diff --git a/livesupport/modules/alib/doc/aarfc.html b/livesupport/modules/alib/doc/aarfc.html new file mode 100644 index 000000000..9049622c1 --- /dev/null +++ b/livesupport/modules/alib/doc/aarfc.html @@ -0,0 +1,227 @@ + + +
+ Authentication - as user's identity
+checking - login call create and return auth token, client sends this token
+with all subsequent calls, logout call make this token invalid
+
Authorization - as checking user's +permission for called action on some object - that's main solved problem. +
+Where:
+ Subjects are divided into two types - users and groups. There is membership relation
+(type N:M) from subjects table to itself with "linearization" feature - for
+questions about it send me a mail please ;)
+This approach allows inserting user to group or group to group with quick
+searching of direct and indirect membership.
+
For simple use with existing projects, there would be a object tree +always separated from project's database tables. It would be implemented by +table of objects and information about parent/child (or other) relation +between objects. +
++There is also class table and N:M membership relation between objects and +classes. +
++RootNode + | + |-> Publication_A(publication) + | \-> Issue_1(issue) <--\ + | |-> Sport(section) | <--\ + | \-> Politics(section) | | + \-> Publication_B(publication) | | + |-> Issue_1(issue) <--| | + | |-> Politics(section) | | + | |-> Sport(section) | <--| + | \-> Culture(section) | | + \-> Issue_2(issue) <--| | + |-> Culture(section) | | + \-> Politics(section) | | + | | +Class "Issues" -------------------------------------------/ | +Class "Sport sections" -------------------------------------------/ ++ + + +
There are several ways to handle permissions - I've used this:
+allow/deny - all without allow
+permission is denied, but more specified setting may overcome less
+specified
+(e.g. group of users is allowed to do smth., but one specified group-member is
+denied)
+
Permissions are stored as triple [subject, action, object]
+and allow/deny flag.
+
Procedure of permission checking:
+Rem.: Some cache system for authorization decisions would be good ... +
+There are 3 main types of usage:
+Alib(&$dbc, $config)
returns objectlogin($login, $pass)
returns tokenlogout($sessid)
returns booleancheckToken($sessid)
returns booleanaddObj($name, $type, $parid, $aftid, $param)
returns intremoveObj($id)
returns booleanaddSubj($login, $pass)
returns intremoveSubj($login)
returns booleanaddPerm($sid, $action, $oid, $type)
returns intremovePerm($permid, $subj, $obj)
returns nullcheckPerm($sid, $action, $oid)
returns booleancopyObj($id, $newParid, $after)
returns intrenameObj($id, $newName)
returns booleangetParent($oid)
returns stringgetPath($id, $flds)
returns arraygetDir($id, $flds, $order)
returns arrayaddClass($cname)
returns intremoveClass($cname)
returns booleanaddObj2Class($cid, $oid)
returns booleanremoveObjFromClass($oid, $cid)
returns booleanaddSubj2Gr($login, $gname)
returns intremoveSubjFromGr($login, $gname)
returns booleanisGroup($gid)
returns booleanlistGroup($gid)
returns arrayAll methods may return PEAR::error object if fails ...
+ PHP applications could include Alib class and call API methods
+directly.
+Other programming platforms should call XMLRPC or HTTP layer above this API.
+
P.S.: sorry for my English ... ;)
+ + diff --git a/livesupport/modules/alib/doc/reference.html b/livesupport/modules/alib/doc/reference.html new file mode 100644 index 000000000..7de65ad0f --- /dev/null +++ b/livesupport/modules/alib/doc/reference.html @@ -0,0 +1,60 @@ + + +Classes may be replaced by one branch in object tree ...
+ + ++subjects < perms > objects/classes + < smemb + cmemb > ++ + +