我应该如何在 ACL 中构建资源树？
我想使用 PHP 和 Zend_ACL 创建一个极其灵活的权限系统。 我希望能够向特定类型的所有对象以及这些对象的实例分配权限。 如果查询对象的特定实例并且资源树中不存在该实例，则可以使用“通用”对象的权限集。 我的问题是，这需要嵌套，并且我无法找到一种无需多重继承的方法，而 Zend_ACL 不支持多重继承。
一个例子是这样的。 一个包含院系、课程和活动的在线学习网站。 每个活动都属于一个课程，每个课程都属于一个教师。 我希望能够允许每个教员角色访问所有课程（以及通过继承的活动），但特定教员希望他们的材料私有。 因此，我使资源树的结构为每个教师都有一个资源节点，并且每个课程都属于来自教师节点的该教师分支，而不是从通用课程节点分支，通用课程节点为每个课程提供默认权限。 使用新结构，我如何应用我的通用课程权限？ 课程下面的事件也是如此，如果我希望每个事件仅在父课程可读的情况下才可读，但我还想对每个事件应用一组默认的权限，如何组织树以使每个事件继承来自其父级并且它是没有多重继承的通用节点？
非常欢迎对不同系统的任何问题、意见或建议。
Using PHP and Zend_ACL, I want to create an extremely flexible permissions system. I want to be able to assign permissions to all objects of a certain type, as well as to instances of those objects. If a specific instance of an object is queried and it doesn't exist in the resource tree then the permission set for the 'generic' object can be used. My problem is that this needs to nest and I can't figure out a way to do it without multiple inheritance, which Zend_ACL doesn't support.
An example would be this. An online learning site with faculties, courses, and events. Each event belongs to a course, and each course to a faculty. I would like to be able to permit each faculty role to access all the courses (and events by inheritance), but a particular faculty wants their material private. So I make the structure of my resource tree have a resource node for each faculty and have each course belonging to that faculty branch from the faculty node instead of branching from the generic course node which gives each course it's default permissions. With the new structure how can I apply my generic course permissions? The same goes for events below courses, if I want each event to only be readable if the parent course is readable, but I also want to apply a default set of permissions to each event, how can I organize the tree such that each event inherits from its parent and it's generic node without multiple inheritance?
Any questions or comments or suggestions for a different system are very welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的多重继承问题全在您的脑海中 - 除非当然可以在多个院系中 - 等等。构建一个额外的“父资源”，可以从基础“课程”更改 ACL。
您不希望课程直接继承教师权限； 您可能希望有人能够为该学院（助教或其他人）编辑课程 - 但不是学院本身，对吗？
等
这将为您提供按教师划分的课程组，但仍继承默认的课程权限。 添加每个资源时，只需将其设为其组资源的父级，而组资源又是整个资源的父级。
如果您希望隐藏特定课程的所有事件 - 您只需在事件上设置权限：课程#
如果您希望能够对教师的所有事件设置权限，您只需在上面添加另一个“中间人”家长即可Event:Course1 也按教师对事件进行分组：
Events:Faculty2:Course1:Event3我发现权限系统十分之九你不需要（或想要混淆）多重继承。 如果您的访问控制比简单的树更复杂，您应该重新评估您的访问控制。
Your multiple inheritance problem is all in your head - unless of course can be in multiple faculties - etc. Build an additional "parent Resource" that can change ACL from the base "course".
You don't want the course to inherit the faculty permissions directly; you'll probably want someone to be able to edit the courses for that faculty (a TA or something) - but not the faculty itself right?
etc
This will give you groups of Courses by faculty, but still inherit default course permissions. As you add each resource - just make it parent to its group resource, which parents to the overall resource.
If you want all events for a particular course to be hidden - you just set a permission on Event:Course#
If you want to be able to set a permission on all events of a faculty, you can just add another "middleman" parent above Event:Course1 that groups Events by Faculty as well:
Events:Faculty2:Course1:Event3I've found for a permissions system 9 times out of 10 you don't need (or want the confusion) of multiple inheritance. If your access control is more complicated than a simple tree, you should re-evaluate your access control.
Zend ACL 非常灵活。 子资源的权限会覆盖从父资源继承的权限。 即使我没有完全理解你的例子，我认为 Zend ACL 模型支持你的设计。 您可以毫无问题地访问特定角色的特定资源。
尽管如此，也许您还可以阅读有关 断言，这给你额外的自由度。
Zend ACL is extremely flexible. Permissions from the child overwrite the inherited permissions from the parent resources. Even if I don't completely get your example, I think the Zend ACL model support your design. You can access to specific resources for specific roles, without any problem.
Nevertheless, maybe you can read also about assertions, which give you an extra degree of freedom.