Du kannst nicht mehr als 25 Themen auswählen Themen müssen entweder mit einem Buchstaben oder einer Ziffer beginnen. Sie können Bindestriche („-“) enthalten und bis zu 35 Zeichen lang sein.

878 Zeilen
25KB

  1. <?php
  2. /**
  3. * @link http://www.yiiframework.com/
  4. * @copyright Copyright (c) 2008 Yii Software LLC
  5. * @license http://www.yiiframework.com/license/
  6. */
  7. namespace yii\rbac;
  8. use yii\base\InvalidCallException;
  9. use yii\base\InvalidParamException;
  10. use Yii;
  11. use yii\helpers\VarDumper;
  12. /**
  13. * PhpManager represents an authorization manager that stores authorization
  14. * information in terms of a PHP script file.
  15. *
  16. * The authorization data will be saved to and loaded from three files
  17. * specified by [[itemFile]], [[assignmentFile]] and [[ruleFile]].
  18. *
  19. * PhpManager is mainly suitable for authorization data that is not too big
  20. * (for example, the authorization data for a personal blog system).
  21. * Use [[DbManager]] for more complex authorization data.
  22. *
  23. * Note that PhpManager is not compatible with facebooks [HHVM](http://hhvm.com/) because
  24. * it relies on writing php files and including them afterwards which is not supported by HHVM.
  25. *
  26. * @author Qiang Xue <qiang.xue@gmail.com>
  27. * @author Alexander Kochetov <creocoder@gmail.com>
  28. * @author Christophe Boulain <christophe.boulain@gmail.com>
  29. * @author Alexander Makarov <sam@rmcreative.ru>
  30. * @since 2.0
  31. */
  32. class PhpManager extends BaseManager
  33. {
  34. /**
  35. * @var string the path of the PHP script that contains the authorization items.
  36. * This can be either a file path or a path alias to the file.
  37. * Make sure this file is writable by the Web server process if the authorization needs to be changed online.
  38. * @see loadFromFile()
  39. * @see saveToFile()
  40. */
  41. public $itemFile = '@app/rbac/items.php';
  42. /**
  43. * @var string the path of the PHP script that contains the authorization assignments.
  44. * This can be either a file path or a path alias to the file.
  45. * Make sure this file is writable by the Web server process if the authorization needs to be changed online.
  46. * @see loadFromFile()
  47. * @see saveToFile()
  48. */
  49. public $assignmentFile = '@app/rbac/assignments.php';
  50. /**
  51. * @var string the path of the PHP script that contains the authorization rules.
  52. * This can be either a file path or a path alias to the file.
  53. * Make sure this file is writable by the Web server process if the authorization needs to be changed online.
  54. * @see loadFromFile()
  55. * @see saveToFile()
  56. */
  57. public $ruleFile = '@app/rbac/rules.php';
  58. /**
  59. * @var Item[]
  60. */
  61. protected $items = []; // itemName => item
  62. /**
  63. * @var array
  64. */
  65. protected $children = []; // itemName, childName => child
  66. /**
  67. * @var array
  68. */
  69. protected $assignments = []; // userId, itemName => assignment
  70. /**
  71. * @var Rule[]
  72. */
  73. protected $rules = []; // ruleName => rule
  74. /**
  75. * Initializes the application component.
  76. * This method overrides parent implementation by loading the authorization data
  77. * from PHP script.
  78. */
  79. public function init()
  80. {
  81. parent::init();
  82. $this->itemFile = Yii::getAlias($this->itemFile);
  83. $this->assignmentFile = Yii::getAlias($this->assignmentFile);
  84. $this->ruleFile = Yii::getAlias($this->ruleFile);
  85. $this->load();
  86. }
  87. /**
  88. * @inheritdoc
  89. */
  90. public function checkAccess($userId, $permissionName, $params = [])
  91. {
  92. $assignments = $this->getAssignments($userId);
  93. return $this->checkAccessRecursive($userId, $permissionName, $params, $assignments);
  94. }
  95. /**
  96. * @inheritdoc
  97. */
  98. public function getAssignments($userId)
  99. {
  100. return isset($this->assignments[$userId]) ? $this->assignments[$userId] : [];
  101. }
  102. /**
  103. * Performs access check for the specified user.
  104. * This method is internally called by [[checkAccess()]].
  105. *
  106. * @param string|integer $user the user ID. This should can be either an integer or a string representing
  107. * the unique identifier of a user. See [[\yii\web\User::id]].
