[Slashcode-development] ACLs for slashcode

[Alvaro d. C. <ac...@ba...>]

Brian Aker wrote:
> 
> Alvaro del Castillo wrote:
> > Our main success has been to introduce an ACL scheme in Bender. We need
> > it because we have modified the software so each registered user can
> > have its own section and we have to give it the admin interface in a
> > controled way.
> Can you expllain how your ACL's work?


It's very simple:

We have created a new table users_acl

mysql> desc users_acl;
+-----------------+---------+------+-----+---------+-------+
| Field           | Type    | Null | Key | Default | Extra |
+-----------------+---------+------+-----+---------+-------+
| uid             | int(11) |      | PRI | 0       |       |
| op_insert_index | text    | YES  |     | NULL    |       |
| op_delete_index | text    | YES  |     | NULL    |       |
| op_admin_index  | text    | YES  |     | NULL    |       |
+-----------------+---------+------+-----+---------+-------+


At the moment we only need to control this three operations, but the
scheme can be expanded easily.

When a user reach the site, in the users object we also put the ACLs. So
in $user->{op_insert_index} appear all the sections in which the user
can
insert stories. An so on with the other operations.

For example:

mysql> select op_insert_index from users_acl where uid=45;
+--------------------------------------------------------------------------------------------------------------------------------+
|
op_insert_index                                                                                                               
|
+--------------------------------------------------------------------------------------------------------------------------------+
|
'mbp-acs','index','kde','gnome','mbp-rodrigo','solo-es','solo-mx','mbp-esteve','empresas','boinapunto','mbp-giordino','debian'
|
+--------------------------------------------------------------------------------------------------------------------------------+
1 row in set (0.00 sec)

If we want to create a new ACL that control if a user can insert polls
in
a section, it's easy. We modify the table and add a new column with the
new
operation.

The functions that controls if a user has a correct ACL are independant 
of the number of operations that appear in that table.

This functions are:

getACLindex ($op,$index)
removeACLindex($uid,$op,$op_indexes) (it works for several indexes)
saveACLindex($uid,$op,$op_indexes) (it works for several indexes)

The getACLindex don't touch the database because all the information
that it needs is the $user object.

For example, if you want to let the user use admin.pl in a ACL way:

admin.pl (1.09):

...

if (($op eq 'edit')&&(getACLindex("op_insert_index","*"))) {
                        editstory($I{F}{sid});

With $index value equal "*" getACLindex returns true if the user can
insert
stories in some index.

In our site we have the two schemes, ACLs and seclev, working together
but
we plan to migrate everything to the ACLs scheme. The migration from 
one scheme to the other is not difficult and can be done smoothly.

At the moment, with users_acl we only can control using the section
concept
but it could be easy to expand the model.

The key is that this scheme is integrated with slashcode in a clean way.
We have migrated to bender very easy. Only we have to modify Slash::DB
to
tell getUser and setUser to take the data also from users_acl.

In our site we have developed this idea and we have the concept of 
MySlash. An user can has it own "mini-slash site" integrated with 
the site. For this we have to make another key change in slashcode
architecture: an story can appear the same in more than one section.
This little change, a new table that relation stories and sections, 
has enabled us to build a great stories syndication platform.

I hope I have explain everything clear but maybe, the patch will show
you
the details. It could be great to integrate our work with the main
slashcode root.

Cheers

-- Alvaro



> 
> > Also, I am writing a doc about Bender architeture. Some Dia diagrams and
> > some text describing the architectura. Is there any doc yet about Bender
> > architetcure?
> I am working on such a beast and one should exist by monday.
>         -Brian
> --
> _______________________________________________________
> Brian Aker, br...@ta...
> Slashdot Senior Developer
> Seattle, Washington
> http://tangent.org/~brian/
> http://slashdot.org/
> _______________________________________________________
> You can't grep a dead tree.
> 
> _______________________________________________
> Slashcode-development mailing list
> Sla...@li...
> http://lists.sourceforge.net/lists/listinfo/slashcode-development

-- 
===================================================
Alvaro del Castillo San Félix	ac...@ba...
Barrapunto.com