Add access controll.

dvaganov · Jun 6, 2016 · d3d38fb · d3d38fb
1 parent 633ff99
commit d3d38fb
Show file tree

Hide file tree

Showing 4 changed files with 83 additions and 2 deletions.
diff --git a/controllers/CalendarController.php b/controllers/CalendarController.php
@@ -56,8 +56,26 @@ public function actionIndex()
      */
     public function actionView($id)
     {
-        return $this->render('view', [
-            'model' => $this->findModel($id),
+        $model = $this->findModel($id);
+        $view = '';
+
+        switch(Access::check($model)) {
+
+            case Access::ACCESS_OWNER:
+                $view = 'view';
+                break;
+
+            case Access::ACCESS_GUEST:
+                $view = 'viewGuest';
+                break;
+
+            case Access::ACCESS_NO:
+            default:
+                throw new \yii\web\ForbiddenHttpException("Not allowed!");
+        }
+
+        return $this->render($view, [
+            'model' => $model,
         ]);
     }
 

diff --git a/models/Access.php b/models/Access.php
@@ -22,6 +22,10 @@ class Access extends \yii\db\ActiveRecord
    * @var string DATE_FORMAT
    */
   const DATE_FORMAT = 'Y-m-d';
+  const ACCESS_NO = 0;
+  const ACCESS_OWNER = 1;
+  const ACCESS_GUEST = 2;
+
     /**
      * @inheritdoc
      */
@@ -81,4 +85,27 @@ public static function find()
     {
         return new \app\models\query\AccessQuery(get_called_class());
     }
+
+    /**
+     * Check access currento user to model.
+     * @param \app\models\Calendar $model
+     * @return int Access status
+     */
+    public function check($model)
+    {
+        $result = self::ACCESS_NO;
+        $currentUser = \Yii::$app->user->id;
+
+        if ($currentUser == $model->creatorID) {
+            $result = self::ACCESS_OWNER;
+        } else {
+            $isGuest = self::find()
+                ->whereGuest($currentUser)
+                ->whereDate($model->dateEvent)
+                ->exists();
+            $result = ($isGuest) ? self::ACCESS_GUEST : $result;
+        }
+
+        return $result;
+    }
 }
diff --git a/models/query/AccessQuery.php b/models/query/AccessQuery.php
@@ -40,4 +40,13 @@ public function whereGuest($userID)
     {
         return $this->andWhere('guestID = :guestID', ['guestID' => $userID]);
     }
+
+    /**
+     * Add date filter to access.
+     * @param int $date
+     */
+    public function whereDate($date)
+    {
+        return $this->andWhere(['like', 'date', $date]);
+    }
 }
diff --git a/views/calendar/viewGuest.php b/views/calendar/viewGuest.php
@@ -0,0 +1,27 @@
+<?php
+
+use yii\helpers\Html;
+use yii\widgets\DetailView;
+
+/* @var $this yii\web\View */
+/* @var $model app\models\Calendar */
+
+$this->title = substr($model->text, 0, 10) . '...';
+$this->params['breadcrumbs'][] = ['label' => Yii::t('app', 'Calendars'), 'url' => ['index']];
+$this->params['breadcrumbs'][] = $this->title;
+?>
+<div class="calendar-view">
+
+    <h1><?= Html::encode($this->title) ?></h1>
+
+    <?= DetailView::widget([
+        'model' => $model,
+        'attributes' => [
+            'id',
+            'text:ntext',
+            'creatorID',
+            'dateEvent',
+        ],
+    ]) ?>
+
+</div>