Code Coverage |
||||||||||
Lines |
Functions and Methods |
Classes and Traits |
||||||||
| Total | |
0.00% |
0 / 184 |
|
0.00% |
0 / 25 |
CRAP | |
0.00% |
0 / 1 |
| core_kernel_users_Service | |
0.00% |
0 / 184 |
|
0.00% |
0 / 25 |
5112 | |
0.00% |
0 / 1 |
| getPasswordHash | |
0.00% |
0 / 4 |
|
0.00% |
0 / 1 |
12 | |||
| loginExists | |
0.00% |
0 / 10 |
|
0.00% |
0 / 1 |
12 | |||
| addUser | |
0.00% |
0 / 18 |
|
0.00% |
0 / 1 |
30 | |||
| removeUser | |
0.00% |
0 / 3 |
|
0.00% |
0 / 1 |
2 | |||
| getOneUser | |
0.00% |
0 / 12 |
|
0.00% |
0 / 1 |
20 | |||
| isASessionOpened | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
| isPasswordValid | |
0.00% |
0 / 6 |
|
0.00% |
0 / 1 |
6 | |||
| setPassword | |
0.00% |
0 / 8 |
|
0.00% |
0 / 1 |
6 | |||
| getUserRoles | |
0.00% |
0 / 8 |
|
0.00% |
0 / 1 |
6 | |||
| userHasRoles | |
0.00% |
0 / 20 |
|
0.00% |
0 / 1 |
72 | |||
| attachRole | |
0.00% |
0 / 8 |
|
0.00% |
0 / 1 |
12 | |||
| unnatachRole | |
0.00% |
0 / 8 |
|
0.00% |
0 / 1 |
12 | |||
| addRole | |
0.00% |
0 / 10 |
|
0.00% |
0 / 1 |
30 | |||
| removeRole | |
0.00% |
0 / 12 |
|
0.00% |
0 / 1 |
42 | |||
| getIncludedRoles | |
0.00% |
0 / 25 |
|
0.00% |
0 / 1 |
90 | |||
| getAllowedRoles | |
0.00% |
0 / 4 |
|
0.00% |
0 / 1 |
2 | |||
| getDefaultRole | |
0.00% |
0 / 3 |
|
0.00% |
0 / 1 |
2 | |||
| includeRole | |
0.00% |
0 / 4 |
|
0.00% |
0 / 1 |
2 | |||
| unincludeRole | |
0.00% |
0 / 8 |
|
0.00% |
0 / 1 |
20 | |||
| login | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
| __construct | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
| singleton | |
0.00% |
0 / 6 |
|
0.00% |
0 / 1 |
6 | |||
| logout | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
| getAllRoles | |
0.00% |
0 / 2 |
|
0.00% |
0 / 1 |
2 | |||
| userAdditionPasswordEncryption | |
0.00% |
0 / 1 |
|
0.00% |
0 / 1 |
2 | |||
| 1 | <?php |
| 2 | |
| 3 | /* |
| 4 | * This program is free software; you can redistribute it and/or |
| 5 | * modify it under the terms of the GNU General Public License |
| 6 | * as published by the Free Software Foundation; under version 2 |
| 7 | * of the License (non-upgradable). |
| 8 | * |
| 9 | * This program is distributed in the hope that it will be useful, |
| 10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 12 | * GNU General Public License for more details. |
| 13 | * |
| 14 | * You should have received a copy of the GNU General Public License |
| 15 | * along with this program; if not, write to the Free Software |
| 16 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
| 17 | * |
| 18 | * Copyright (c) 2002-2008 (original work) Public Research Centre Henri Tudor & University of Luxembourg |
| 19 | * (under the project TAO & TAO2); |
| 20 | * 2008-2010 (update and modification) Deutsche Institut für Internationale Pädagogische Forschung |
| 21 | * (under the project TAO-TRANSFER); |
| 22 | * 2009-2012 (update and modification) Public Research Centre Henri Tudor |
| 23 | * (under the project TAO-SUSTAIN & TAO-DEV); |
| 24 | * 2017 (update and modification) Open Assessment Technologies SA (under the project TAO-PRODUCT); |
| 25 | */ |
| 26 | |
| 27 | use oat\generis\model\GenerisRdf; |
| 28 | use oat\generis\model\OntologyRdfs; |
| 29 | use oat\oatbox\user\LoginService; |
| 30 | |
| 31 | /** |
| 32 | * The UserService aims at providing an API to manage Users and Roles within Generis. |
| 33 | * |
| 34 | * @access public |
| 35 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 36 | * @package generis |
| 37 | |
| 38 | */ |
