Source for file User.php

Documentation is available at User.php

1: <?php
2:
3: /**
4: * Nette Framework
5: *
6: * Copyright (c) 2004, 2009 David Grudl (http://davidgrudl.com)
7: *
8: * This source file is subject to the "Nette license" that is bundled
9: * with this package in the file license.txt.
10: *
11: * For more information please see https://nette.org
12: *
13: * @copyright Copyright (c) 2004, 2009 David Grudl
14: * @license https://nette.org/license Nette license
15: * @link https://nette.org
16: * @category Nette
17: * @package Nette\Web
18: * @version $Id$
19: */
20:
21:
22:
23: require_once dirname(__FILE__) . '/../Object.php';
24:
25: require_once dirname(__FILE__) . '/../Web/IUser.php';
26:
27:
28:
29: /**
30: * Authentication and authorization.
31: *
32: * @author David Grudl
33: * @copyright Copyright (c) 2004, 2009 David Grudl
34: * @package Nette\Web
35: */
36: class User extends Object implements IUser
37: {
38: /**#@+ sign-out reason {@link User::getSignOutReason()} */
39: const MANUAL = 1;
40: const INACTIVITY = 2;
41: const BROWSER_CLOSED = 3;
42: /**#@-*/
43:
44: /** @var string default role for unauthenticated user */
45: public $guestRole = 'guest';
46:
47: /** @var string default role for authenticated user without own identity */
48: public $authenticatedRole = 'authenticated';
49:
50: /** @var array of event handlers; Occurs when the user is successfully authenticated; function(User $sender) */
51: public $onAuthenticated;
52:
53: /** @var array of event handlers; Occurs when the user is logged off; function(User $sender) */
54: public $onSignedOut;
55:
56: /** @var IAuthenticator */
57: private $authenticationHandler;
58:
59: /** @var IAuthorizator */
60: private $authorizationHandler;
61:
62: /** @var string */
63: private $namespace = '';
64:
65: /** @var SessionNamespace */
66: private $session;
67:
68:
69:
70: /********************* Authentication ****************d*g**/
71:
72:
73:
74: /**
75: * Conducts the authentication process.
76: * @param string
77: * @param string
78: * @param mixed
79: * @return void
80: * @throws AuthenticationException if authentication was not successful
81: */
82: public function authenticate($username, $password, $extra = NULL)
83: {
84: $handler = $this->getAuthenticationHandler();
85: if ($handler === NULL) {
86: throw new InvalidStateException('Authentication handler has not been set.');
87: }
88:
89: $this->signOut(TRUE);
90:
91: $credentials = array(
92: IAuthenticator::USERNAME => $username,
93: IAuthenticator::PASSWORD => $password,
94: 'extra' => $extra,
95: );
96:
97: $this->setIdentity($handler->authenticate($credentials));
98: $this->setAuthenticated(TRUE);
99: $this->onAuthenticated($this);
100: }
101:
102:
103:
104: /**
105: * Logs off the user from the current session.
106: * @param bool clear the identity from persistent storage?
107: * @return void
108: */
109: final public function signOut($clearIdentity = FALSE)
110: {
111: if ($this->isAuthenticated()) {
112: $this->setAuthenticated(FALSE);
113: $this->onSignedOut($this);
114: }
115:
116: if ($clearIdentity) {
117: $this->setIdentity(NULL);
118: }
119: }
120:
121:
122:
123: /**
124: * Is this user authenticated?
125: * @return bool
126: */
127: final public function isAuthenticated()
128: {
129: $session = $this->getSessionNamespace(FALSE);
130: return $session && $session->authenticated;
131: }
132:
133:
134:
135: /**
136: * Returns current user identity, if any.
137: * @return IIdentity
138: */
139: final public function getIdentity()
140: {
141: $session = $this->getSessionNamespace(FALSE);
142: return $session ? $session->identity : NULL;
143: }
144:
145:
146:
147: /**
148: * Sets authentication handler.
149: * @param IAuthenticator
150: * @return void
151: */
152: public function setAuthenticationHandler(IAuthenticator $handler)
153: {
154: $this->authenticationHandler = $handler;
155: }
156:
157:
158:
159: /**
160: * Returns authentication handler.
161: * @return IAuthenticator
162: */
163: final public function getAuthenticationHandler()
164: {
165: if ($this->authenticationHandler === NULL) {
166: $this->authenticationHandler = Environment::getService('Nette\Security\IAuthenticator');
167: }
168: return $this->authenticationHandler;
169: }
170:
171:
172:
173: /**
174: * Changes namespace; allows more users to share a session.
175: * @param string
176: * @return void
177: */
178: public function setNamespace($namespace)
179: {
180: if ($this->namespace !== $namespace) {
181: $this->namespace = (string) $namespace;
182: $this->session = NULL;
183: }
184: }
185:
186:
187:
188: /**
189: * Returns current namespace.
190: * @return string
191: */
192: final public function getNamespace()
193: {
194: return $this->namespace;
195: }
196:
197:
198:
199: /**
200: * Enables sign out after inactivity.
201: * @param int number of seconds or timestamp
202: * @param bool sign out when the browser is closed?
203: * @param bool clear the identity from persistent storage?
204: * @return void
205: */
206: public function setExpiration($seconds, $whenBrowserIsClosed = TRUE, $clearIdentity = FALSE)
207: {
208: $session = $this->getSessionNamespace(TRUE);
209: if ($seconds > 0) {
210: if ($seconds <= Tools::YEAR) {