  108. * @param string $itemName the name of the operation that need access check
  109. * @param array $params name-value pairs that would be passed to rules associated
  110. * with the tasks and roles assigned to the user. A param with name 'user' is added to this array,
  111. * which holds the value of `$userId`.
  112. * @param Assignment[] $assignments the assignments to the specified user
  113. * @return boolean whether the operations can be performed by the user.
  114. */
  115. protected function checkAccessRecursive($user, $itemName, $params, $assignments)
  116. {
  117. if (!isset($this->items[$itemName])) {
  118. return false;
  119. }
  120. /* @var $item Item */
  121. $item = $this->items[$itemName];
  122. Yii::trace($item instanceof Role ? "Checking role: $itemName" : "Checking permission : $itemName", __METHOD__);
  123. if (!$this->executeRule($user, $item, $params)) {
  124. return false;
  125. }
  126. if (isset($assignments[$itemName]) || in_array($itemName, $this->defaultRoles)) {
  127. return true;
  128. }
  129. foreach ($this->children as $parentName => $children) {
  130. if (isset($children[$itemName]) && $this->checkAccessRecursive($user, $parentName, $params, $assignments)) {
  131. return true;
  132. }
  133. }
  134. return false;
  135. }
  136. /**
  137. * @inheritdoc
  138. * @since 2.0.8
  139. */
  140. public function canAddChild($parent, $child)
  141. {
  142. return !$this->detectLoop($parent, $child);
  143. }
  144. /**
  145. * @inheritdoc
  146. */
  147. public function addChild($parent, $child)
  148. {
  149. if (!isset($this->items[$parent->name], $this->items[$child->name])) {
  150. throw new InvalidParamException("Either '{$parent->name}' or '{$child->name}' does not exist.");
  151. }
  152. if ($parent->name === $child->name) {
  153. throw new InvalidParamException("Cannot add '{$parent->name} ' as a child of itself.");
  154. }
  155. if ($parent instanceof Permission && $child instanceof Role) {
  156. throw new InvalidParamException('Cannot add a role as a child of a permission.');
  157. }
  158. if ($this->detectLoop($parent, $child)) {
  159. throw new InvalidCallException("Cannot add '{$child->name}' as a child of '{$parent->name}'. A loop has been detected.");
  160. }
  161. if (isset($this->children[$parent->name][$child->name])) {
  162. throw new InvalidCallException("The item '{$parent->name}' already has a child '{$child->name}'.");
  163. }
  164. $this->children[$parent->name][$child->name] = $this->items[$child->name];
  165. $this->saveItems();
  166. return true;
  167. }
  168. /**
  169. * Checks whether there is a loop in the authorization item hierarchy.
  170. *
  171. * @param Item $parent parent item
  172. * @param Item $child the child item that is to be added to the hierarchy
  173. * @return boolean whether a loop exists
  174. */
  175. protected function detectLoop($parent, $child)
  176. {
  177. if ($child->name === $parent->name) {
  178. return true;
  179. }
  180. if (!isset($this->children[$child->name], $this->items[$parent->name])) {
  181. return false;
  182. }
  183. foreach ($this->children[$child->name] as $grandchild) {
  184. /* @var $grandchild Item */
  185. if ($this->detectLoop($parent, $grandchild)) {
  186. return true;
  187. }
  188. }
  189. return false;
  190. }
  191. /**
  192. * @inheritdoc
  193. */
  194. public function removeChild($parent, $child)
  195. {
  196. if (isset($this->children[$parent->name][$child->name])) {
  197. unset($this->children[$parent->name][$child->name]);
  198. $this->saveItems();
  199. return true;
  200. } else {
  201. return false;
  202. }
  203. }
  204. /**
  205. * @inheritdoc
  206. */
  207. public function removeChildren($parent)
  208. {
  209. if (isset($this->children[$parent->name])) {
  210. unset($this->children[$parent->name]);
  211. $this->saveItems();
  212. return true;
  213. } else {
  214. return false;
  215. }
  216. }
  217. /**
  218. * @inheritdoc
  219. */
  220. public function hasChild($parent, $child)
  221. {
  222. return isset($this->children[$parent->name][$child->name]);
  223. }
  224. /**
  225. * @inheritdoc
  226. */
  227. public function assign($role, $userId)
  228. {
  229. if (!isset($this->items[$role->name])) {
  230. throw new InvalidParamException("Unknown role '{$role->name}'.");
  231. } elseif (isset($this->assignments[$userId][$role->name])) {