| 39 | class core_kernel_users_Service implements |
| 40 | core_kernel_users_UsersManagement, |
| 41 | core_kernel_users_RolesManagement |
| 42 | { |
| 43 | public const LEGACY_ALGORITHM = 'md5'; |
| 44 | public const LEGACY_SALT_LENGTH = 0; |
| 45 | |
| 46 | /** |
| 47 | * |
| 48 | * @access private |
| 49 | * @var core_kernel_users_Service |
| 50 | */ |
| 51 | private static $instance = null; |
| 52 | |
| 53 | |
| 54 | /** |
| 55 | * Returns the hashing algorithm defined in generis configuration |
| 56 | * |
| 57 | * @return helpers_PasswordHash |
| 58 | */ |
| 59 | public static function getPasswordHash() |
| 60 | { |
| 61 | return new helpers_PasswordHash( |
| 62 | defined('PASSWORD_HASH_ALGORITHM') ? PASSWORD_HASH_ALGORITHM : self::LEGACY_ALGORITHM, |
| 63 | defined('PASSWORD_HASH_SALT_LENGTH') ? PASSWORD_HASH_SALT_LENGTH : self::LEGACY_SALT_LENGTH |
| 64 | ); |
| 65 | } |
| 66 | |
| 67 | /** |
| 68 | * Returns true if a user with login = $login is currently in the |
| 69 | * persistent memory of Generis. |
| 70 | * |
| 71 | * @access public |
| 72 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 73 | * @param string login A string that is used as a Generis user login in the persistent memory. |
| 74 | * @param Class class A specific sub class of User where the login must be searched into. |
| 75 | * @return boolean |
| 76 | */ |
| 77 | public function loginExists($login, core_kernel_classes_Class $class = null) |
| 78 | { |
| 79 | $returnValue = (bool) false; |
| 80 | |
| 81 | if (is_null($class)) { |
| 82 | $class = new core_kernel_classes_Class(GenerisRdf::CLASS_GENERIS_USER); |
| 83 | } |
| 84 | $users = $class->searchInstances( |
| 85 | [GenerisRdf::PROPERTY_USER_LOGIN => $login], |
| 86 | ['like' => false, 'recursive' => true] |
| 87 | ); |
| 88 | |
| 89 | if (count($users) > 0) { |
| 90 | $returnValue = true; |
| 91 | } |
| 92 | |
| 93 | return (bool) $returnValue; |
| 94 | } |
| 95 | |
| 96 | /** |
| 97 | * Create a new Generis User with a specific Role. If the $role is not |
| 98 | * the user will be given the Generis Role. |
| 99 | * |
| 100 | * @access public |
| 101 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 102 | * @param string login A specific login for the User to create. |
| 103 | * @param string password A password for the User to create (raw). |
| 104 | * @param Resource role A Role to grant to the new User. |
| 105 | * @return core_kernel_classes_Resource |
| 106 | */ |
| 107 | public function addUser( |
| 108 | $login, |
| 109 | $password, |
| 110 | core_kernel_classes_Resource $role = null, |
| 111 | core_kernel_classes_Class $class = null |
| 112 | ) { |
| 113 | $returnValue = null; |
| 114 | |
| 115 | if ($this->loginExists($login)) { |
| 116 | throw new core_kernel_users_Exception( |
| 117 | "Login '${login}' already in use.", |
| 118 | core_kernel_users_Exception::LOGIN_EXITS |
| 119 | ); |
| 120 | } else { |
| 121 | $role = (empty($role)) ? new core_kernel_classes_Resource(GenerisRdf::INSTANCE_ROLE_GENERIS) : $role; |
| 122 | |
| 123 | $userClass = (!empty($class)) ? $class : new core_kernel_classes_Class(GenerisRdf::CLASS_GENERIS_USER); |
| 124 | $returnValue = $userClass->createInstanceWithProperties([ |
| 125 | OntologyRdfs::RDFS_LABEL => "User ${login}", |
| 126 | OntologyRdfs::RDFS_COMMENT => 'User Created on ' . date(DATE_ISO8601), |
| 127 | GenerisRdf::PROPERTY_USER_LOGIN => $login, |
| 128 | GenerisRdf::PROPERTY_USER_PASSWORD => $this->userAdditionPasswordEncryption($login, $password), |
