User role-based authorization action class. More...

#include <Cutelyst/RoleACL>

Inheritance diagram for Cutelyst::RoleACL:

Public Member Functions
	RoleACL (QObject *parent=nullptr)

virtual bool	aroundExecute (Context c, QStack< Component > stack) override

bool	canVisit (Context *c) const

virtual bool	init (Application *application, const QVariantHash &args) override

virtual Modifiers	modifiers () const override

Public Member Functions inherited from Cutelyst::Component
	Component (QObject *parent=nullptr)

bool	execute (Context *c)

QString	name () const

QString	reverse () const

void	setName (const QString &name)

void	setReverse (const QString &reverse)

Public Member Functions inherited from QObject
	QObject (QObject *parent)

bool	blockSignals (bool block)

const QObjectList &	children () const

QMetaObject::Connection	connect (const QObject sender, const char signal, const char *method, Qt::ConnectionType type) const

void	deleteLater ()

void	destroyed (QObject *obj)

bool	disconnect (const char signal, const QObject receiver, const char *method) const

bool	disconnect (const QObject receiver, const char method) const

void	dumpObjectInfo ()

void	dumpObjectTree ()

QList< QByteArray >	dynamicPropertyNames () const

virtual bool	event (QEvent *e)

virtual bool	eventFilter (QObject watched, QEvent event)

T	findChild (const QString &name, Qt::FindChildOptions options) const

QList< T >	findChildren (const QString &name, Qt::FindChildOptions options) const

QList< T >	findChildren (const QRegExp &regExp, Qt::FindChildOptions options) const

QList< T >	findChildren (const QRegularExpression &re, Qt::FindChildOptions options) const

bool	inherits (const char *className) const

void	installEventFilter (QObject *filterObj)

bool	isWidgetType () const

bool	isWindowType () const

void	killTimer (int id)

virtual const QMetaObject *	metaObject () const

void	moveToThread (QThread *targetThread)

QString	objectName () const

void	objectNameChanged (const QString &objectName)

QObject *	parent () const

QVariant	property (const char *name) const

void	removeEventFilter (QObject *obj)

void	setObjectName (const QString &name)

void	setParent (QObject *parent)

bool	setProperty (const char *name, const QVariant &value)

bool	signalsBlocked () const

int	startTimer (int interval, Qt::TimerType timerType)

QThread *	thread () const

Protected Member Functions
virtual bool	dispatcherReady (const Dispatcher dispatcher, Controller controller) override

Protected Member Functions inherited from Cutelyst::Component
	Component (ComponentPrivate d, QObject parent=nullptr)
	A derived class using pimpl should call this constructor, to reduce the number of memory allocations.

virtual bool	afterExecute (Context *c)

void	applyRoles (const QStack< Component * > &roles)

virtual bool	beforeExecute (Context *c)

virtual bool	doExecute (Context *c)

Protected Member Functions inherited from QObject
virtual void	childEvent (QChildEvent *event)

virtual void	connectNotify (const QMetaMethod &signal)

virtual void	customEvent (QEvent *event)

virtual void	disconnectNotify (const QMetaMethod &signal)

bool	isSignalConnected (const QMetaMethod &signal) const

int	receivers (const char *signal) const

QObject *	sender () const

int	senderSignalIndex () const

virtual void	timerEvent (QTimerEvent *event)

Additional Inherited Members
Public Types inherited from Cutelyst::Component
enum	Modifier { None, OnlyExecute, BeforeExecute, AroundExecute, AfterExecute }

Static Public Member Functions inherited from QObject
QMetaObject::Connection	connect (const QObject sender, const char signal, const QObject receiver, const char method, Qt::ConnectionType type)

QMetaObject::Connection	connect (const QObject sender, const QMetaMethod &signal, const QObject receiver, const QMetaMethod &method, Qt::ConnectionType type)

QMetaObject::Connection	connect (const QObject sender, PointerToMemberFunction signal, const QObject receiver, PointerToMemberFunction method, Qt::ConnectionType type)

QMetaObject::Connection	connect (const QObject *sender, PointerToMemberFunction signal, Functor functor)

QMetaObject::Connection	connect (const QObject sender, PointerToMemberFunction signal, const QObject context, Functor functor, Qt::ConnectionType type)

bool	disconnect (const QMetaObject::Connection &connection)

bool	disconnect (const QObject sender, const char signal, const QObject receiver, const char method)

bool	disconnect (const QObject sender, PointerToMemberFunction signal, const QObject receiver, PointerToMemberFunction method)

bool	disconnect (const QObject sender, const QMetaMethod &signal, const QObject receiver, const QMetaMethod &method)

QString	tr (const char sourceText, const char disambiguation, int n)

QString	trUtf8 (const char sourceText, const char disambiguation, int n)

Properties inherited from QObject
	objectName

Detailed Description

Provides a reusable action role for user role-based authorization. ACLs are applied via the assignment of attributes to application action subroutines.

class Foo : public Cutelyst::Controller
{
    Q_OBJECT
public:
    C_ATTR(foo,
           :Local
           :Does(RoleACL)
           :RequiresRole(admin)
           :ACLDetachTo(denied))
    void foo(Context *c);
    C_ATTR(denied, :Local :Private :AutoArgs :ActionClass(RenderView))
    void denied(Context *c);
};

REQUIRED ATTRIBUTES

Failure to include the following required attributes will result in a fatal error when the RoleACL action's constructor is called.

ACLDetachTo

The name of an action to which the request should be detached if it is determined that ACLs are not satisfied for this user and the resource he is attempting to access.

RequiresRole and AllowedRole

The action must include at least one of these attributes, otherwise the Role::ACL constructor will have a fatal error.

Processing of ACLs

One or more roles may be associated with an action.

User roles are fetched via the invocation of the AuthenticationUser object's "roles" QStringList value.

Roles specified with the RequiresRole attribute are checked before roles specified with the AllowedRole attribute.

The mandatory ACLDetachTo attribute specifies the name of the action to which execution will detach on access violation.

ACLs may be applied to chained actions so that different roles are required or allowed for each link in the chain (or no roles at all).

ACLDetachTo allows us to short-circuit traversal of an action chain as soon as access is denied to one of the actions in the chain by its ACL.

Examples

// this is an invalid action
C_ATTR(broken,
       :Local
       :Does(RoleACL))
void broken(Context *c);

This action will cause a fatal error because it's missing the ACLDetachTo attribute and has neither a RequiresRole nor an AllowedRole attribute. A RoleACL action must include at least one RequiresRole or AllowedRole attribute.

C_ATTR(foo,
       :Local
       :Does(RoleACL)
       :RequiresRole(admin)
       :ACLDetachTo(denied))
void foo(Context *c);

This action may only be executed by users with the 'admin' role.

C_ATTR(bar,
       :Local
       :Does(RoleACL)
       :RequiresRole(admin)
       :AllowedRole(editor)
       :AllowedRole(writer)
       :ACLDetachTo(denied))
void bar(Context *c);

This action requires that the user has the 'admin' role and either the 'editor' or 'writer' role (or both).

C_ATTR(easy,
       :Local
       :Does(RoleACL)
       :AllowedRole(admin)
       :AllowedRole(user)
       :ACLDetachTo(denied))
void easy(Context *c);

Any user with either the 'admin' or 'user' role may execute this action.

Definition at line 31 of file roleacl.h.