  232. throw new InvalidParamException("Authorization item '{$role->name}' has already been assigned to user '$userId'.");
  233. } else {
  234. $this->assignments[$userId][$role->name] = new Assignment([
  235. 'userId' => $userId,
  236. 'roleName' => $role->name,
  237. 'createdAt' => time(),
  238. ]);
  239. $this->saveAssignments();
  240. return $this->assignments[$userId][$role->name];
  241. }
  242. }
  243. /**
  244. * @inheritdoc
  245. */
  246. public function revoke($role, $userId)
  247. {
  248. if (isset($this->assignments[$userId][$role->name])) {
  249. unset($this->assignments[$userId][$role->name]);
  250. $this->saveAssignments();
  251. return true;
  252. } else {
  253. return false;
  254. }
  255. }
  256. /**
  257. * @inheritdoc
  258. */
  259. public function revokeAll($userId)
  260. {
  261. if (isset($this->assignments[$userId]) && is_array($this->assignments[$userId])) {
  262. foreach ($this->assignments[$userId] as $itemName => $value) {
  263. unset($this->assignments[$userId][$itemName]);
  264. }
  265. $this->saveAssignments();
  266. return true;
  267. } else {
  268. return false;
  269. }
  270. }
  271. /**
  272. * @inheritdoc
  273. */
  274. public function getAssignment($roleName, $userId)
  275. {
  276. return isset($this->assignments[$userId][$roleName]) ? $this->assignments[$userId][$roleName] : null;
  277. }
  278. /**
  279. * @inheritdoc
  280. */
  281. public function getItems($type)
  282. {
  283. $items = [];
  284. foreach ($this->items as $name => $item) {
  285. /* @var $item Item */
  286. if ($item->type == $type) {
  287. $items[$name] = $item;
  288. }
  289. }
  290. return $items;
  291. }
  292. /**
  293. * @inheritdoc
  294. */
  295. public function removeItem($item)
  296. {
  297. if (isset($this->items[$item->name])) {
  298. foreach ($this->children as &$children) {
  299. unset($children[$item->name]);
  300. }
  301. foreach ($this->assignments as &$assignments) {
  302. unset($assignments[$item->name]);
  303. }
  304. unset($this->items[$item->name]);
  305. $this->saveItems();
  306. $this->saveAssignments();
  307. return true;
  308. } else {
  309. return false;
  310. }
  311. }
  312. /**
  313. * @inheritdoc
  314. */
  315. public function getItem($name)
  316. {
  317. return isset($this->items[$name]) ? $this->items[$name] : null;
  318. }
  319. /**
  320. * @inheritdoc
  321. */
  322. public function updateRule($name, $rule)
  323. {
  324. if ($rule->name !== $name) {
  325. unset($this->rules[$name]);
  326. }
  327. $this->rules[$rule->name] = $rule;
  328. $this->saveRules();
  329. return true;
  330. }
  331. /**
  332. * @inheritdoc
  333. */
  334. public function getRule($name)
  335. {
  336. return isset($this->rules[$name]) ? $this->rules[$name] : null;
  337. }
  338. /**
  339. * @inheritdoc
  340. */
  341. public function getRules()
  342. {
  343. return $this->rules;
  344. }
  345. /**
  346. * @inheritdoc
  347. */
  348. public function getRolesByUser($userId)
  349. {
  350. $roles = [];
  351. foreach ($this->getAssignments($userId) as $name => $assignment) {
  352. $role = $this->items[$assignment->roleName];
  353. if ($role->type === Item::TYPE_ROLE) {
  354. $roles[$name] = $role;
  355. }
  356. }
  357. return $roles;
  358. }
  359. /**
  360. * @inheritdoc
  361. */
  362. public function getChildRoles($roleName)
  363. {
  364. $role = $this->getRole($roleName);
  365. if (is_null($role)) {
  366. throw new InvalidParamException("Role \"$roleName\" not found.");
  367. }
  368. /** @var $result Item[] */
  369. $this->getChildrenRecursive($roleName, $result);
  370. $roles = [$roleName => $role];
  371. $roles += array_filter($this->getRoles(), function (Role $roleItem) use ($result) {
  372. return array_key_exists($roleItem->name, $result);
  373. });
  374. return $roles;
  375. }
  376. /**
  377. * @inheritdoc
  378. */
  379. public function getPermissionsByRole($roleName)
  380. {
  381. $result = [];
  382. $this->getChildrenRecursive($roleName, $result);
  383. if (empty($result)) {
  384. return [];
  385. }
  386. $permissions = [];
  387. foreach (array_keys($result) as $itemName) {
  388. if (isset($this->items[$itemName]) && $this->items[$itemName] instanceof Permission) {
  389. $permissions[$itemName] = $this->items[$itemName];
  390. }
  391. }
  392. return $permissions;
  393. }
  394. /**
  395. * Recursively finds all children and grand children of the specified item.
