265 lines
9.8 KiB
PHP
265 lines
9.8 KiB
PHP
<?php
|
|
|
|
class App_Controller_Plugin_Acl extends Zend_Controller_Plugin_Abstract
|
|
{
|
|
|
|
const AUTHORIZATION_HEADER = 'Authorization';
|
|
const MONGO_DB_NAME = 'MongoDBName';
|
|
|
|
const AUTH_TYPE_SECRET_ID = 'SECRET';
|
|
|
|
protected $_acl;
|
|
protected $_aclRestV1;
|
|
protected $_role;
|
|
protected $_auth;
|
|
protected $_genericModel;
|
|
protected $_configs;
|
|
protected $_ipManager;
|
|
|
|
public function __construct()
|
|
{
|
|
$this->_genericModel = new Application_Model_Generic();
|
|
$this->_auth = Zend_Auth::getInstance();
|
|
$this->_acl = new App_Model_Acl_Acl();
|
|
$this->_aclRestV1 = new App_Model_Acl_AclRestV1();
|
|
|
|
$this->_role = !$this->_auth->hasIdentity() ? 'unregistered' : $this->_auth->getIdentity()->role;
|
|
$this->_configs = new App_Service_ConfigManager();
|
|
$this->_ipManager = new App_Service_IpManager();
|
|
|
|
}
|
|
|
|
public function preDispatch(Zend_Controller_Request_Abstract $request)
|
|
{
|
|
|
|
//Gestione degli accessi separati per i vari moduli
|
|
/**
|
|
* V1 = Web Service di tipo REST per interfacciarsi verso lesterno [Accesso Tramite TOKEN]
|
|
* DEFAULT | AUTH: Accesso normale del sito
|
|
* ADMIN: Accesso solo per l'utente admin
|
|
*/
|
|
|
|
switch ($request->getModuleName()) {
|
|
//Il modulo default e auth non hanno bisogno di autenticazione quindi imposto user come 'unregistered' e vado avanti
|
|
case'default':
|
|
case'auth':
|
|
$this->_role = 'unregistered';
|
|
if (!$this->_acl->isAllowed($this->_role, $request->getModuleName())) {
|
|
$this->denyAccess();
|
|
}
|
|
return;
|
|
case 'admin':
|
|
case 'user':
|
|
case 'monitoring':
|
|
if (!$this->_acl->isAllowed($this->_role, $request->getModuleName())) {
|
|
$this->_auth->clearIdentity();
|
|
$this->_redirectLogin($request);
|
|
}
|
|
return;
|
|
case'v1':
|
|
//controllo se il web services non è offline
|
|
if ($this->_configs->get('interrutore_webservices_v1') == 'off' && !$this->_ipManager->allowedIp()) {
|
|
$this->_redirectOffline($request);
|
|
}
|
|
|
|
//controllo il web services ad accesso libero
|
|
$this->_role = 'unregistered';
|
|
if (!$this->_aclRestV1->isAllowed(trim($this->_role), $request->getControllerName())) {
|
|
//Se il controller non è abilitato all'accesso libero allora procedo con l'autenticazione server v1 tramite token
|
|
$this->accessoV1($request, $request->getHeader(self::AUTHORIZATION_HEADER));
|
|
} else {
|
|
if (Zend_Registry::get('ENABLE_MONGODB')) {
|
|
// controllo se settare il parametro per il nome DB nel caso non sono autenticato utilizzo un db mongo di default
|
|
$mongoDbName = $request->getHeader(self::MONGO_DB_NAME);
|
|
if ($mongoDbName) {
|
|
$mongoDbName = $this->_ipManager->getMongoDbName($mongoDbName);
|
|
$this->setMongoDbRegistryName($mongoDbName);
|
|
}
|
|
}
|
|
}
|
|
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
|
|
//Controllo i permessi prima sul modulo e poi sul controller in caso sia un webservices
|
|
if (!$this->_acl->isAllowed(trim($this->_role), $request->getModuleName())) {
|
|
$this->denyAccess();
|
|
} else {
|
|
switch ($request->getModuleName()) {
|
|
case'v1':
|
|
if (!$this->_aclRestV1->isAllowed(trim($this->_role), $request->getControllerName()))
|
|
$this->denyAccess();
|
|
break;
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
private function accessoV1(Zend_Controller_Request_Abstract $request, $token)
|
|
{
|
|
if (!$token) return $this->_redirectNoAuth($request);
|
|
|
|
//Controllo che nell'autorization header sia contenuto anche il metodo di autorizazzione lo scompongo e ottendo il codice
|
|
$authorizationHeaderParts = explode(' ', $token);
|
|
if (count($authorizationHeaderParts) > 1) {
|
|
$type = strtoupper($authorizationHeaderParts[0]);
|
|
$token = $authorizationHeaderParts[1];
|
|
} else {
|
|
$token = $authorizationHeaderParts[0];
|
|
}
|
|
|
|
$user = null;
|
|
switch ($type) {
|
|
case self::AUTH_TYPE_SECRET_ID:
|
|
$user = $this->authenticateV1SecretToken($token);
|
|
break;
|
|
default:
|
|
$user = $this->authenticateV1($token);
|
|
break;
|
|
}
|
|
|
|
// Salvo il token nel registry
