访问控制

一、基本概论
在Rong_Framework中,访问控制由角色和属性组成。角色可以有多个上层角色,属性也可以有多个上层属性。一个角色有上层属性的权限,它必将有下层属性的权限。一个角色可以被授权予多个属性。
二、示例
public function aclAction()
{
	require_once 'Rong/Acl.php';
	$acl = new Rong_Acl();
	/*
	 *  + - guest												     + - hehe
	 *       + - national_news_admin					      + - haha
	 *                +------------  national_news_admin  --+
	 */
	$acl ->addRole( new Rong_Acl_Role( "guest" ))
					->addRole( new Rong_Acl_Role( "national_news_admin" , array("guest" ) ))
					->addRole( new Rong_Acl_Role( "hehe" ))
					->addRole( new Rong_Acl_Role( "haha" , array("hehe" ) ))
					->addRole( new Rong_Acl_Role( "news_admin"  , array( "national_news_admin" , "haha" ) ))
					 
					->addRole( new Rong_Acl_Role( "guestbook_admin" ));
	
	$acl->addProperty( new Rong_Acl_Property( "news" ) )
				  ->addProperty( new Rong_Acl_Property( "national_news" , array( "news") ) );

	$acl->addAccount( new Rong_Acl_Account( "yaqy" ) )
				  ->addAccount( new Rong_Acl_Account( "yangqingrong" , array("guest" , "guestbook_admin")) );

	$acl->grantRole( "guestbook_admin" , "news" , array("read" , "check" , "chat" ))
				  ->grantRole( "guest" , "news" , array("read"  ));
				  

	$acl->revokeRole( "guestbook_admin" , "news" , array( "read" , "check" ));
	//  $acl->revokeRole( "guestbook_admin" , "news" , "ALL");
	if( $acl->isRoleGranted( "guest" , "news" , "read" ) )
	{
		echo "hello,授权了。";
	}
	//判断是否有权限,读出所有角色名的父名,并存入返回字符串。用,打散,逐角色去取实体的,取实体的父实体,看是否存在
	echo $acl->getParentRoles( "news_admin" );
	$acl->getParentProperties( "national_news");
	echo $acl->parentPropertiesLine;
	if( $acl->isGranted( "haha" , "national_news" , "read" ) )
	{
	   echo "guest 有读新闻的权限";
	}
	else
	{
	   echo "没有权限读新闻";
	}
	$aclString = serialize( $acl );
	echo $aclString;
	$newObj = unserialize( $aclString );
	print_r( $newObj );
}