  396. *
  397. * @param string $name the name of the item whose children are to be looked for.
  398. * @param array $result the children and grand children (in array keys)
  399. */
  400. protected function getChildrenRecursive($name, &$result)
  401. {
  402. if (isset($this->children[$name])) {
  403. foreach ($this->children[$name] as $child) {
  404. $result[$child->name] = true;
  405. $this->getChildrenRecursive($child->name, $result);
  406. }
  407. }
  408. }
  409. /**
  410. * @inheritdoc
  411. */
  412. public function getPermissionsByUser($userId)
  413. {
  414. $directPermission = $this->getDirectPermissionsByUser($userId);
  415. $inheritedPermission = $this->getInheritedPermissionsByUser($userId);
  416. return array_merge($directPermission, $inheritedPermission);
  417. }
  418. /**
  419. * Returns all permissions that are directly assigned to user.
  420. * @param string|integer $userId the user ID (see [[\yii\web\User::id]])
  421. * @return Permission[] all direct permissions that the user has. The array is indexed by the permission names.
  422. * @since 2.0.7
  423. */
  424. protected function getDirectPermissionsByUser($userId)
  425. {
  426. $permissions = [];
  427. foreach ($this->getAssignments($userId) as $name => $assignment) {
  428. $permission = $this->items[$assignment->roleName];
  429. if ($permission->type === Item::TYPE_PERMISSION) {
  430. $permissions[$name] = $permission;
  431. }
  432. }
  433. return $permissions;
  434. }
  435. /**
  436. * Returns all permissions that the user inherits from the roles assigned to him.
  437. * @param string|integer $userId the user ID (see [[\yii\web\User::id]])
  438. * @return Permission[] all inherited permissions that the user has. The array is indexed by the permission names.
  439. * @since 2.0.7
  440. */
  441. protected function getInheritedPermissionsByUser($userId)
  442. {
  443. $assignments = $this->getAssignments($userId);
  444. $result = [];
  445. foreach (array_keys($assignments) as $roleName) {
  446. $this->getChildrenRecursive($roleName, $result);
  447. }
  448. if (empty($result)) {
  449. return [];
  450. }
  451. $permissions = [];
  452. foreach (array_keys($result) as $itemName) {
  453. if (isset($this->items[$itemName]) && $this->items[$itemName] instanceof Permission) {
  454. $permissions[$itemName] = $this->items[$itemName];
  455. }
  456. }
  457. return $permissions;
  458. }
  459. /**
  460. * @inheritdoc
  461. */
  462. public function getChildren($name)
  463. {
  464. return isset($this->children[$name]) ? $this->children[$name] : [];
  465. }
  466. /**
  467. * @inheritdoc
  468. */
  469. public function removeAll()
  470. {
  471. $this->children = [];
  472. $this->items = [];
  473. $this->assignments = [];
  474. $this->rules = [];
  475. $this->save();
  476. }
  477. /**
  478. * @inheritdoc
  479. */
  480. public function removeAllPermissions()
  481. {
  482. $this->removeAllItems(Item::TYPE_PERMISSION);
  483. }
  484. /**
  485. * @inheritdoc
  486. */
  487. public function removeAllRoles()
  488. {
  489. $this->removeAllItems(Item::TYPE_ROLE);
  490. }
  491. /**
  492. * Removes all auth items of the specified type.
