Best way to filter access to controller actions ac

问题:

Using CakePHP 2.2, I am building an application in which each client has it's own "realm" of data and none of the other data is visible to them. For example, a client has his set of users, courses, contractors and jobs. Groups are shared among clients, but they cannot perform actions on groups. All clients can do with groups is assign them to users. So, an administrator (using ACL) can only manage data from the same client id.

All my objects (except groups, of course) have the client_id key.

Now, I know one way to get this done and actually having it working well, but it seems a bit dirty and I'm wondering if there is a better way. Being early in the project and new to CakePHP, I'm eager to get it right.

This is how I'm doing it now :

1- A user logs in. His client_id is written to session according to the data from the user's table.

$user = $this->User->read(null, $this->Auth->user('id'));
$this->Session->write('User.client_id', $user['User']['client_id']);

2- In AppController, I have a protected function that compares that session id to a given parameter.

protected function clientCheck($client_id) {
    if ($this->Session->read('User.client_id') == $client_id) {
        return true;
    } else {
        $this->Session->setFlash(__('Invalid object or view.'));
        $this->redirect(array('controller' => 'user', 'action' => 'home'));
    }
}

3- Im my different index actions (each index, each relevant controller), I check the client_id using a paginate condition.

public function index() {
    $this->User->recursive = 0;
    $this->paginate = array(
         'conditions' => array('User.client_id' => $this->Session->read('User.client_id'))
    );
    $this->set('users', $this->paginate());
}

4- In other actions, I check the client_id before checking the HTTP request type this way.

$user = $this->User->read(null, $id);
$this->clientCheck($user['User']['client_id']);
$this->set('user', $user);

回答1:

The concept is good - it's not 'dirty', and it's pretty much exactly the same as how I've handled situations like that.

You've just got a couple of lines of redundant code. First:

$this->Auth->user('id')

That method can actually get any field for the logged in user, so you can do:

$this->Auth->user('client_id')

So your two lines:

$user = $this->User->read(null, $this->Auth->user('id'));
$this->Session->write('User.client_id', $user['User']['client_id']);

Aren't needed. You don't need to re-read the User, or write anything to the session - just grab the client_id directly from Auth any time you need it.

In fact, if you read http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#accessing-the-logged-in-user it even says you can get it from outside the context of a controller, using the static method like:

AuthComponent::user('client_id')

Though it doesn't seem you'll be needing that.

回答2:

You could also apply the client_id condition to all finds for a Model by placing something in the beforeFind function in the Model.

For example, in your User model, you could do something like this:

function beforeFind( $queryData ) {

    // Automatically filter all finds by client_id of logged in user
    $queryData['conditions'][$this->alias . '.client_id'] = AuthComponent::user('client_id');

    return $queryData;
}

Not sure if AuthComponent::user('client_id') works in the Model, but you get the idea. This will automatically apply this condition to every find in the model.

You could also use the beforeSave in the model to automatically set that client_id for you in new records.

回答3:

My answer may be database engine specific as I use PostgreSQL. In my project I used different schema for every client in mysql terms that would be separate database for every client.

In public schema (common database) I store all data that needs to be shared between all clients (objects that do not have client_id in your case), for example, variable constants, profile settings and so on.

In company specific models I define

public $useDbConfig = 'company_data';

In Controller/AppController.php beforeFilter() method I have this code to set schema according to the logged in user.

if ($this->Session->check('User.Company.id')) {
    App::uses('ConnectionManager', 'Model'); 
    $dataSource = ConnectionManager::getDataSource('company_data');
    $dataSource->config['schema'] = 
        'company_'.$this->Session->read('User.Company.id');
}

As you see I update dataSource on the fly according to used company. This does exclude any involvement of company_id in any query as only company relevant data is stored in that schema (database). Also this adds ability to scale the project.

Downside of this approach is that it creates pain in the ass to synchronize all database structures on structure change, but it can be done using exporting data, dropping all databases, recreating them with new layout and importing data back again. Just need to be sure to export data with full inserts including column names.