211: $seconds += time();
212: }
213: $session->expireTime = $seconds;
214: $session->expireDelta = $seconds - time();
215:
216: } else {
217: unset($session->expireTime, $session->expireDelta);
218: }
219:
220: $session->expireIdentity = (bool) $clearIdentity;
221: $session->expireBrowser = (bool) $whenBrowserIsClosed;
222: }
223:
224:
225:
226: /**
227: * Why was user signed out?
228: * @return int
229: */
230: final public function getSignOutReason()
231: {
232: $session = $this->getSessionNamespace(FALSE);
233: return $session ? $session->reason : NULL;
234: }
235:
236:
237:
238: /**
239: * Returns and initializes $this->session.
240: * @return SessionNamespace
241: */
242: protected function getSessionNamespace($need)
243: {
244: if ($this->session !== NULL) {
245: return $this->session;
246: }
247:
248: $sessionHandler = $this->getSession();
249: if (!$need && !$sessionHandler->exists()) {
250: return NULL;
251: }
252:
253: $this->session = $session = $sessionHandler->getNamespace('Nette.Web.User/' . $this->namespace);
254:
255: if (!($session->identity instanceof IIdentity)) {
256: $session->remove();
257: }
258:
259: if (!is_bool($session->authenticated)) {
260: $session->remove();
261: }
262:
263: if ($session->authenticated && $session->expireBrowser && !$session->browserCheck) { // check if browser was closed?
264: $session->reason = self::BROWSER_CLOSED;
265: $session->authenticated = FALSE;
266: $this->onSignedOut($this);
267: if ($session->expireIdentity) {
268: unset($session->identity);
269: }
270: }
271:
272: if ($session->authenticated && $session->expireDelta > 0) { // check time expiration
273: if ($session->expireTime < time()) {
274: $session->reason = self::INACTIVITY;
275: $session->authenticated = FALSE;
276: $this->onSignedOut($this);
277: if ($session->expireIdentity) {
278: unset($session->identity);
279: }
280: }
281: $session->expireTime = time() + $session->expireDelta; // sliding expiration
282: }
283:
284: return $this->session;
285: }
286:
287:
288:
289: /**
290: * Set the authenticated status of this user.
291: * @param bool flag indicating the authenticated status of user
292: * @return void
293: */
294: protected function setAuthenticated($state)
295: {
296: $session = $this->getSessionNamespace(TRUE);
297: $session->authenticated = (bool) $state;
298:
299: // Session Fixation defence
300: $this->getSession()->regenerateId();
301:
302: if ($state) {
303: $session->reason = NULL;
304: $session->expireBrowser = TRUE;
305: $session->authTime = time(); // informative value
306: $session->browserCheck = TRUE;
307: $session->setExpiration(0, 'browserCheck');
308:
309: } else {
310: $session->reason = self::MANUAL;
311: unset($session->browserCheck, $session->expireTime, $session->expireDelta,
312: $session->expireIdentity, $session->expireBrowser, $session->authTime);
313: }
314: }
315:
316:
317:
318: protected function setIdentity(IIdentity $identity = NULL)
319: {
320: $this->getSessionNamespace(TRUE)->identity = $identity;
321: }
322:
323:
324:
325: /********************* Authorization ****************d*g**/
326:
327:
328:
329: /**
330: * Returns a list of effective roles that a user has been granted.
331: * @return array
332: */
333: public function getRoles()
334: {
335: if (!$this->isAuthenticated()) {
336: return array($this->guestRole);
337: }
338:
339: $identity = $this->getIdentity();
340: return $identity ? $identity->getRoles() : array($this->authenticatedRole);
341: }
342:
343:
344:
345: /**
346: * Is a user in the specified effective role?
347: * @param string
348: * @return bool
349: */
350: final public function isInRole($role)
351: {
352: return in_array($role, $this->getRoles(), TRUE);
353: }
354:
355:
356:
357: /**
358: * Has a user effective access to the Resource?
359: * If $resource is NULL, then the query applies to all resources.
360: * @param string resource
361: * @param string privilege
362: * @return bool
363: */
364: public function isAllowed($resource = NULL, $privilege = NULL)
365: {
366: $handler = $this->getAuthorizationHandler();
367: if (!$handler) {
368: throw new InvalidStateException("Authorization handler has not been set.");
369: }
370:
371: foreach ($this->getRoles() as $role) {
372: if ($handler->isAllowed($role, $resource, $privilege)) return TRUE;
373: }
374:
375: return FALSE;
376: }
377:
378:
379:
380: /**
381: * Sets authorization handler.
382: * @param IAuthorizator
383: * @return void
384: */
385: public function setAuthorizationHandler(IAuthorizator $handler)
386: {
387: $this->authorizationHandler = $handler;
388: }
389:
390:
391:
392: /**
393: * Returns current authorization handler.
394: * @return IAuthorizator
395: */
396: final public function getAuthorizationHandler()
397: {
398: if ($this->authorizationHandler === NULL) {
399: $this->authorizationHandler = Environment::getService('Nette\Security\IAuthorizator');
400: }
401: return $this->authorizationHandler;
402: }
403:
404:
405:
406: /********************* backend ****************d*g**/
407:
408:
409:
410: /**
411: * Returns session handler.
412: * @return Session
413: */
414: protected function getSession()
415: {
416: return Environment::getSession();
417: }
418:
419: }

Source for file User.php

Namespaces