| 129 | GenerisRdf::PROPERTY_USER_ROLES => $role |
| 130 | ]); |
| 131 | |
| 132 | if (empty($returnValue)) { |
| 133 | throw new core_kernel_users_Exception("Unable to create user with login = '${login}'."); |
| 134 | } |
| 135 | } |
| 136 | |
| 137 | return $returnValue; |
| 138 | } |
| 139 | |
| 140 | /** |
| 141 | * Remove a Generis User from persistent memory. Bound roles will remain |
| 142 | * |
| 143 | * @access public |
| 144 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 145 | * @param Resource user A reference to the User to be removed from the persistent memory of Generis. |
| 146 | * @return boolean |
| 147 | */ |
| 148 | public function removeUser(core_kernel_classes_Resource $user) |
| 149 | { |
| 150 | $returnValue = (bool) false; |
| 151 | |
| 152 | $returnValue = $user->delete(); |
| 153 | |
| 154 | return (bool) $returnValue; |
| 155 | } |
| 156 | |
| 157 | /** |
| 158 | * Get a specific Generis User from the persistent memory of Generis that |
| 159 | * a specific login. If multiple users have the same login, a UserException |
| 160 | * be thrown. |
| 161 | * |
| 162 | * @access public |
| 163 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 164 | * @param string login A Generis User login. |
| 165 | * @param Class class A specific sub Class of User where in the User has to be searched in. |
| 166 | * @return core_kernel_classes_Resource |
| 167 | */ |
| 168 | public function getOneUser($login, core_kernel_classes_Class $class = null) |
| 169 | { |
| 170 | $returnValue = null; |
| 171 | |
| 172 | if (empty($class)) { |
| 173 | $class = new core_kernel_classes_Class(GenerisRdf::CLASS_GENERIS_USER); |
| 174 | } |
| 175 | |
| 176 | $users = $class->searchInstances( |
| 177 | [GenerisRdf::PROPERTY_USER_LOGIN => $login], |
| 178 | ['like' => false, 'recursive' => true] |
| 179 | ); |
| 180 | |
| 181 | if (count($users) == 1) { |
| 182 | $returnValue = current($users); |
| 183 | } elseif (count($users) > 1) { |
| 184 | $msg = "More than one user have the same login '${login}'."; |
| 185 | } |
| 186 | |
| 187 | return $returnValue; |
| 188 | } |
| 189 | |
| 190 | /** |
| 191 | * Indicates if an Authenticated Session is open. |
| 192 | * |
| 193 | * @access public |
| 194 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 195 | * @return boolean |
| 196 | */ |
| 197 | public function isASessionOpened() |
| 198 | { |
| 199 | return !\common_session_SessionManager::isAnonymous(); |
| 200 | } |
| 201 | |
| 202 | /** |
| 203 | * used in conjunction with the callback validator |
| 204 | * to test the pasword entered |
| 205 | * |
| 206 | * @access public |
| 207 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 208 | * @param string password used in conjunction with the callback validator to test the pasword entered |
| 209 | * @param Resource user used in conjunction with the callback validator to test the pasword entered |
| 210 | * @return boolean |
| 211 | */ |
| 212 | public function isPasswordValid($password, core_kernel_classes_Resource $user) |
| 213 | { |
| 214 | $returnValue = (bool) false; |
| 215 | |
| 216 | if (!is_string($password)) { |
| 217 | throw new core_kernel_users_Exception('The password must be of "string" type, got ' . gettype($password)); |
| 218 | } |
| 219 | |
| 220 | $hash = $user->getUniquePropertyValue(new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_PASSWORD)); |
| 221 | $returnValue = core_kernel_users_Service::getPasswordHash()->verify($password, $hash); |
| 222 | |