  493. * @param integer $type the auth item type (either Item::TYPE_PERMISSION or Item::TYPE_ROLE)
  494. */
  495. protected function removeAllItems($type)
  496. {
  497. $names = [];
  498. foreach ($this->items as $name => $item) {
  499. if ($item->type == $type) {
  500. unset($this->items[$name]);
  501. $names[$name] = true;
  502. }
  503. }
  504. if (empty($names)) {
  505. return;
  506. }
  507. foreach ($this->assignments as $i => $assignments) {
  508. foreach ($assignments as $n => $assignment) {
  509. if (isset($names[$assignment->roleName])) {
  510. unset($this->assignments[$i][$n]);
  511. }
  512. }
  513. }
  514. foreach ($this->children as $name => $children) {
  515. if (isset($names[$name])) {
  516. unset($this->children[$name]);
  517. } else {
  518. foreach ($children as $childName => $item) {
  519. if (isset($names[$childName])) {
  520. unset($children[$childName]);
  521. }
  522. }
  523. $this->children[$name] = $children;
  524. }
  525. }
  526. $this->saveItems();
  527. }
  528. /**
  529. * @inheritdoc
  530. */
  531. public function removeAllRules()
  532. {
  533. foreach ($this->items as $item) {
  534. $item->ruleName = null;
  535. }
  536. $this->rules = [];
  537. $this->saveRules();
  538. }
  539. /**
  540. * @inheritdoc
  541. */
  542. public function removeAllAssignments()
  543. {
  544. $this->assignments = [];
  545. $this->saveAssignments();
  546. }
  547. /**
  548. * @inheritdoc
  549. */
  550. protected function removeRule($rule)
  551. {
  552. if (isset($this->rules[$rule->name])) {
  553. unset($this->rules[$rule->name]);
  554. foreach ($this->items as $item) {
  555. if ($item->ruleName === $rule->name) {
  556. $item->ruleName = null;
  557. }
  558. }
  559. $this->saveRules();
  560. return true;
  561. } else {
  562. return false;
  563. }
  564. }
  565. /**
  566. * @inheritdoc
  567. */
  568. protected function addRule($rule)
  569. {
  570. $this->rules[$rule->name] = $rule;
  571. $this->saveRules();
  572. return true;
  573. }
  574. /**
  575. * @inheritdoc
  576. */
  577. protected function updateItem($name, $item)
  578. {
  579. if ($name !== $item->name) {
  580. if (isset($this->items[$item->name])) {
  581. throw new InvalidParamException("Unable to change the item name. The name '{$item->name}' is already used by another item.");
  582. } else {
  583. // Remove old item in case of renaming
  584. unset($this->items[$name]);
  585. if (isset($this->children[$name])) {
  586. $this->children[$item->name] = $this->children[$name];
  587. unset($this->children[$name]);
  588. }
  589. foreach ($this->children as &$children) {
  590. if (isset($children[$name])) {
  591. $children[$item->name] = $children[$name];
  592. unset($children[$name]);
  593. }
  594. }
  595. foreach ($this->assignments as &$assignments) {
  596. if (isset($assignments[$name])) {
  597. $assignments[$item->name] = $assignments[$name];
  598. $assignments[$item->name]->roleName = $item->name;
  599. unset($assignments[$name]);
  600. }
  601. }
  602. $this->saveAssignments();
  603. }
  604. }
  605. $this->items[$item->name] = $item;
  606. $this->saveItems();
  607. return true;
  608. }
  609. /**
  610. * @inheritdoc
  611. */
  612. protected function addItem($item)
  613. {
  614. $time = time();
  615. if ($item->createdAt === null) {
  616. $item->createdAt = $time;
  617. }
  618. if ($item->updatedAt === null) {
  619. $item->updatedAt = $time;
  620. }
  621. $this->items[$item->name] = $item;
  622. $this->saveItems();
  623. return true;
  624. }
  625. /**
  626. * Loads authorization data from persistent storage.
  627. */
  628. protected function load()
  629. {
  630. $this->children = [];
  631. $this->rules = [];
  632. $this->assignments = [];
  633. $this->items = [];
  634. $items = $this->loadFromFile($this->itemFile);
  635. $itemsMtime = @filemtime($this->itemFile);
  636. $assignments = $this->loadFromFile($this->assignmentFile);
  637. $assignmentsMtime = @filemtime($this->assignmentFile);
  638. $rules = $this->loadFromFile($this->ruleFile);
  639. foreach ($items as $name => $item) {
  640. $class = $item['type'] == Item::TYPE_PERMISSION ? Permission::className() : Role::className();
  641. $this->items[$name] = new $class([
  642. 'name' => $name,
  643. 'description' => isset($item['description']) ? $item['description'] : null,
  644. 'ruleName' => isset($item['ruleName']) ? $item['ruleName'] : null,
  645. 'data' => isset($item['data']) ? $item['data'] : null,
  646. 'createdAt' => $itemsMtime,
  647. 'updatedAt' => $itemsMtime,
  648. ]);
  649. }
  650. foreach ($items as $name => $item) {
  651. if (isset($item['children'])) {
  652. foreach ($item['children'] as $childName) {
  653. if (isset($this->items[$childName])) {
  654. $this->children[$name][$childName] = $this->items[$childName];
  655. }
  656. }
  657. }
  658. }
  659. foreach ($assignments as $userId => $roles) {
  660. foreach ($roles as $role) {
  661. $this->assignments[$userId][$role] = new Assignment([
  662. 'userId' => $userId,
  663. 'roleName' => $role,
  664. 'createdAt' => $assignmentsMtime,
  665. ]);
  666. }
  667. }
  668. foreach ($rules as $name => $ruleData) {
  669. $this->rules[$name] = unserialize($ruleData);
  670. }
  671. }
  672. /**
  673. * Saves authorization data into persistent storage.
