Auth (A1) and ACL (A2, ACL): Pt 3, the User Controller

Laws control the lesser man… Right conduct controls the greater one. – Mark Twain

Part 1: Introduction
Part 2: The Data Model
Part 3: The Controller
Part 4: It becomes a module
Part 5: Adding ACL

You now need a User Controller

&lt;?php defined('SYSPATH') or die('No direct script access.');</p>
<p>class Controller_User extends Controller_Template implements Acl_Resource_Interface<br />
{<br />
   public function before()<br />
   {<br />
      parent::before();</p>
<p>      $this-&gt;a2 = A2::instance();</p>
<p>      // Returns user currently logged in.<br />
      // Does an auto_login (using cookie token) if<br />
      // cookie exists and is valid<br />
      // Returns FALSE if no-one logged in<br />
      $this-&gt;user = $this-&gt;a2-&gt;get_user();</p>
<p>      // If NOT Logged on AND Guest NOT ALLOWED throw a 401<br />
      // (e.g. In case of Controller_User, guest would<br />
      //  be allowed access to 'login' action)<br />
      if (($this-&gt;user === FALSE) AND<br />
	  (!$this-&gt;a2-&gt;allowed($this-&gt;get_resource_id(),<br />
			       $this-&gt;request-&gt;action())))<br />
      {<br />
	 // 401 - NOT AUTHENTICATED, NOT ALLOWED, SO GO TO LOGIN PAGE<br />
	 throw new HTTP_Exception_401(<br />
	    'Please login to access :resource',<br />
	    array(':resource'=&gt;$this-&gt;get_resource_id()));<br />
      }</p>
<p>      // If Logged on AND NOT ALLOWED<br />
      // Throw a 403<br />
      if (!$this-&gt;a2-&gt;allowed($this-&gt;get_resource_id(),<br />
			      $this-&gt;request-&gt;action()))<br />
      {<br />
	 // 403 - AUTHENTICATED, BUT NOT ALLOWED ACCESS<br />
	 throw new HTTP_Exception_403(<br />
	    '&lt;b&gt;:user&lt;/b&gt; (:roles) is not allowed to &lt;b&gt;:action&lt;/b&gt; &lt;b&gt;:resource&lt;/b&gt;',<br />
	    array(':user'=&gt;$this-&gt;user-&gt;username,<br />
		  ':roles'=&gt;implode(', ',$this-&gt;user-&gt;get_role_id()),<br />
		  ':action'=&gt;$this-&gt;request-&gt;action(),<br />
		  ':resource'=&gt;$this-&gt;get_resource_id()));<br />
      }<br />
   }</p>
<p>   public function get_resource_id()<br />
   {<br />
      return 'user';<br />
   }</p>
<p>   /**<br />
    * View: Login form.<br />
    */<br />
   public function action_login()<br />
   {<br />
      if (HTTP_Request::POST == $this-&gt;request-&gt;method())<br />
      {<br />
	 if ($this-&gt;request-&gt;post('cancel'))<br />
	    throw HTTP_Exception::factory(302)<br />
	       -&gt;location('/');	    </p>
<p>	 $post = Validation::factory($this-&gt;request-&gt;post())<br />
	    //-&gt;filter(TRUE,'trim')<br />
	    -&gt;rule('username', 'not_empty')<br />
	    -&gt;rule('username', 'min_length', array(':username', 4))<br />
	    -&gt;rule('username', 'max_length', array(':username',127))<br />
	    -&gt;rule('password', 'not_empty');</p>
<p>	 // do we have a username and a password??<br />
	 if($post-&gt;check())<br />
	 {<br />
	    if($this-&gt;a2<br />
	       -&gt;auth()<br />
	       -&gt;login($post['username'],$post['password'],<br />
		       isset($post['remember'])<br />
		       ? (bool) $post['remember']<br />
		       : FALSE))<br />
	    {<br />
	       // !!! probably want something more specific here<br />
	       $this-&gt;redirect('/');<br />
	    }<br />
	 }<br />
      }</p>
<p>      $page = $this-&gt;request-&gt;query('page');<br />
      if (isset($_POST['page']))<br />
	 $page = $_POST['page'];</p>
<p>      $this-&gt;template-&gt;title = &quot;Login&quot;;<br />
      // --center heading--<br />
      $this-&gt;template-&gt;center_heading = 'L O G I N';</p>
<p>      $this-&gt;template-&gt;content = view::factory('nimda/page/login')<br />
	 -&gt;set('page', $page);<br />
   }      </p>
<p>   /**<br />
    * Log the user out.<br />
    */<br />
   public function action_logout()<br />
   {<br />
      // Sign out the user<br />
      $this-&gt;a2-&gt;auth()-&gt;logout();<br />
      $this-&gt;user = NULL;</p>
<p>      $page = $this-&gt;request-&gt;query('page');<br />
      if (!empty($page))<br />
	 $this-&gt;redirect($page);<br />
      return $this-&gt;action_login();<br />
   }</p>
<p>   /**<br />
    * If no users (a virgin setup) then create<br />
    * an admin user<br />
    */<br />
   public function action_initialise()<br />
   {<br />
      if (ORM::factory('user')-&gt;count_all() == 0)<br />
      {<br />
	 $user = ORM::factory('user');<br />
	 $user-&gt;values(array(<br />
			  'username' =&gt; 'admin',<br />
			  'email' =&gt; 'webmaster@silver-bullet.co.nz',<br />
			  'password' =&gt; 'admin',<br />
			  'password_confirm' =&gt; 'admin',<br />
			  ));<br />
	 $user-&gt;save();</p>
<p>	 $user-&gt;add('roles',<br />
		    ORM::factory('role')-&gt;where('name', '=', 'login')-&gt;find());<br />
	 $user-&gt;add('roles',<br />
		    ORM::factory('role')-&gt;where('name', '=', 'admin')-&gt;find());<br />
      }</p>
<p>      $this-&gt;redirect('/login');<br />
   }<br />
} // End Welcome<br />