| 223 | return (bool) $returnValue; |
| 224 | } |
| 225 | |
| 226 | /** |
| 227 | * Set the password of a specifc user. |
| 228 | * |
| 229 | * @access public |
| 230 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 231 | * @param Resource user The user you want to set the password. |
| 232 | * @param string password The md5 hash of the password you want to set to the user. |
| 233 | */ |
| 234 | public function setPassword(core_kernel_classes_Resource $user, $password) |
| 235 | { |
| 236 | if (!is_string($password)) { |
| 237 | throw new core_kernel_users_Exception( |
| 238 | 'The password must be of "string" type, got ' . gettype($password) |
| 239 | ); |
| 240 | } |
| 241 | |
| 242 | $user->editPropertyValues( |
| 243 | new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_PASSWORD), |
| 244 | core_kernel_users_Service::getPasswordHash()->encrypt($password) |
| 245 | ); |
| 246 | } |
| 247 | |
| 248 | /** |
| 249 | * Get the roles that a given user has. |
| 250 | * |
| 251 | * @access public |
| 252 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 253 | * @param Resource user A Generis User. |
| 254 | * @return array |
| 255 | */ |
| 256 | public function getUserRoles(core_kernel_classes_Resource $user) |
| 257 | { |
| 258 | $returnValue = []; |
| 259 | // We use a Depth First Search approach to flatten the Roles Graph. |
| 260 | $rolesProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_ROLES); |
| 261 | $rootRoles = $user->getPropertyValuesCollection($rolesProperty); |
| 262 | |
| 263 | foreach ($rootRoles->getIterator() as $r) { |
| 264 | $returnValue[$r->getUri()] = $r; |
| 265 | $returnValue = array_merge($returnValue, $this->getIncludedRoles($r)); |
| 266 | } |
| 267 | |
| 268 | $returnValue = array_unique($returnValue); |
| 269 | |
| 270 | return (array) $returnValue; |
| 271 | } |
| 272 | |
| 273 | /** |
| 274 | * Indicates if a user is granted with a set of Roles. |
| 275 | * |
| 276 | * @access public |
| 277 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 278 | * @param Resource user The User instance you want to check Roles. |
| 279 | * @param roles Can be either a single Resource or an array of Resource depicting Role(s). |
| 280 | * @return boolean |
| 281 | */ |
| 282 | public function userHasRoles(core_kernel_classes_Resource $user, $roles) |
| 283 | { |
| 284 | $returnValue = (bool) false; |
| 285 | |
| 286 | if (empty($roles)) { |
| 287 | throw new InvalidArgumentException('The $roles parameter must not be empty.'); |
| 288 | } |
| 289 | |
| 290 | $roles = (is_array($roles)) ? $roles : [$roles]; |
| 291 | $searchRoles = []; |
| 292 | foreach ($roles as $r) { |
| 293 | $searchRoles[] = ($r instanceof core_kernel_classes_Resource) ? $r->getUri() : $r; |
| 294 | } |
| 295 | unset($roles); |
| 296 | |
| 297 | if (common_session_SessionManager::getSession()->getUserUri() == $user->getUri()) { |
| 298 | foreach (common_session_SessionManager::getSession()->getUserRoles() as $role) { |
| 299 | if (in_array($role, $searchRoles)) { |
| 300 | $returnValue = true; |
| 301 | break; |
| 302 | } |
| 303 | } |
| 304 | } else { |
| 305 | // After introducing remote users, we can no longer guarantee that any user and his roles are available |
| 306 | common_Logger::w( |
| 307 | 'Roles of non current user (' . $user->getUri() . ') checked, trying fallback to local ontology' |
| 308 | ); |
| 309 | $userRoles = array_keys($this->getUserRoles($user)); |
| 310 | $identicalRoles = array_intersect($searchRoles, $userRoles); |
| 311 | |