|
|
Zend_Registry::set('TOKEN', $token);
|
|
|
|
if ($user != null)
|
|
$this->_role = $user['role'];
|
|
else
|
|
$this->_redirectTokenScaduto($request);
|
|
|
|
if (!$user['stato']) {
|
|
$this->_redirectDeactiveUserState($request);
|
|
}
|
|
|
|
if (Zend_Registry::get('ENABLE_MONGODB')) {
|
|
$mongoDbName = $this->_ipManager->getMongoDbName($user['NomeDB']);
|
|
if ($user['role'] === 'admin') {
|
|
$mongoDbName = $request->getHeader(self::MONGO_DB_NAME);
|
|
if (!$mongoDbName) {
|
|
$mongoDbName = $this->_ipManager->getMongoAdminDbName();
|
|
} else {
|
|
$mongoDbName = $this->_ipManager->getMongoDbName($mongoDbName);
|
|
}
|
|
}
|
|
|
|
$this->setMongoDbRegistryName($mongoDbName);
|
|
}
|
|
|
|
}
|
|
|
|
private function setMongoDbRegistryName($mongoDbName)
|
|
{
|
|
if (Zend_Registry::isRegistered(App_Model_Mongo_Adapter::MONGO_DB_ADAPTER_REG_NAME))
|
|
Zend_Registry::get(App_Model_Mongo_Adapter::MONGO_DB_ADAPTER_REG_NAME)->setDbname($mongoDbName);
|
|
else
|
|
Zend_Registry::set(App_Model_Mongo_Adapter::MONGO_DB_NAME, $mongoDbName);
|
|
}
|
|
|
|
private function authenticateV1($token)
|
|
{
|
|
$user = $this->_genericModel->getByColumnName('Users', 'token', $token, '=', true);
|
|
if (!$user) {
|
|
return null;
|
|
}
|
|
|
|
//Aggiornamento del campo UltimoAccesso
|
|
$this->_genericModel->update('Users', $user['id'], array('UltimoAccesso' => date('Y-m-d H:i:s')));
|
|
|
|
return $user;
|
|
}
|
|
|
|
private function authenticateV1SecretToken($token)
|
|
{
|
|
$user = $this->_genericModel->getByColumnName('Users', 'secret_token', $token, '=', true);
|
|
if (!$user) {
|
|
return null;
|
|
}
|
|
|
|
//Aggiornamento del campo UltimoAccesso
|
|
$this->_genericModel->update('Users', $user['id'], array('UltimoAccesso' => date('Y-m-d H:i:s')));
|
|
|
|
return $user;
|
|
}
|
|
|
|
public function denyAccess()
|
|
{
|
|
$this->_request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'L\'utente non ha i permessi per accedere alla risorsa.');
|
|
}
|
|
|
|
protected function _invalidCredential()
|
|
{
|
|
$this->_request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'Username e/o password errati.');
|
|
}
|
|
|
|
protected function _redirectInvalidRequest(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
$request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'Invalid authentication header.');
|
|
}
|
|
|
|
protected function _redirectNoAuth(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
$request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'Authentication header not found');
|
|
}
|
|
|
|
protected function _redirectUrlScaduto(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
$request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'Url Scaduto');
|
|
}
|
|
|
|
protected function _redirectTokenScaduto(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
throw new App_Controller_Errors_WebServiceError(utf8_encode("Accesso Scaduto"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_SESSION_EXPIRED);
|
|
}
|
|
|
|
protected function _redirectOffline(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
$request->setModuleName('default')
|
|
->setControllerName('error')
|
|
->setActionName('invalid')
|
|
->setParam('message', 'Il web services è offline');
|
|
}
|
|
|
|
protected function _redirectDeactiveUserState(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
throw new App_Controller_Errors_WebServiceError(utf8_encode("Account Api Disattivato"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_SESSION_EXPIRED);
|
|
}
|
|
|
|
protected function _redirectNoMongoDBName(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
throw new App_Controller_Errors_WebServiceError(utf8_encode("Nomd DB Mongo non specificato"), null, App_Controller_Errors_WebServiceError::WEBSERVICE_GENERIC_ERROR);
|
|
}
|
|
|
|
protected function _redirectLogin(\Zend_Controller_Request_Abstract $request)
|
|
{
|
|
// Forward the request to the noauth error page.
|
|
$request->setParam('section', $request->getModuleName())
|
|
->setModuleName('default')
|
|
->setControllerName('index')
|
|
->setActionName('login');
|
|
}
|
|
|
|
}
|