[Upgrade] New api/core/Request Authentication management (possibility to combine permissions ('or' and 'and' behaviour))
This commit is contained in:
xdrm-brackets
parent
a7d8530ec7
commit
fa0b0a956e
|
|
@ -63,7 +63,6 @@
|
|||
$_SESSION['ADMIN'] = [];
|
||||
}
|
||||
|
||||
|
||||
/* (4) On vérifie l'authentification par BDD
|
||||
---------------------------------------------------------*/
|
||||
if( !self::deepCheck() ){
|
||||
|
|
@ -81,7 +80,7 @@
|
|||
*
|
||||
*
|
||||
*/
|
||||
public static function deepCheck(){
|
||||
private static function deepCheck(){
|
||||
|
||||
/* [1] Si aucune authentification
|
||||
=========================================================*/
|
||||
|
|
@ -164,18 +163,58 @@
|
|||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/* VERIFICATION DES ACCES EN FONCTION DE PERMISSIONS ATTENDUES
|
||||
*
|
||||
* @module<String> Module concerné
|
||||
* @expected<array> Liste des permissions attendues
|
||||
* @expected<array> Liste de listes de combinaisons de permissions attendues
|
||||
*
|
||||
* @return error<Error> Si FALSE, pas la permission, sinon si
|
||||
*
|
||||
*/
|
||||
public static function permission($module, $expected){
|
||||
/* [0] Mise à jour de l'authentification
|
||||
|
||||
/* [1] Check format -> if not array of array(s) -> ERROR
|
||||
=========================================================*/
|
||||
// self::check();
|
||||
/* (1) If not array of array(s) -> ERROR*/
|
||||
foreach($expected as $permissions)
|
||||
if( !is_array($permissions) )
|
||||
return new Error(Err::FormatError);
|
||||
|
||||
|
||||
/* [2] Foreach each set of permission
|
||||
=========================================================*/
|
||||
foreach($expected as $permission_group){
|
||||
|
||||
/* If granted -> don't go further */
|
||||
if( self::check_permission_group($module, $permission_group) == Err::Success )
|
||||
return new Error(Err::Success);
|
||||
|
||||
}
|
||||
|
||||
|
||||
/* [3] By default return `PermissionError`
|
||||
=========================================================*/
|
||||
return new Error(Err::PermissionError);
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
/* VERIFICATION DES ACCES EN FONCTION DE PERMISSIONS ATTENDUES
|
||||
*
|
||||
* @module<String> Module concerné
|
||||
* @expected<array> Liste des permissions attendues
|
||||
*
|
||||
* @return error<int> Err:: error constants
|
||||
*
|
||||
*/
|
||||
private static function check_permission_group($module, $expected){
|
||||
|
||||
|
||||
/* [1] Gestion de l'AUTH (authentification)
|
||||
|
|
@ -184,17 +223,17 @@
|
|||
/* (1) Si entrepot requis, mais manquant
|
||||
---------------------------------------------------------*/
|
||||
if( in_array('warehouse', $expected) && self::auth() < 1 )
|
||||
return new Error(Err::PermissionError);
|
||||
return Err::PermissionError;
|
||||
|
||||
/* (2) Si admin requis, mais manquant
|
||||
---------------------------------------------------------*/
|
||||
if( in_array('admin', $expected) && self::auth() < 2 )
|
||||
return new Error(Err::PermissionError);
|
||||
return Err::PermissionError;
|
||||
|
||||
/* (3) Si SATS requis, mais manquant
|
||||
---------------------------------------------------------*/
|
||||
if( in_array('sats', $expected) && self::auth() < 3 )
|
||||
return new Error(Err::TokenError);
|
||||
return Err::TokenError;
|
||||
|
||||
/* (4) On retire 'warehouse', 'admin' et 'sats' de @expected
|
||||
---------------------------------------------------------*/
|
||||
|
|
@ -212,7 +251,7 @@
|
|||
foreach($expected as $permission)
|
||||
// Si il manque au minimum une permission, on retourne FALSE
|
||||
if( !in_array($permission, $_SESSION['PERM']) )
|
||||
return new Error(Err::PermissionError);
|
||||
return Err::PermissionError;
|
||||
|
||||
|
||||
/* [3] Vérification que le module est actif pour l'entrepot
|
||||
|
|
@ -228,12 +267,12 @@
|
|||
|
||||
/* (3) Si aucune autorisation et pas module "Default" */
|
||||
if( !$allowedModule && !$defaultModule )
|
||||
return new Error(Err::DisabledModule);
|
||||
return Err::DisabledModule;
|
||||
|
||||
|
||||
/* [4] Si on a toutes les permissions requises
|
||||