| 312 | $returnValue = (count($identicalRoles) === count($searchRoles)); |
| 313 | } |
| 314 | |
| 315 | return (bool) $returnValue; |
| 316 | } |
| 317 | |
| 318 | /** |
| 319 | * Attach a Generis Role to a given Generis User. A UserException will be |
| 320 | * if an error occurs. If the User already has the role, nothing happens. |
| 321 | * |
| 322 | * @access public |
| 323 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 324 | * @param Resource user The User you want to attach a Role. |
| 325 | * @param Resource role A Role to attach to a User. |
| 326 | * @return void |
| 327 | */ |
| 328 | public function attachRole(core_kernel_classes_Resource $user, core_kernel_classes_Resource $role) |
| 329 | { |
| 330 | try { |
| 331 | if (false === $this->userHasRoles($user, $role)) { |
| 332 | $rolesProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_ROLES); |
| 333 | $user->setPropertyValue($rolesProperty, $role); |
| 334 | } |
| 335 | } catch (common_Exception $e) { |
| 336 | $roleUri = $role->getUri; |
| 337 | $userUri = $user->getUri(); |
| 338 | $msg = "An error occured while attaching role '${roleUri}' to user '${userUri}': " . $e->getMessage(); |
| 339 | throw new core_kernel_users_Exception($msg); |
| 340 | } |
| 341 | } |
| 342 | |
| 343 | /** |
| 344 | * Short description of method unnatachRole |
| 345 | * |
| 346 | * @access public |
| 347 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 348 | * @param Resource user A Generis user from which you want to unnattach the Generis Role. |
| 349 | * @param Resource role The Generis Role you want to Unnatach from the Generis User. |
| 350 | */ |
| 351 | public function unnatachRole(core_kernel_classes_Resource $user, core_kernel_classes_Resource $role) |
| 352 | { |
| 353 | try { |
| 354 | if (true === $this->userHasRoles($user, $role)) { |
| 355 | $rolesProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_ROLES); |
| 356 | $options = ['like' => false, 'pattern' => $role->getUri()]; |
| 357 | $user->removePropertyValues($rolesProperty, $options); |
| 358 | } |
| 359 | } catch (common_Exception $e) { |
| 360 | $roleUri = $role->getUri(); |
| 361 | $userUri = $user->getUri(); |
| 362 | $msg = "An error occured while unnataching role '${roleUri}' from user '${userUri}': " . $e->getMessage(); |
| 363 | } |
| 364 | } |
| 365 | |
| 366 | /** |
| 367 | * Add a role in Generis. |
| 368 | * |
| 369 | * @access public |
| 370 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 371 | * @param string $label The label to apply to the newly created Generis Role. |
| 372 | * @param $includedRoles The Role(s) to be included in the newly created Generis Role. Can be either a Resource or |
| 373 | * an array of Resources. |
| 374 | * @return core_kernel_classes_Resource |
| 375 | */ |
| 376 | public function addRole($label, $includedRoles = null, core_kernel_classes_Class $class = null) |
| 377 | { |
| 378 | $returnValue = null; |
| 379 | |
| 380 | $includedRoles = is_array($includedRoles) ? $includedRoles : [$includedRoles]; |
| 381 | $includedRoles = empty($includedRoles[0]) ? [] : $includedRoles; |
| 382 | |
| 383 | $classRole = (empty($class)) ? new core_kernel_classes_Class(GenerisRdf::CLASS_ROLE) : $class; |
| 384 | $includesRoleProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_ROLE_INCLUDESROLE); |
| 385 | $role = $classRole->createInstance($label, "${label} Role"); |
| 386 | |
| 387 | foreach ($includedRoles as $ir) { |
| 388 | $role->setPropertyValue($includesRoleProperty, $ir); |
