$__privilege
$__privilege : array
Cached actual midcom_core_privilege_db data for this privilege.
Privilege class, used to interact with the privilege system. It encapsulates the actual Database Level Object. As usual with MidCOM DBA, you <i>must never access the DB layer object.</i>
The main area of expertise of this class is privilege IO (loading and storing), their validation and privilege merging.
It is important to understand that you must never load privilege records directly, or access them by their IDs. Instead, use the DBA level interface functions to locate existing privilege sets. The only time where you use this class directly is when creating new privilege, using the default constructor of this class (although the create_new_privilege_object DBA member methods are the preferred way of doing this).
Caching:
This class uses the memcache cache module to speed up ACL accesses. It caches the ACL objects retrieved from the database, not any merged privilege set (at this time, that is). This should speed up regular operations quite a bit (along with the parent guid cache, which is a second important key).
get_object() : \midcom_core_dbaobject
A copy of the object referenced by the guid value of this privilege.
The DBA object to which this privileges is assigned or false on failure (f.x. missing access permissions).
get_assignee() : \midcom_core_user|\midcom_core_group|false
If the assignee has an object representation (at this time, only users and groups have), this call will return the assignee object held by the authentication service.
Use is_magic_assignee to determine if you have an assignee object.
object as returned by the auth service, false on failure.
set_assignee(mixed $assignee) : boolean
Set the assignee member string to the correct value to represent the object passed, in general, this resolves users and groups to their strings and leaves magic assignees intact.
Possible argument types:
| mixed | $assignee | An assignee representation as outlined above. |
indicating success.
validate()
Validate the privilege for correctness of all set options. This includes:
get_content_privileges(string $guid) : array<mixed,\midcom_core_privilege>
List all content privileges assigned to a given object.
Essentially, this will exclude all SELF style assignees.
This function is for use in the authentication framework only.
| string | $guid | A GUID to query. |
get_self_privileges(string $guid) : array<mixed,\midcom_core_privilege>
List all privileges assigned directly to a user or group.
These are all SELF privileges.
This function is for use in the authentication framework only.
| string | $guid | A GUID to query. |
get_all_privileges(string $guid) : array<mixed,\midcom_core_privilege>
List all privileges assigned an object unfiltered.
This function is for use in the authentication framework only
| string | $guid | The GUID of the object for which we should look up privileges. |
get_privilege(object $object, string $name, string $assignee, string $classname = '') : \midcom_core_privilege
Retrieve a single given privilege at a content object, identified by the combination of assignee and privilege name.
This call will return an object even if the privilege is set to INHERITED at the given object (i.e. does not exist) for consistency reasons. Errors are thrown for example on database inconsistencies.
This function is for use in the authentication framework only.
| object | $object | The object to query. |
| string | $name | The name of the privilege to query |
| string | $assignee | The identifier of the assignee to query. |
| string | $classname | The optional classname required only for class-limited SELF privileges. |
The privilege matching the constraints.
does_privilege_apply(string $user_id) : boolean
Determine whether a given privilege applies for the given user in content mode. This means, that all SELF privileges are skipped at this point, EVERYONE privileges apply always, and all other privileges are checked against the user.
| string | $user_id | The user id in question. |
Indicating whether the privilege record applies for the user, or not.
_query_privileges(string $guid, string $type) : array<mixed,\midcom_core_privilege>
Query the database for privileges and construct all necessary objects out of it.
| string | $guid | The GUID of the object for which to query ACL data. |
| string | $type | SELF or CONTENT |
_get_privileges(string $guid, $type) : array<mixed,\midcom_core_privilege>
List all privileges assigned an object unfiltered.
| string | $guid | The GUID of the object for which we should look up privileges. |
| $type |