diff --git a/livesupport/modules/alib/doc/aarfc.html b/livesupport/modules/alib/doc/aarfc.html new file mode 100644 index 000000000..9049622c1 --- /dev/null +++ b/livesupport/modules/alib/doc/aarfc.html @@ -0,0 +1,227 @@ + + +
+ Authentication - as user's identity
+checking - login call create and return auth token, client sends this token
+with all subsequent calls, logout call make this token invalid
+
Authorization - as checking user's +permission for called action on some object - that's main solved problem. +
+Where:
+ Subjects are divided into two types - users and groups. There is membership relation
+(type N:M) from subjects table to itself with "linearization" feature - for
+questions about it send me a mail please ;)
+This approach allows inserting user to group or group to group with quick
+searching of direct and indirect membership.
+
For simple use with existing projects, there would be a object tree +always separated from project's database tables. It would be implemented by +table of objects and information about parent/child (or other) relation +between objects. +
++There is also class table and N:M membership relation between objects and +classes. +
++RootNode + | + |-> Publication_A(publication) + | \-> Issue_1(issue) <--\ + | |-> Sport(section) | <--\ + | \-> Politics(section) | | + \-> Publication_B(publication) | | + |-> Issue_1(issue) <--| | + | |-> Politics(section) | | + | |-> Sport(section) | <--| + | \-> Culture(section) | | + \-> Issue_2(issue) <--| | + |-> Culture(section) | | + \-> Politics(section) | | + | | +Class "Issues" -------------------------------------------/ | +Class "Sport sections" -------------------------------------------/ ++ + + +
There are several ways to handle permissions - I've used this:
+allow/deny - all without allow
+permission is denied, but more specified setting may overcome less
+specified
+(e.g. group of users is allowed to do smth., but one specified group-member is
+denied)
+
Permissions are stored as triple [subject, action, object]
+and allow/deny flag.
+
Procedure of permission checking:
+Rem.: Some cache system for authorization decisions would be good ... +
+There are 3 main types of usage:
+Alib(&$dbc, $config) returns objectlogin($login, $pass) returns tokenlogout($sessid) returns booleancheckToken($sessid) returns booleanaddObj($name, $type, $parid, $aftid, $param) returns intremoveObj($id) returns booleanaddSubj($login, $pass) returns intremoveSubj($login) returns booleanaddPerm($sid, $action, $oid, $type) returns intremovePerm($permid, $subj, $obj) returns nullcheckPerm($sid, $action, $oid) returns booleancopyObj($id, $newParid, $after) returns intrenameObj($id, $newName) returns booleangetParent($oid) returns stringgetPath($id, $flds) returns arraygetDir($id, $flds, $order) returns arrayaddClass($cname) returns intremoveClass($cname) returns booleanaddObj2Class($cid, $oid) returns booleanremoveObjFromClass($oid, $cid) returns booleanaddSubj2Gr($login, $gname) returns intremoveSubjFromGr($login, $gname) returns booleanisGroup($gid) returns booleanlistGroup($gid) returns arrayAll methods may return PEAR::error object if fails ...
+ PHP applications could include Alib class and call API methods
+directly.
+Other programming platforms should call XMLRPC or HTTP layer above this API.
+
P.S.: sorry for my English ... ;)
+ + diff --git a/livesupport/modules/alib/doc/reference.html b/livesupport/modules/alib/doc/reference.html new file mode 100644 index 000000000..7de65ad0f --- /dev/null +++ b/livesupport/modules/alib/doc/reference.html @@ -0,0 +1,60 @@ + + +Classes may be replaced by one branch in object tree ...
+ + ++subjects < perms > objects/classes + < smemb + cmemb > ++ + +