摘要：一般至少要在執(zhí)行路由前要判斷用戶是否具有權(quán)限一般在中，所以應(yīng)該在它之前獲得填充。以下代碼可參考這里的方法就是重點(diǎn)。參考這里把對(duì)象保存在中。

使用如下圖解釋這個(gè)組件：

實(shí)際最終真正要使用的是access_list（ACL），但是這個(gè)ACL的填充的場(chǎng)景一般是在后臺(tái)，先添加具體的role，然后添加resource以及resource_list（一般resource以及resource_list是固定的，因?yàn)檫@兩個(gè)東西一般對(duì)應(yīng)控制器和控制器的動(dòng)作），再然后針對(duì)role設(shè)置access_list，每條access_list組成有roles_name、resources_name、access_name、allowed，檢查某個(gè)用戶（屬于某個(gè)role）是否可以執(zhí)行某控制器和動(dòng)作，就檢查對(duì)應(yīng)的控制器和動(dòng)作在列表中它的allowed的值。如果access_list已經(jīng)設(shè)置好了，在檢查用戶權(quán)限這個(gè)步驟，完全可以只使用access_list。PhalconAclAdapter抽象類要求所有的適配器都要提供添加角色，添加資源，添加訪問(wèn)列表，判斷權(quán)限等功能。

對(duì)于角色繼承，比如有角色A和B，B繼承A，如果要獲取A的ACL，只要去access_list查詢r(jià)oles_name為A的記錄即可，如果是B，則要查詢r(jià)oles_name為A和B的記錄。

從邏輯上看，role，roles_inherits, resource, resource_access應(yīng)不是ACL對(duì)象的組成部分，但是由于要管理這些資源，所有提供了對(duì)應(yīng)方法。

//acl object
$acl = new PhalconAclAdapterMemory();
$acl->setDefaultAction(PhalconAcl::DENY);
 
//role name description
$roleAdmins = new PhalconAclRole("Admin","Super-User role");        
$roleGuests = new PhalconAclRole("Guests");
$acl->addRole($roleGuests);
 
//roles_inhelit roles_name roles_inherit
$acl->addRole($roleAdmins, $roleGuests);
 
//resource name description
//resource_accesses resources_name access_name
$customersResource = new PhalconAclResource("Customers");
$acl->addResource($customersResource,array("search","edit"));
 
//access_list roles_name resources_name access_name
$acl->allow("Admin","Customers","search");
 
//check acl
//echo $acl->isAllowed("Admin","Customers","edit");
echo $acl->isAllowed("Admin","Customers","update");
    

一般至少要在執(zhí)行路由前要判斷用戶是否具有權(quán)限（一般在beforeDispatch中），所以ACL應(yīng)該在它之前獲得填充。以下代碼可參考：

public function beforeDispatch(Event $event, Dispatcher $dispatcher) {
 
    $auth = $this->session->get("auth");
    if (!$auth){
        $role = "Guests";
    } else {
        $role = "Users";
    }
 
    $controller = $dispatcher->getControllerName();
    $action = $dispatcher->getActionName();
 
    $acl = $this->getAcl();
 
    $allowed = $acl->isAllowed($role, $controller, $action);
    if ($allowed != Acl::ALLOW) {
        $this->flash->error("You don"t have access to this module");
        $dispatcher->forward(
            array(
                "controller" => "index",
                "action" => "index"
            )
        );
        return false;
    }
}

這里的getAcl()方法就是重點(diǎn)。參考：

public function getAcl() {
    if (!isset($this->persistent->acl)) {
  
        $acl = new PhalconAclAdapterMemory();
 
        $acl->setDefaultAction(PhalconAcl::DENY);
 
        //Register roles
        $roles = array(
            "users"  => new PhalconAclRole("Users"),
            "guests" => new PhalconAclRole("Guests")
        );
        foreach ($roles as $role) {
             $acl->addRole($role);
        }
 
        //Private area resources
        $privateResources = array(
            "companies"    => array("index", "search", "new", "edit", "save", "create", "delete"),
            "products"     => array("index", "search", "new", "edit", "save", "create", "delete"),
            "producttypes" => array("index", "search", "new", "edit", "save", "create", "delete"),
            "invoices"     => array("index", "profile")
    );
        foreach ($privateResources as $resource => $actions) {
            $acl->addResource(new PhalconAclResource($resource), $actions);
        }
 
        //Public area resources
        $publicResources = array(
            "index"   => array("index"),
            "about"   => array("index"),
            "session" => array("index", "register", "start", "end"),
            "contact" => array("index", "send")
        );
        foreach ($publicResources as $resource => $actions) {
            $acl->addResource(new PhalconAclResource($resource), $actions);
        }
 
        //Grant access to public areas to both users and guests
        foreach ($roles as $role) {
            foreach ($publicResources as $resource => $actions) {
                $acl->allow($role->getName(), $resource, "*");
            }
        }
 
        //Grant acess to private area to role Users
        foreach ($privateResources as $resource => $actions) {
            foreach ($actions as $action){
                $acl->allow("Users", $resource, $action);
            }
        }
 
        //The acl is stored in session, APC would be useful here too
        $this->persistent->acl = $acl;
    }
 
    return $this->persistent->acl;
}

這里把a(bǔ)cl對(duì)象保存在persistent中。

所有角色 資源 訪問(wèn)列表這些應(yīng)該是要可配置并且是要保存起來(lái)的。但是Phalcon當(dāng)前只提供PhalconAclAdapterMemory適配器，在它實(shí)例化后你需要手動(dòng)填充它，資源訪問(wèn)列表可以來(lái)自數(shù)據(jù)庫(kù)等，然后可以把這個(gè)對(duì)象緩存起來(lái)，https://github.com/phalcon/in...中提供了一個(gè)保存到數(shù)據(jù)庫(kù)的適配器，它可以根據(jù)數(shù)據(jù)表自動(dòng)填充，可以調(diào)用相關(guān)方法添加資源、角色、訪問(wèn)列表，而這些如果使用PhalconAclAdapterMemory，那么就要自己去實(shí)現(xiàn)。