=========================================================*/
|
||||
return new Error(Err::Success);
|
||||
return Err::Success;
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -3,20 +3,20 @@
|
|||
"module": {
|
||||
"POST::method": {
|
||||
"description": "Test de l'API",
|
||||
"permissions": ["warehouse"],
|
||||
"permissions": [["warehouse"]],
|
||||
"parameters": {}
|
||||
},
|
||||
|
||||
"POST::markdown": {
|
||||
"description": "Retourne une description en markdown des différents modules de l'API",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"options": { "download": true },
|
||||
"parameters": {}
|
||||
},
|
||||
|
||||
"POST::apiBlueprint": {
|
||||
"description": "Retourne une documentation de l'API au format API Blueprint.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"options": { "download": true },
|
||||
"parameters": {}
|
||||
}
|
||||
|
|
@ -27,7 +27,7 @@
|
|||
|
||||
"POST::call_log": {
|
||||
"description": "Upload d'un journal d'appel au format .xml. Retour des données de call_log/unserialize",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"file": { "description": "Fichier du journal d'appel.", "type": "FILE" }
|
||||
},
|
||||
|
|
@ -44,7 +44,7 @@
|
|||
|
||||
"POST::multiple": {
|
||||
"description": "Download des données relatives aux sujets donnés.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"options": { "download": true },
|
||||
"parameters": {
|
||||
"subjects": { "description": "Identifiants des sujets d'enquêtes à intégrer.", "type": "array<id>", "optional": true },
|
||||
|
|
@ -72,7 +72,7 @@
|
|||
|
||||
"POST::admin": {
|
||||
"description": "Connexion de second niveau : administrateur.",
|
||||
"permissions": ["warehouse"],
|
||||
"permissions": [[["warehouse"]]],
|
||||
"parameters": {
|
||||
"username": { "description": "Identifiant de l'administrateur.", "type": "varchar(1,30,alphanumeric)" },
|
||||
"password": { "description": "Mot de passe de l'administrateur'.", "type": "text" }
|
||||
|
|
@ -88,7 +88,7 @@
|
|||
|
||||
"POST::create": {
|
||||
"description": "Création d'un nouvel utilisateur.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"code": { "description": "Code RFID de l'utilisateur.", "type": "rfid" },
|
||||
"username": { "description": "Identifiant de l'utilisateur.", "type": "varchar(1,30,alphanumeric)" },
|
||||
|
|
@ -103,7 +103,7 @@
|
|||
|
||||
"POST::link": {
|
||||
"description": "Ajout d'un utilisateur à un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe auquel rattacher.", "type": "id" },
|
||||
"id_user": { "description": "UID de l'utilisateur à rattacher.", "type": "id" }
|
||||
|
|
@ -114,7 +114,7 @@
|
|||
|
||||
"POST::unlink": {
|
||||
"description": "Retrait d'un utilisateur d'un groupe",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe auquel détacher.", "type": "id" },
|
||||
"id_user": { "description": "UID de l'utilisateur à détacher.", "type": "id" }
|
||||
|
|
@ -124,7 +124,7 @@
|
|||
|
||||
"POST::search": {
|
||||
"description": "Recherche d'un utilisateur par mots-clés.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"keywords": { "description": "Mots-clés de la recherche.", "type": "text" }
|
||||
},
|
||||
|
|
@ -135,7 +135,7 @@
|
|||
|
||||
"POST::getAll": {
|
||||
"description": "Liste de tous les utilisateurs",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {},
|
||||
"output": {
|
||||
"users": { "description": "Liste de tous les utilisateurs.", "type": "array<array<mixed>>" }
|
||||
|
|
@ -144,7 +144,7 @@
|
|||
|
||||
"POST::getById": {
|
||||
"description": "Retourne un utilisateur spécifique.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_user": { "description": "UID de l'utilisateur.", "type": "id" }
|
||||
},
|
||||
|
|
@ -155,7 +155,7 @@
|
|||
|
||||
"POST::getByCode": {
|
||||
"description": "Retourne un utilisateur de Code RFID donné.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"code": { "description": "Code RFID de l'utilisateur.", "type": "rfid" }
|
||||
},
|
||||
|
|
@ -166,7 +166,7 @@
|
|||
|
||||
"POST::getByUsername": {
|
||||
"description": "Retourne un utilisateur d'identifiant donné.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"username": { "description": "Identifiant de l'utilisateur.", "type": "varchar(1,30,alphanumeric)" }
