访问控制列表ACL

use Phalcon\Acl;
use Phalcon\Acl\Role;
use Phalcon\Acl\Resource;
use Phalcon\Events\Event;
use Phalcon\Mvc\User\Plugin;
use Phalcon\Mvc\Dispatcher;
use Phalcon\Acl\Adapter\Memory as AclList;

class SecurityPlugin extends Plugin
{
    //返回一个已存在的或新创建的acl列表
    public function getAcl()
    {
        if(!isset($this->persistent->acl)) {

            $acl = new AclList();
            //设置默认访问级别为“拒绝”
            $acl->setDefaultAction(Acl::DENY);

            //添加角色
            $roles = array(
                ‘users‘ => new Role(‘Users‘),
                ‘guests‘ => new Role(‘Guests‘)
            );
            foreach($roles as $role) {
                $acl->addRole($role);
            }

            //添加私有资源
            $privateResources = array(
                ‘posts‘ => array(‘post‘),
                ‘comments‘ => array(‘comment‘)
            );
            foreach($privateResources as $resource => $actions) {
                $acl->addResource(new Resource($resource),$actions);
            }

            //添加公有资源
            $publicResources = array(
                ‘index‘ => array(‘index‘),
                ‘register‘ => array(‘index‘),
                ‘login‘ => array(‘index‘,‘start‘,‘end‘),
                ‘posts‘ => array(‘index‘,‘detail‘)
            );
            foreach($publicResources as $resource => $actions) {
                $acl->addResource(new Resource($resource),$actions);
            }

            //公有资源访问控制
            foreach($roles as $role) {
                foreach($publicResources as $resource => $actions) {
                    foreach($actions as $action) {
                        $acl->allow($role->getName(),$resource,$action);
                    }
                }
            }

            //私有资源访问控制
            foreach($privateResources as $resource => $actions) {
                foreach($actions as $action) {
                    $acl->allow(‘Users‘,$resource,$action);
                }
            }
            $this->persistent->acl = $acl;
        }
        return $this->persistent->acl;
    }

    //查询acl列表进行权限控制
    public function beforeDispatch(Event $event,Dispatcher $dispatcher)
    {
        $auth = $this->session->get(‘auth‘);
        if(!$auth) {         //查询当前用户的身份
            $role = ‘Guests‘;
        } else {
            $role = ‘Users‘;
        }

        $controller = $dispatcher->getControllerName();
        $action = $dispatcher->getActionName();

        $acl = $this->getAcl();

        $allowed = $acl->isAllowed($role,$controller,$action);

        if($allowed != Acl::ALLOW) {        //需要用户登录才有权限
            $dispatcher->forward(array(
                ‘controller‘ => ‘login‘,
                ‘action‘     => ‘index‘
            ));
            $this->session->destroy();
            return false;
        }
    }
}

在注入调度控制器时绑定到一个事件控制器中：
$di->set(‘dispatcher‘,function() use ($di) {

    $eventsManager = new EventsManager;

    $eventsManager->attach(‘dispatch:beforeDispatch‘,new SecurityPlugin);

    $dispatcher = new Dispatcher;
    $dispatcher->setEventsManager($eventsManager);

    return $dispatcher;
});