Question

Zend_Acl by default disallow every role to every resource on every privilege untill or unless
they are specifically allowed.
In my system a user can have many roles and permission are assinged to these roles.
I simply get all user roles iterate over all of them and check isAllowed() for given resourse and privilege for every role.

for e.g if current resourse is ‘foo’ and privilege is ‘bar’

public function checkAllow($roles, $resouse, $privilege)
{

    foreach ($roles as $role) {
        if ($acl->isAllowed($role, 'foo', 'bar') === true)
            return true;
    }
    return false;
}

Now I want to implement sort order on these roles i.e first role assinged will have more preference then second and so forth.

Problem comes how can I detect specific deny to some roles like

$this->deny('member','foo','bar');

While iterating over all roles how can I know the given role was specificly “denyied”?
So at that point I can break out of foreach loop and return false.

Answer 1

Ok I found the solution myself by going into Zend_Acl code well its come out to be Zend_Acl is missing isDenied() Method , it has isAllowed() but not isDenied()

Heres my implementation of isDenied() method in class which extends Zend_Acl

public function isDenied($roleId,$resource,$privilege)
    {

        if($this->has($resource) && $this->hasRole($roleId))
        {

         $roleId = $this->getRole($roleId)->getRoleId();
         $resourceId = $this->get($resource)->getResourceId();   

       return @$this->_rules['byResourceId'][$resourceId]['byRoleId'][$roleId]['byPrivilegeId'][$privilege]['type'] === 'TYPE_DENY';
        }

        return false;
    }