|
||||
},
|
||||
|
|
@ -177,7 +177,7 @@
|
|||
|
||||
"POST::getClusters": {
|
||||
"description": "Retourne les groupes d'un utilisateur.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_user": { "description": "UID de l'utilisateur.", "type": "id" }
|
||||
},
|
||||
|
|
@ -188,7 +188,7 @@
|
|||
|
||||
"POST::edit": {
|
||||
"description": "Modifie les attributs d'un utilisateur.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_user": { "description": "UID de l'utilisateur.", "type": "id" },
|
||||
"code": { "description": "Code RFID de l'utilisateur.", "type": "rfid", "optional": true },
|
||||
|
|
@ -207,7 +207,7 @@
|
|||
|
||||
"POST::delete": {
|
||||
"description": "Suppression d'un utilisateur.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_user": { "description": "UID de l'utilisateur.", "type": "id" }
|
||||
},
|
||||
|
|
@ -223,7 +223,7 @@
|
|||
|
||||
"POST::sync": {
|
||||
"description": "Synchronisation d'une machine.",
|
||||
"permissions": ["warehouse", "sats"],
|
||||
"permissions": [["sats"]],
|
||||
"parameters": {
|
||||
"data": { "description": "Données (dépendent des modules).", "type": "array<mixed>" }
|
||||
},
|
||||
|
|
@ -234,7 +234,7 @@
|
|||
|
||||
"POST::init": {
|
||||
"description": "Données d'initialisation d'une machine.",
|
||||
"permissions": ["warehouse"],
|
||||
"permissions": [["warehouse"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" },
|
||||
"token": { "description": "Initialisation du code d'accès évolutif", "type": "hash" },
|
||||
|
|
@ -247,7 +247,7 @@
|
|||
|
||||
"POST::create": {
|
||||
"description": "Création d'une nouvelle machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"name": { "description": "Nom de la machine.", "type": "varchar(1,30,letters)" }
|
||||
},
|
||||
|
|
@ -258,7 +258,7 @@
|
|||
|
||||
"POST::link": {
|
||||
"description": "Ajout d'une machine à un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" },
|
||||
"id_cluster": { "description": "UID du groupe de la machine.", "type": "id" }
|
||||
|
|
@ -268,7 +268,7 @@
|
|||
|
||||
"POST::unlink": {
|
||||
"description": "Retrait d'une machine d'un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" },
|
||||
"id_cluster": { "description": "UID du groupe de la machine.", "type": "id" }
|
||||
|
|
@ -278,7 +278,7 @@
|
|||
|
||||
"POST::search": {
|
||||
"description": "Recherche une machine par mots-clés.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"keywords": { "description": "Mots-clés de recherche de machine", "type": "text" }
|
||||
},
|
||||
|
|
@ -289,7 +289,7 @@
|
|||
|
||||
"POST::getAll": {
|
||||
"description": "Retourne la liste de toutes les machines.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {},
|
||||
"output": {
|
||||
"machines": { "description": "Liste de toutes les machines.", "type": "array<array<mixed>>" }
|
||||
|
|
@ -298,7 +298,7 @@
|
|||
|
||||
"POST::getById": {
|
||||
"description": "Retourne les données d'une machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" }
|
||||
},
|
||||
|
|
@ -309,7 +309,7 @@
|
|||
|
||||
"POST::getByName": {
|
||||
"description": "Retourne les données d'une machine de nom donné.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"name": { "description": "Nom de la machine.", "type": "varchar(1,30,letters)" }
|
||||
},
|
||||
|
|
@ -320,7 +320,7 @@
|
|||
|
||||
"POST::getClusters": {
|
||||
"description": "Retourne les groupes d'une machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" }
|
||||
},
|
||||
|
|
@ -331,7 +331,7 @@
|
|||
|
||||
"POST::edit": {
|
||||
"description": "Modifie les attributs d'une machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" },
|
||||
"name": { "description": "Nom de la machine.", "type": "varchar(1,30,letters)", "optional": true }
|
||||
|
|
@ -341,7 +341,7 @@
|
|||
|
||||
"POST::delete": {
|
||||
"description": "Supprime une machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine.", "type": "id" }
|
||||
},
|
||||
|
|
@ -352,7 +352,7 @@
|
|||
|
||||
"POST::getState": {
|
||||
"description": "Retourne l'état d'une machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "UID de la machine", "type": "id" }
