arachne / security Goto Github PK

<?php

declare(strict_types=1);

namespace App\Libs\Security;

use Arachne\Security\Authentication\Firewall;

final class AdminFirewall extends Firewall
{
}

<?php

declare(strict_types=1);

namespace App\Libs\Security;

use App\Model\Entities\User;
use Arachne\Security\Authentication\IdentityValidatorInterface;
use Kdyby\Doctrine\EntityManager;
use Nette\Security\Identity;
use Nette\Security\IIdentity;

final class AdminIdentityValidator implements IdentityValidatorInterface
{
    /**
     * @var EntityManager
     */
    private $entityManager;

    public function __construct(EntityManager $entityManager)
    {
        $this->entityManager = $entityManager;
    }

    public function validateIdentity(IIdentity $identity): ?IIdentity
    {
        $user = $this->entityManager->getRepository(User::class)->find($identity->getId());

        if (!$user) {
            return NULL;
        }

        return new Identity(
            $user->userId,
            $user->roles,
            [
                'login' => $user->login,
                'name' => $user->name,
            ]
        );
    }
}

<?php

declare(strict_types=1);

namespace App\Libs\Security;

use Arachne\Security\Authorization\AuthorizatorInterface;
use Arachne\Security\Authorization\Permission;
use Arachne\Security\Authorization\PermissionAuthorizator;

final class AuthorizatorFactory
{
    /**
     * @var AdminFirewall
     */
    private $firewall;

    public function __construct(AdminFirewall $adminFirewall)
    {
        $this->firewall = $adminFirewall;
    }

    public function create(): AuthorizatorInterface
    {
        $permission = new Permission;

        $permission->addRole('admin');

        $permission->addResource('datacenter');
        $permission->addResource('ipAddress');
        $permission->addResource('ipRange');
        $permission->addResource('macAddress');

        $permission->allow('admin', ['datacenter', 'ipAddress', 'ipRange', 'macAddress'], 'view');

        return new PermissionAuthorizator($this->firewall, $permission);
    }
}