  674. */
  675. protected function save()
  676. {
  677. $this->saveItems();
  678. $this->saveAssignments();
  679. $this->saveRules();
  680. }
  681. /**
  682. * Loads the authorization data from a PHP script file.
  683. *
  684. * @param string $file the file path.
  685. * @return array the authorization data
  686. * @see saveToFile()
  687. */
  688. protected function loadFromFile($file)
  689. {
  690. if (is_file($file)) {
  691. return require($file);
  692. } else {
  693. return [];
  694. }
  695. }
  696. /**
  697. * Saves the authorization data to a PHP script file.
  698. *
  699. * @param array $data the authorization data
  700. * @param string $file the file path.
  701. * @see loadFromFile()
  702. */
  703. protected function saveToFile($data, $file)
  704. {
  705. file_put_contents($file, "<?php\nreturn " . VarDumper::export($data) . ";\n", LOCK_EX);
  706. $this->invalidateScriptCache($file);
  707. }
  708. /**
  709. * Invalidates precompiled script cache (such as OPCache or APC) for the given file.
  710. * @param string $file the file path.
  711. * @since 2.0.9
  712. */
  713. protected function invalidateScriptCache($file)
  714. {
  715. if (function_exists('opcache_invalidate')) {
  716. opcache_invalidate($file, true);
  717. }
  718. if (function_exists('apc_delete_file')) {
  719. @apc_delete_file($file);
  720. }
  721. }
  722. /**
  723. * Saves items data into persistent storage.
  724. */
  725. protected function saveItems()
  726. {
  727. $items = [];
  728. foreach ($this->items as $name => $item) {
  729. /* @var $item Item */
  730. $items[$name] = array_filter(
  731. [
  732. 'type' => $item->type,
  733. 'description' => $item->description,
  734. 'ruleName' => $item->ruleName,
  735. 'data' => $item->data,
  736. ]
  737. );
  738. if (isset($this->children[$name])) {
  739. foreach ($this->children[$name] as $child) {
  740. /* @var $child Item */
  741. $items[$name]['children'][] = $child->name;
  742. }
  743. }
  744. }
  745. $this->saveToFile($items, $this->itemFile);
  746. }
  747. /**
  748. * Saves assignments data into persistent storage.
  749. */
  750. protected function saveAssignments()
  751. {
  752. $assignmentData = [];
  753. foreach ($this->assignments as $userId => $assignments) {
  754. foreach ($assignments as $name => $assignment) {
  755. /* @var $assignment Assignment */
  756. $assignmentData[$userId][] = $assignment->roleName;
  757. }
  758. }
  759. $this->saveToFile($assignmentData, $this->assignmentFile);
  760. }
  761. /**
  762. * Saves rules data into persistent storage.
  763. */
  764. protected function saveRules()
  765. {
  766. $rules = [];
  767. foreach ($this->rules as $name => $rule) {
  768. $rules[$name] = serialize($rule);
  769. }
  770. $this->saveToFile($rules, $this->ruleFile);
  771. }
  772. /**
  773. * @inheritdoc
  774. * @since 2.0.7
  775. */
  776. public function getUserIdsByRole($roleName)
  777. {
  778. $result = [];
  779. foreach ($this->assignments as $userID => $assignments) {
  780. foreach ($assignments as $userAssignment) {
  781. if ($userAssignment->roleName === $roleName && $userAssignment->userId == $userID) {
  782. $result[] = (string)$userID;
  783. }
  784. }
  785. }
  786. return $result;
  787. }
  788. }