-2

Let's say I have models that are subjects to rights when used by users, but not when used by business logic.

For exemple: When one create an item A, it automaticaly creates an Item B.

Users must have the right to create A or B if he wants to create one. But the business logic when creating B from A doesn't need any rights.

If I put the right system in business logic, I get classes that have strong dependancy to the session and A can't create a B if the logged in user doesn't have the right.

If I put rights managements in controlers, I feel like my business logic isn't safe as any programmer could forget to test rights before creating an item and wouldn't be stopped, plus there's code duplication if 2 controllers are able to update an item for any reason.

Where would you put the rights management ?

I coul create inheritance of every objet that would be used by controllers, and implement rights limitation, while business logic would access the objects themselves. Controllers create UserA, UserB while object A directly creates a B object. But it sounds like I'll have to duplicate (inherit) every single business logic objet that has to be used in a controller, thus a solid 80% of them.

Geekureuil
  • 1
  • 1

2 Answers2

0

I will suggest you to use laravel for the same. Laravel provides middle ware which you need to specify in route file. so each time any of the controller would get called, first middleware has to be called and then all conditions would be checked over there after that it will get forwarded to controller.

in middleware you can create one class file which will check roles and rights or necessary permission.

you may refer https://heera.it/laravel-5-1-x-acl-middleware

or may like https://github.com/Zizaco/entrust#user-relation-to-roles

Yaxita Shah
  • 1,206
  • 1
  • 11
  • 17
-1

Here's an example:

    <!-- language: php -->
//abstact Model
abstract class Models {
    public function save() {
        if($this->id === null) {
            $this->insert();
        } else {
            $this->update();
        }
    }    

    abstract protected function insert() {
        //insertion in DB
    }    

    abstract protected function update() {
        //update in DB
    }
}    


//A Model
class A extends Model {
    protected function insert() {
        //check if logged in user can insert A objects otherwise throw an exception
        //insert in DB    

        $b = new B;
        //set $b datas
        $b->save();
    }    

    protected function update() {
        //check if logged in user can update A objects and has rights on instanciated A otherwise throw an exception
        //update in DB
    }
}    

//B Model
class B extends Model {
    protected function insert() {
        //check if logged in user can insert B objects otherwise throw an exception
        //insert in DB
    }    

    protected function update() {
        //check if logged in user can update B objects and has rights on instanciated B otherwise throw an exception
        //update in DB
    }
}    

//A Controller
class AController() {

    public function createA() {
        $a = new A;
        //set $a datas
        $a->save()
    }    

    public function updateA($id) {
        $a = new A($id);
        //set new $a datas
        $a->save()
    }
}    

//B Controller
class BController() {

    public function createB() {
        $b = new B;
        //set $b datas
        $b->save()
    }    

    public function updateB($id) {
        $b = new B($id);
        //set new $b datas
        $b->save()
    }
}

If I keep the verifications inside models, object A can't create object B if the users can't, but it should as it's not the users that create B in this exemple, it's business logic through A code.

If I take verifications out of models to put it in controllers, I'm exposed to a programmer that will somedya forget the verification, and may have many duplication when diferent controllers should update an item.

So far I thought about:

  • 1 Puting rights checks in controller but it doesn't sound safe
  • 2 Injecting the user, but I'd have to create an "all rights on" user that would be used by business logic
  • 3 Adding a $norights options on save() methods that would be false by default but set as true by business logic to overpass rights checks

None of these ideas full satisfy me for different reason:

  • 1 non safe models if one forget the checks
  • 2 super user is not sounding very good
  • 3 sounds dirty
Geekureuil
  • 1
  • 1