|
||||
},
|
||||
|
|
@ -368,7 +368,7 @@
|
|||
|
||||
"POST::create": {
|
||||
"description": "Création d'un nouveau groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"name": { "description": "Nom du groupe.", "type": "varchar(1,30,letters)" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
|
|
@ -380,7 +380,7 @@
|
|||
|
||||
"POST::search": {
|
||||
"description": "Recherche d'un groupe par mots-clés.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"keywords": { "description": "Mots-clés de la recherche.", "type": "text" },
|
||||
"class": { "description": "Type de groupe.", "type": "id", "optional": true }
|
||||
|
|
@ -392,7 +392,7 @@
|
|||
|
||||
"POST::getAll": {
|
||||
"description": "Liste de tous les groupes",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
},
|
||||
|
|
@ -403,7 +403,7 @@
|
|||
|
||||
"POST::getById": {
|
||||
"description": "Retourne un groupe spécifique.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe.", "type": "id" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
|
|
@ -415,7 +415,7 @@
|
|||
|
||||
"POST::getByName": {
|
||||
"description": "Retourne un groupe de nom donné.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"name": { "description": "Nom du groupe.", "type": "varchar(1,30,letters)" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
|
|
@ -427,7 +427,7 @@
|
|||
|
||||
"POST::getMembers": {
|
||||
"description": "Retourne les membres d'un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe.", "type": "id" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
|
|
@ -439,7 +439,7 @@
|
|||
|
||||
"POST::edit": {
|
||||
"description": "Modifie le nom d'un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe.", "type": "id" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" },
|
||||
|
|
@ -452,7 +452,7 @@
|
|||
|
||||
"POST::delete": {
|
||||
"description": "Suppression d'un groupe.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_cluster": { "description": "UID du groupe.", "type": "id" },
|
||||
"class": { "description": "Type de groupe.", "type": "id" }
|
||||
|
|
@ -464,7 +464,7 @@
|
|||
|
||||
"POST::addPermission": {
|
||||
"description": "Ajout d'une permission",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_source": { "description": "Groupe d'utilisateur source.", "type": "id" },
|
||||
"id_target": { "description": "Groupe de machine cible.", "type": "id" },
|
||||
|
|
@ -475,7 +475,7 @@
|
|||
|
||||
"POST::remPermission": {
|
||||
"description": "Suppression d'une permission",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_source": { "description": "Groupe d'utilisateur source.", "type": "id" },
|
||||
"id_target": { "description": "Groupe de machine cible.", "type": "id" },
|
||||
|
|
@ -486,7 +486,7 @@
|
|||
|
||||
"POST::getPermissions": {
|
||||
"description": "Retourne la liste des permissions",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {},
|
||||
"output": {
|
||||
"permissions": { "description": "Liste des permissions", "type": "array" }
|
||||
|
|
@ -495,7 +495,7 @@
|
|||
|
||||
"POST::getAuthenticatedClusters": {
|
||||
"description": "Retourne les groupes d'utilisateurs ayant une action sur un groupe de machine.",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {
|
||||
"id_target": { "description": "Groupe de machine cible.", "type": "id" },
|
||||
"id_action": { "description": "Action en question.", "type": "id" }
|
||||
|
|
@ -510,7 +510,7 @@
|
|||
"historyDefault": {
|
||||
"POST::create": {
|
||||
"description": "Retourne l'historique complet",
|
||||
"permissions": ["admin", "sats"],
|
||||
"permissions": [["admin"], ["sats"]],
|
||||
"parameters": {
|
||||
"id_machine": { "description": "Machine UID", "type": "id" },
|
||||
"id_user": { "description": "User UID", "type": "id" },
|
||||
|
|
@ -521,7 +521,7 @@
|
|||
},
|
||||
"POST::getAll": {
|
||||
"description": "Retourne l'historique complet",
|
||||
"permissions": ["admin"],
|
||||
"permissions": [["admin"]],
|
||||
"parameters": {},
|
||||
"output": {
|
||||
"history": { "description": "Données de l'historique", "type": "array" }
|
||||
|
|
|
|||
Loading…
Reference in New Issue