| 389 | } |
| 390 | |
| 391 | $returnValue = $role; |
| 392 | |
| 393 | return $returnValue; |
| 394 | } |
| 395 | |
| 396 | /** |
| 397 | * Remove a Generis Role from the persistent memory. Any reference to the Role |
| 398 | * will be removed. |
| 399 | * |
| 400 | * @access public |
| 401 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 402 | * @param Resource role The Role to remove. |
| 403 | * @return boolean |
| 404 | */ |
| 405 | public function removeRole(core_kernel_classes_Resource $role) |
| 406 | { |
| 407 | $returnValue = (bool) false; |
| 408 | |
| 409 | if (GENERIS_CACHE_USERS_ROLES == true && core_kernel_users_Cache::areIncludedRolesInCache($role)) { |
| 410 | if ($role->delete(true) == true) { // delete references. |
| 411 | $returnValue = core_kernel_users_Cache::removeIncludedRoles($role); |
| 412 | |
| 413 | // We also need to remove all included roles cache that contain |
| 414 | // the role we just deleted. |
| 415 | foreach ($this->getAllRoles() as $r) { |
| 416 | if (array_key_exists($role->getUri(), $this->getIncludedRoles($r))) { |
| 417 | core_kernel_users_Cache::removeIncludedRoles($r); |
| 418 | } |
| 419 | } |
| 420 | } else { |
| 421 | $roleUri = $role->getUri(); |
| 422 | $msg = "An error occured while removing role '${roleUri}'. It could not be deleted from the cache."; |
| 423 | throw new core_kernel_users_Exception($msg); |
| 424 | } |
| 425 | } else { |
| 426 | $returnValue = $role->delete(true); // delete references to this role! |
| 427 | } |
| 428 | |
| 429 | return (bool) $returnValue; |
| 430 | } |
| 431 | |
| 432 | /** |
| 433 | * Get an array of the Roles included by a Generis Role. |
| 434 | * |
| 435 | * @access public |
| 436 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 437 | * |
| 438 | * @param core_kernel_classes_Resource $role A Generis Role. |
| 439 | * |
| 440 | * @return array An associative array where keys are Role URIs and values are instances of |
| 441 | * core_kernel_classes_Resource. |
| 442 | * @throws core_kernel_users_CacheException |
| 443 | * @throws core_kernel_users_Exception |
| 444 | */ |
| 445 | public function getIncludedRoles(core_kernel_classes_Resource $role) |
| 446 | { |
| 447 | $returnValue = []; |
| 448 | |
| 449 | if (GENERIS_CACHE_USERS_ROLES === true && core_kernel_users_Cache::areIncludedRolesInCache($role) === true) { |
| 450 | $returnValue = core_kernel_users_Cache::retrieveIncludedRoles($role); |
| 451 | } else { |
| 452 | // We use a Depth First Search approach to flatten the Roles Graph. |
| 453 | $includesRoleProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_ROLE_INCLUDESROLE); |
| 454 | $visitedRoles = []; |
| 455 | $s = []; // vertex stack. |
| 456 | array_push($s, $role); // begin with $role as the first vertex. |
| 457 | |
| 458 | while (!empty($s)) { |
| 459 | $u = array_pop($s); |
| 460 | |
| 461 | if (false === in_array($u->getUri(), $visitedRoles, true)) { |
| 462 | $visitedRoles[] = $u->getUri(); |
| 463 | $returnValue[$u->getUri()] = $u; |
| 464 | |
| 465 | $ar = $u->getPropertyValuesCollection($includesRoleProperty); |
| 466 | foreach ($ar->getIterator() as $w) { |
| 467 | if (false === in_array($w->getUri(), $visitedRoles, true)) { // not visited |
| 468 | array_push($s, $w); |
| 469 | } |
| 470 | } |
| 471 | } |
| 472 | } |
| 473 | |
| 474 | // remove the root vertex which is actually the role we are testing. |
| 475 | unset($returnValue[$role->getUri()]); |
| 476 | |
| 477 | if (GENERIS_CACHE_USERS_ROLES === true) { |
