ZF-Commons/ZfcRbac — pull request #93 by bakura10 (2013-11-07 17:46:54+00:00)
Title: [WIP] Refactor ZfcRbac 1.0

Hi everyone,

ping @spiffyjr @jmleroux

This is the refactor branch of ZfcRbac. I've been working on this one intensively since around 1 week with the help of @jmleroux.

As for previous version of ZfcRbac, the next version will be tightly integrated with the ZF Rbac component. In this refactor, I've taken all the good ideas from various authorization module (from actual version of ZfcRbac, SpiffyAuthorize and BjyAuthorize).

Note for @spiffyjr: I hope you will agree about this refactor. While it "steals" a lot of ideas from SpiffyAuhtorize (and make a lot of things even more awesome), @jmleroux and me had the same feeling that having something generic is too much work, and more complicated to use/maintain because of the differences in the two models. I hope you won't take this bad ;-). And once again, a lot of good ideas come from your own work, so you deserve a big :+1: on this!

What will be new:

* The module is entirely unit-tested from the beginning. I target to have > 90 % coverage.
* Code is much more solid by having proper dependency injection.
* You will still have the good old firewall/guards for both route and controller. However their implementation is completely different, it lazy load the rules inside the Rbac container only when needed, so having a cache for guards is nearly useless. They also completely support wildcard syntax and fix a few odd bugs from current version of ZfcRbac. You can even use wildcard for roles, so the following is possible "admin/*" => array("*").
* For guards, I added a new way so that once a guard is added, the policy is to "block" any non-defined rule/controller. This can be configurable.
* Dependency to Doctrine is completely optional now.
* Role and permission provider have been completely rewrite. As in SpiffyAuthorize, complex models like nested set have been removed as this depends too much on the context of your application.
* A long awaited feature have been added: you can now have cache for role and permission providers, so that if you load your roles and permissions from database, the calls will be made only once.
* In addition to the previous UnauthorizedStrategy, a new RedirectStrategy has been added. Now, instead of just sending a 403, it will redirect any unauthorized requests to another route. You even have the possibility to append the previous URI as a query param.
* A lot more...

However:

* ZfcRbac will be PHP 5.4 only. It allows us to make some useful simplifications and using traits.
* The minimum ZF version **may** be increased to ZF2.3, depending on which features are landed. Some more interfaces in Rbac that may land in ZF 2.3 would be particularly useful to this new version of ZfcRbac.

And last but not least: the major problem of authorization system is the lack of doc. I plan to write a lot of docs in this new version, so hopefully it will be simpler to use!

To-do:

* Write a lot of functional unit tests
* Thorough review of the code
* Decide about the best syntax to register role/permission providers.
* Backport the ZendDeveloperTools features.
* Write doc