Conditions for Guards

docs/04. Guards.md

@@ -177,17 +177,34 @@ return [
         'guards' => [
             'ZfcRbac\Guard\RoutePermissionsGuard' => [
                 'admin*' => ['admin'],
-                'post/manage'   => ['post.update', 'post.delete']
+                'post/manage'   =>
             ]
         ]
     ]
 ];
 ```
 
-> All permissions in a rule must be matched (it is an AND condition).
+> By default, all permissions in a rule must be matched (an AND condition).
 
 In the previous example, one must have ```post.update``` **AND** ```post.delete``` permissions
-to access the ```post/manage``` route.
+to access the ```post/manage``` route. You can also specify an OR condition like so:
+
+```php
+use ZfcRbac\Guard\GuardInterface;
+
+return [
+    'zfc_rbac' => [
+        'guards' => [
+            'ZfcRbac\Guard\RoutePermissionsGuard' => [
+                'post/manage'   => [
+                    'permissions' => ['post.update', 'post.delete'],
+                    'condition'   => GuardInterface::CONDITION_OR
+                ]
+            ]
+        ]
+    ]
+];
+```
 
 > Permissions are linked to roles, not to users
 

src/ZfcRbac/Guard/GuardInterface.php

@@ -47,6 +47,12 @@ interface GuardInterface extends ListenerAggregateInterface
     const POLICY_DENY  = 'deny';
     const POLICY_ALLOW = 'allow';
 
+    /**
+     * Condition constants
+     */
+    const CONDITION_OR  = 'OR';
+    const CONDITION_AND = 'AND';
+
     /**
      * @param  MvcEvent $event
      * @return bool

src/ZfcRbac/Guard/RoutePermissionsGuard.php

@@ -18,7 +18,6 @@
 namespace ZfcRbac\Guard;
 
 use Zend\Mvc\MvcEvent;
-use ZfcRbac\Exception;
 use ZfcRbac\Service\AuthorizationServiceInterface;
 
 /**
@@ -101,12 +100,30 @@ public function isGranted(MvcEvent $event)
             return true;
         }
 
-        foreach ($allowedPermissions as $permission) {
-            if (!$this->authorizationService->isGranted($permission)) {
+        $permissions = isset($allowedPermissions['permissions'])
+            ? $allowedPermissions['permissions']
+            : $allowedPermissions;
+
+        $condition   = isset($allowedPermissions['condition'])
+            ? $allowedPermissions['condition']
+            : GuardInterface::CONDITION_AND;
+
+        foreach ($permissions as $permission) {
+            if ($condition === GuardInterface::CONDITION_OR
+                && $this->authorizationService->isGranted($permission)
+            ) {
+                return true;
+            } elseif ($condition === GuardInterface::CONDITION_AND
+                      && !$this->authorizationService->isGranted($permission)
+            ) {
                 return false;
             }
         }
 
+        if ($condition === GuardInterface::CONDITION_OR) {
+            return false;
+        }
+
         return true;
     }
 }

tests/ZfcRbacTest/Guard/RoutePermissionsGuardTest.php

@@ -326,6 +326,26 @@ public function routeDataProvider()
                 'isGranted'           => true,
                 'policy'              => GuardInterface::POLICY_DENY
             ],
+            [
+                'rules'               => ['route' => [
+                    'permissions' => ['post.edit', 'post.read'],
+                    'condition'   => GuardInterface::CONDITION_OR
+                ]],
+                'matchedRouteName'    => 'route',
+                'identityPermissions' => [['post.edit', null, true]],
+                'isGranted'           => true,
+                'policy'              => GuardInterface::POLICY_DENY
+            ],
+            [
+                'rules'               => ['route' => [
+                    'permissions' => ['post.edit', 'post.read'],
+                    'condition'   => GuardInterface::CONDITION_AND
+                ]],
+                'matchedRouteName'    => 'route',
+                'identityPermissions' => [['post.edit', null, true]],
+                'isGranted'           => false,
+                'policy'              => GuardInterface::POLICY_DENY
+            ]
         ];
     }