provides a fluent interface

removeAll ( )

Removes all Resources.

Returns: Zend_Acl Provides a fluent interface

removeAllow	(	$roles = `null`,
		$resources = `null`,
		$privileges = `null`
	)

Removes "allow" permissions from the ACL.

Parameters

Zend_Acl_Role_Interface \| string \| array	$roles
Zend_Acl_Resource_Interface \| string \| array	$resources
string \| array	$privileges	Zend_Acl::setRule()

Returns: Zend_Acl Provides a fluent interface

removeDeny	(	$roles = `null`,
		$resources = `null`,
		$privileges = `null`
	)

Removes "deny" restrictions from the ACL.

Parameters

Zend_Acl_Role_Interface \| string \| array	$roles
Zend_Acl_Resource_Interface \| string \| array	$resources
string \| array	$privileges	Zend_Acl::setRule()

Returns: Zend_Acl Provides a fluent interface

removeRole ( $role )

Removes the Role from the registry.

The $role parameter can either be a Role or a Role identifier.

Parameters

Zend_Acl_Role_Interface | string $role Zend_Acl_Role_Registry::remove()

Returns: Zend_Acl Provides a fluent interface

removeRoleAll ( )

Removes all Roles from the registry.

Zend_Acl_Role_Registry::removeAll()

Returns: Zend_Acl Provides a fluent interface

setRule	(		$operation,
			$type,
			$roles = `null`,
			$resources = `null`,
			$privileges = `null`,
		Zend_Acl_Assert_Interface	$assert = `null`
	)

Performs operations on ACL rules.

The $operation parameter may be either OP_ADD or OP_REMOVE, depending on whether the user wants to add or remove a rule, respectively:

OP_ADD specifics:

A rule is added that would allow one or more Roles access to [certain $privileges upon] the specified Resource(s).

OP_REMOVE specifics:

The rule is removed only in the context of the given Roles, Resources, and privileges. Existing rules to which the remove operation does not apply would remain in the ACL.

The $type parameter may be either TYPE_ALLOW or TYPE_DENY, depending on whether the rule is intended to allow or deny permission, respectively.

The $roles and $resources parameters may be references to, or the string identifiers for, existing Resources/Roles, or they may be passed as arrays of these - mixing string identifiers and objects is ok - to indicate the Resources and Roles to which the rule applies. If either $roles or $resources is null, then the rule applies to all Roles or all Resources, respectively. Both may be null in order to work with the default rule of the ACL.

The $privileges parameter may be used to further specify that the rule applies only to certain privileges upon the Resource(s) in question. This may be specified to be a single privilege with a string, and multiple privileges may be specified as an array of strings.

If $assert is provided, then its assert() method must return true in order for the rule to apply. If $assert is provided with $roles, $resources, and $privileges all equal to null, then a rule having a type of:

TYPE_ALLOW will imply a type of TYPE_DENY, and

TYPE_DENY will imply a type of TYPE_ALLOW

when the rule's assertion fails. This is because the ACL needs to provide expected behavior when an assertion upon the default ACL rule fails.

Parameters

string	$operation
string	$type
Zend_Acl_Role_Interface \| string \| array	$roles
Zend_Acl_Resource_Interface \| string \| array	$resources
string \| array	$privileges
Zend_Acl_Assert_Interface	$assert

Exceptions

Zend_Acl_Exception

Zend_Acl_Role_Registry::get() Zend_Acl::get()

Returns: Zend_Acl Provides a fluent interface

since null (all resources) was passed to this setRule() call, we need clean up all the rules for the global allResources, as well as the indivually set resources (per privilege as well)

Member Data Documentation

$_isAllowedPrivilege = null

protected

$_isAllowedResource = null

protected

$_isAllowedRole = null

protected

$_resources = array()

protected

$_roleRegistry = null

protected

$_rules

protected

Initial value:

= array(
        'allResources' => array(
            'allRoles' => array(
                'allPrivileges' => array(
                    'type'   => self::TYPE_DENY,
                    'assert' => null
                    ),
                'byPrivilegeId' => array()
                ),
            'byRoleId' => array()
            ),
        'byResourceId' => array()
        )

const OP_ADD = 'OP_ADD'

Rule operation: add.

const OP_REMOVE = 'OP_REMOVE'

Rule operation: remove.

const TYPE_ALLOW = 'TYPE_ALLOW'

Rule type: allow.

const TYPE_DENY = 'TYPE_DENY'

Rule type: deny.

Public Member Functions

Public Attributes

Protected Member Functions

Protected Attributes

Member Function Documentation

Member Data Documentation