小型项目用户特权

Question

我有一个小型的web应用程序，需要一个用户权限系统来访问某些内容或添加/编辑它。

我使用赋予用户的角色来管理私密性，并使用用户自定义meta将自定义私密性设置为特定用户。

我想知道这个方法是否好？如果不是为什么？有什么建议比把私密装在数组里更好吗？因为太长了。

    if(!function_exists('user_cap')) {
    /**
     *
     */
    function user_cap( $user_id, $cap, $action, $accesable = null ) {

        $get_user_info = get_user_info( $user_id );
        $user_role = $get_user_info->user_role;
        /**
         * Super admin role can determine custom privileges for every user 
         */
        //$user_privileges = get_user_meta( $user_id, 'user_privileges' );

        //

        $privileges = [
            'super_admin' => [
                'users' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],
                'projects' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],
                'locations' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],
                'reminders' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],              
                'administrations' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],              
                'locations' => [
                    'create' => 'yes',
                    'read' => 'yes',
                    'update' => 'yes',
                    'delete' => 'yes'
                ],

            ],          

            'user' => [
                'users' => [
                    'create' => 'no',
                    'read' => 'no',
                    'update' => 'no',
                    'delete' => 'no'
                ],
                'projects' => [
                    'create' => 'no',
                    'read' => 'get_user_responsible_projects',
                    'update' => 'no',
                    'delete' => 'no'
                ],
                'locations' => [
                    'create' => 'no',
                    'read' => 'no',
                    'update' => 'no',
                    'delete' => 'no'
                ],
                'reminders' => [
                    'create' => 'yes',
                    'read' => 'get_user_reminders',
                    'update' => 'get_user_reminders',
                    'delete' => 'get_user_reminders'
                ],              
                'administrations' => [
                    'create' => 'no',
                    'read' => 'no',
                    'update' => 'no',
                    'delete' => 'no'
                ],              
                'locations' => [
                    'create' => 'no',
                    'read' => 'no',
                    'update' => 'no',
                    'delete' => 'no'
                ],

            ],
        ];

        $role_privilege = $privileges[$user_role][$cap][$action];

        if($privilegs == 'yes') {

            return true;

        }elseif($privilege == 'no') {

            return false;

        }else{

            $privilege = call_user_func($privilege);
            if(in_array($accesable, $privilege) {

                return true;

            }

        }

        return false;

    }
}

if(!function_exists('user_can')) {
    /**
     * @param   int     $user_id
     * @param   string  $cap
     * @param   string  $action
     */
    function user_can( $user_id, $cap, $action ) {

        return user_cap( $user_id, $cap, $action );

    }
}

if(!function_exists('current_user_can')) {
    /**
     * @param   string  $cap
     * @parzm   string  $action
     *
     * @return mixed (string on success|boolean on failure)
     */
    function current_user_can( $cap, $action ) {

        $current_user = current_user();

        if(empty($current_user)) {
            return false;
        }

        return user_can($current_user->id, $cap, $action);
    }
}

Answer 1

将有很多种方法来构造这些权限。我会提供一条不完全放弃你原来剧本的途径。

1. 在您真正为super_admin设置no之前，不要费心地写出它们的所有D3权限。只需在这个单变量和早期返回上写一个简单的条件。
2. 只存储yes和回调值。这将节省大量的眼睛紧张和滚动。默认情况下，让程序假定为No权限，并且只声明授予密钥的访问权限。通过这样做，如果没有列出一组键，就可以编写早期的false返回。
3. 如果权限查找数组中列出的值为yes，则提前返回true。
4. 将“最重”动作保留到最后。此返回是最后的决定线，因此它可以是return上的内联条件。

调整后的脚本可能如下所示：(注意没有输入和临时变量)

function user_cap($user_id, $cap, $action, $accesable = null) {
    $get_user_info = get_user_info($user_id);
    $user_role = $get_user_info->user_role;

    $privileges = [
        'user' => [
            'projects' => [
                'read' => 'get_user_responsible_projects',
            ],
            'reminders' => [
                'create' => 'yes',
                'read' => 'get_user_reminders',
                'update' => 'get_user_reminders',
                'delete' => 'get_user_reminders'
            ]
        ]
    ];

    if ($user_role == 'super_admin') {
        return true;
    }

    if (!isset($privileges[$user_role][$cap][$action])) {
        return false;
    }

    if ($privileges[$user_role][$cap][$action] == 'yes') {
        return true;
    }

    return in_array($accesable, call_user_func($privileges[$user_role][$cap][$action]));
}