| 478 | try { |
| 479 | core_kernel_users_Cache::cacheIncludedRoles($role, $returnValue); |
| 480 | } catch (core_kernel_users_CacheException $e) { |
| 481 | $roleUri = $role->getUri(); |
| 482 | $msg = "Unable to retrieve included roles from cache memory for role '${roleUri}': "; |
| 483 | $msg .= $e->getMessage(); |
| 484 | throw new core_kernel_users_Exception($msg); |
| 485 | } |
| 486 | } |
| 487 | } |
| 488 | |
| 489 | return (array) $returnValue; |
| 490 | } |
| 491 | |
| 492 | /** |
| 493 | * Returns an array of Roles (as Resources) where keys are their URIs. The |
| 494 | * roles represent which kind of Roles are accepted to be identified against |
| 495 | * system. |
| 496 | * |
| 497 | * @access public |
| 498 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 499 | * @return array |
| 500 | */ |
| 501 | public function getAllowedRoles() |
| 502 | { |
| 503 | $returnValue = []; |
| 504 | |
| 505 | $role = new core_kernel_classes_Resource(GenerisRdf::INSTANCE_ROLE_GENERIS); |
| 506 | $returnValue = [$role->getUri() => $role]; |
| 507 | |
| 508 | return (array) $returnValue; |
| 509 | } |
| 510 | |
| 511 | /** |
| 512 | * Returns a Role (as a Resource) which represents the default role of the |
| 513 | * If a user has to be created but no Role is given to him, it will receive |
| 514 | * role. |
| 515 | * |
| 516 | * @access public |
| 517 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 518 | * @return core_kernel_classes_Resource |
| 519 | */ |
| 520 | public function getDefaultRole() |
| 521 | { |
| 522 | $returnValue = null; |
| 523 | |
| 524 | $returnValue = new core_kernel_classes_Resource(GenerisRdf::INSTANCE_ROLE_GENERIS); |
| 525 | |
| 526 | return $returnValue; |
| 527 | } |
| 528 | |
| 529 | /** |
| 530 | * Make a Role include another Role. |
| 531 | * |
| 532 | * @access public |
| 533 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 534 | * @param core_kernel_classes_Resource role The role that needs to include another role. |
| 535 | * @param core_kernel_classes_Resource Resource roleToInclude The role to be included. |
| 536 | */ |
| 537 | public function includeRole(core_kernel_classes_Resource $role, core_kernel_classes_Resource $roleToInclude) |
| 538 | { |
| 539 | $includesRoleProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_ROLE_INCLUDESROLE); |
| 540 | |
| 541 | // Clean to avoid double entries... |
| 542 | $role->removePropertyValues($includesRoleProperty, ['like' => false, 'pattern' => $roleToInclude->getUri()]); |
| 543 | |
| 544 | // Include the Role. |
| 545 | $role->setPropertyValue($includesRoleProperty, $roleToInclude->getUri()); |
| 546 | |
| 547 | // Reset cache. |
| 548 | core_kernel_users_Cache::removeIncludedRoles($role); |
| 549 | } |
| 550 | |
| 551 | /** |
| 552 | * Uninclude a Role from antother Role. |
| 553 | * |
| 554 | * @access public |
| 555 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 556 | * @param core_kernel_classes_Resource role The Role from which you want to uninclude a Role. |
| 557 | * @param core_kernel_classes_Resource roleToUninclude The Role to uninclude. |
| 558 | */ |
| 559 | public function unincludeRole(core_kernel_classes_Resource $role, core_kernel_classes_Resource $roleToUninclude) |
| 560 | { |
| 561 | $includesRoleProperty = new core_kernel_classes_Property(GenerisRdf::PROPERTY_ROLE_INCLUDESROLE); |
| 562 | $role->removePropertyValues($includesRoleProperty, ['like' => false, 'pattern' => $roleToUninclude->getUri()]); |
| 563 | |
| 564 | // invalidate cache for the role. |
| 565 | if (GENERIS_CACHE_USERS_ROLES == true) { |
| 566 | core_kernel_users_Cache::removeIncludedRoles($role); |
| 567 | |
| 568 | // For each roles that have $role for included role, |
| 569 | // remove the cache entry. |
| 570 | foreach ($this->getAllRoles() as $r) { |
| 571 | $includedRoles = $this->getIncludedRoles($r); |
| 572 | |
| 573 | if (array_key_exists($role->getUri(), $includedRoles)) { |
| 574 | core_kernel_users_Cache::removeIncludedRoles($r); |
| 575 | } |
| 576 | } |
| 577 | } |
| 578 | } |
| 579 | |
| 580 | /** |
| 581 | * Log in a user into Generis that has one of the provided $allowedRoles. |
| 582 | * |
| 583 | * @access public |
| 584 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 585 | * @param string $login The login of the user. |
| 586 | * @param string $password the md5 hash of the password. |
| 587 | * @param $allowedRoles - A role or an array of Roles that are allowed to be logged in. If the user has a Role that |
| 588 | * matches one or more Roles in this array, the login request will be accepted. |
| 589 | * @return boolean |
| 590 | */ |
| 591 | public function login($login, $password, $allowedRoles) |
| 592 | { |
| 593 | return LoginService::login($login, $password); |
| 594 | } |
| 595 | |
| 596 | /** |
| 597 | * The constructor is private to implement the Singleton Design Pattern. |
| 598 | * |
| 599 | * @access private |
| 600 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 601 | */ |
| 602 | private function __construct() |
| 603 | { |
| 604 | // Only to restrict instances of this class to a single instance. |
| 605 | } |
| 606 | |
| 607 | /** |
| 608 | * Get a unique instance of the UserService. |
| 609 | * |
| 610 | * @access public |
| 611 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 612 | * @return core_kernel_users_Service |
| 613 | */ |
| 614 | public static function singleton() |
| 615 | { |
| 616 | $returnValue = null; |
| 617 | |
| 618 | if (!isset(self::$instance)) { |
| 619 | $c = __CLASS__; |
| 620 | self::$instance = new $c(); |
| 621 | } |
| 622 | $returnValue = self::$instance; |
| 623 | |
| 624 | return $returnValue; |
| 625 | } |
| 626 | |
| 627 | /** |
| 628 | * Logout the current user. The session will be entirely reset. |
| 629 | * |
| 630 | * @access public |
| 631 | * @author Jerome Bogaerts, <jerome@taotesting.com> |
| 632 | * @return boolean |
| 633 | */ |
| 634 | public function logout() |
| 635 | { |
| 636 | return \common_session_SessionManager::endSession(); |
| 637 | } |
| 638 | |
| 639 | /** |
| 640 | * Returns the whole collection of Roles in Generis. |
| 641 | * |
| 642 | * @return array An associative array where keys are Role URIs and values are instances of the |
| 643 | * core_kernel_classes_Resource PHP class. |
| 644 | */ |
| 645 | public function getAllRoles() |
| 646 | { |
| 647 | $roleClass = new core_kernel_classes_Class(GenerisRdf::CLASS_ROLE); |
| 648 | return $roleClass->getInstances(true); |
| 649 | } |
| 650 | |
| 651 | /** |
| 652 | * Trigger user encrypition at user insertion time. |
| 653 | * |
| 654 | * @param string $login |
| 655 | * @param string $password |
| 656 | * |
| 657 | * @return string The encrypted password. |
| 658 | */ |
| 659 | protected function userAdditionPasswordEncryption($login, $password) |
| 660 | { |
| 661 | // $login not used but might be useful for delegated encryptions in sub classes. |
| 662 | return static::getPasswordHash()->encrypt($password); |
| 663 | } |
| 664 | } |