1: <?php
 2: /**
 3:  * Magento
 4:  *
 5:  * NOTICE OF LICENSE
 6:  *
 7:  * This source file is subject to the Open Software License (OSL 3.0)
 8:  * that is bundled with this package in the file LICENSE.txt.
 9:  * It is also available through the world-wide-web at this URL:
10:  * http://opensource.org/licenses/osl-3.0.php
11:  * If you did not receive a copy of the license and are unable to
12:  * obtain it through the world-wide-web, please send an email
13:  * to license@magentocommerce.com so we can send you a copy immediately.
14:  *
15:  * DISCLAIMER
16:  *
17:  * Do not edit or add to this file if you wish to upgrade Magento to newer
18:  * versions in the future. If you wish to customize Magento for your
19:  * needs please refer to http://www.magentocommerce.com for more information.
20:  *
21:  * @category    Mage
22:  * @package     Mage_Api2
23:  * @copyright   Copyright (c) 2012 Magento Inc. (http://www.magentocommerce.com)
24:  * @license     http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
25:  */
26: 
27: /**
28:  * API Global ACL model
29:  *
30:  * @category   Mage
31:  * @package    Mage_Api2
32:  * @author     Magento Core Team <core@magentocommerce.com>
33:  */
34: class Mage_Api2_Model_Acl_Global
35: {
36:     /**
37:      * Check if the operation is allowed on resources of given type type for given user type/role
38:      *
39:      * @param Mage_Api2_Model_Auth_User_Abstract $apiUser
40:      * @param string $resourceType
41:      * @param string $operation
42:      * @return boolean
43:      * @throws Mage_Api2_Exception
44:      */
45:     public function isAllowed(Mage_Api2_Model_Auth_User_Abstract $apiUser, $resourceType, $operation)
46:     {
47:         // skip user without role, e.g. Customer
48:         if (null === $apiUser->getRole()) {
49:             return true;
50:         }
51:         /** @var $aclInstance Mage_Api2_Model_Acl */
52:         $aclInstance = Mage::getSingleton(
53:             'api2/acl',
54:             array('resource_type' => $resourceType, 'operation' => $operation)
55:         );
56: 
57:         if (!$aclInstance->hasRole($apiUser->getRole())) {
58:             throw new Mage_Api2_Exception('Role not found', Mage_Api2_Model_Server::HTTP_UNAUTHORIZED);
59:         }
60:         if (!$aclInstance->has($resourceType)) {
61:             throw new Mage_Api2_Exception('Resource not found', Mage_Api2_Model_Server::HTTP_NOT_FOUND);
62:         }
63:         return $aclInstance->isAllowed($apiUser->getRole(), $resourceType, $operation);
64:     }
65: }
66: