RFC - Zend_Permission_Rbac

h2. What is RBAC?

From Wikipedia:

"In computer systems security, role-based access control (RBAC) is an approach to restricting system access to authorized users. It is used by the majority of enterprises with more than 500 employees,[3] and can implement mandatory access control (MAC) or discretionary access control (DAC). RBAC is sometimes referred to as role-based security."

h2. Proposal

The primary goals for this RFC are:

* Implement role-based access control as an *alternative* to access control lists (Zend\Permission\Acl).
* Utilize PHP 5.3 SPL datastructures (RecursiveIterator and RecursiveIteratorIterator).

h3. Architecture

The requirements are as follows:

* Many to many relationship between identities and roles.
* Many to many relationship between roles and permissions.
* A role can have a parent (inheritance must be supported).
* Dynamic assertions *must* be supported.

Given the requirements, RBAC is a perfect fit for a composite pattern ([http://en.wikipedia.org/wiki/Composite_pattern]) combined with SPL RecursiveIterator.

h3. Class skeletons

{code:php|title=ZendPermissionRbacAbstractIterator.php|borderStyle=solid}
<?php
namespace Zend\Permission\Rbac;

use RecursiveIterator;

abstract class AbstractIterator implements RecursiveIterator
{
public function current();

public function next();

public function key();

public function valid();

public function rewind();

public function hasChildren();

public function getChildren();
}
{code}

{code:php|title=ZendPermissionRbacAbstractRole.php|borderStyle=solid}
<?php
namespace Zend\Permission\Rbac;

abstract class AbstractRole extends AbstractIterator
{
public function getName();

public function addPermission($permission);

public function hasPermission($permission);

public function addChild($child);
}
{code}

{code:php|title=ZendPermissionRbacRbac.php|borderStyle=solid}
<?php
namespace Zend\Permission\Rbac;

class Rbacextends AbstractIterator
{
public function addRole($role);

public function hasRole($role);

public function getRole($role);

public function isGranted($permission);
}
{code}

{code:php|title=ZendPermissionRbacRole.php|borderStyle=solid}
<?php
namespace Zend\Permission\Rbac;

class Role extends AbstractRole
{
}

Dynamic assertions can be provided via an AssertionInterface (Zend\Permission\Rbac\AssertionInterface) or by simply passing a closure. For example,

{code:php|title=Zend\\Permission\\Rbac\\AssertionInterface|borderStyle=solid}
<?php

$event = new \My\Event;
$event->setUserId(1);

// Verify user has event.update permission and event user matches user.
$rbac->isGranted('event.update', function($rbac) use ($user, $event) {
return $user->getId() === $event->getUserId();
});
{code}

h3. Working example

The SpiffySecurity module currently implements the Rbac code and can be found at https://github.com/SpiffyJr/SpiffySecurity/tree/master/src/SpiffySecurity/Rbac.