RBAC class

<?php

/*  ROLE-BASED ACCESS CONTROL CLASS */


/**
 *  Database tables. Copy/paste the SQL code to create the tables on your own database.
 */


/* Accounts table. */
/*
CREATE TABLE `accounts` (
  `account_id` int(11) NOT NULL,
  `account_name` varchar(128) NOT NULL,
  `account_pwd` varchar(128) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `accounts`
  ADD PRIMARY KEY (`account_id`),
  ADD UNIQUE KEY `account_name` (`account_name`);

ALTER TABLE `accounts`
  MODIFY `account_id` int(11) NOT NULL AUTO_INCREMENT;
*/

/* Roles table. */
/*
CREATE TABLE `roles` (
  `role_id` int(10) UNSIGNED NOT NULL,
  `role_name` varchar(128) NOT NULL,
  `role_desc` varchar(128) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `roles`
  ADD PRIMARY KEY (`role_id`),
  ADD UNIQUE KEY `role_name` (`role_name`);

ALTER TABLE `roles`
  MODIFY `role_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT;
*/

/* Account-roles relation table. */
/*
 CREATE TABLE `account_roles` (
  `ar_id` int(10) UNSIGNED NOT NULL,
  `ar_account_id` int(10) UNSIGNED NOT NULL,
  `ar_role_id` int(10) UNSIGNED NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `account_roles`
  ADD PRIMARY KEY (`ar_id`),
  ADD UNIQUE KEY `ar_account_id` (`ar_account_id`,`ar_role_id`);

ALTER TABLE `account_roles`
  MODIFY `ar_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT;
*/

/* Permissions table. */
/*
CREATE TABLE `permissions` (
  `permission_id` int(10) UNSIGNED NOT NULL,
  `permission_name` varchar(128) NOT NULL,
  `permission_desc` varchar(128) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `permissions`
  ADD PRIMARY KEY (`permission_id`),
  ADD UNIQUE KEY `permission_name` (`permission_name`);

ALTER TABLE `permissions`
  MODIFY `permission_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT;
*/

/* Role-permissions relation table. */
/*
 CREATE TABLE `role_permissions` (
  `rp_id` int(10) UNSIGNED NOT NULL,
  `rp_role_id` int(10) UNSIGNED NOT NULL,
  `rp_permission_id` int(10) UNSIGNED NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

ALTER TABLE `role_permissions`
  ADD PRIMARY KEY (`rp_id`),
  ADD UNIQUE KEY `rp_role_id` (`rp_role_id`,`rp_permission_id`);

ALTER TABLE `role_permissions`
  MODIFY `rp_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT;
*/



/* Class. */
class RBAC
{
     /* PDO object for class database operations. */
    private $db;


    /* Constructor. Takes a PDO resource link as argument. */
    public function __construct(PDO &$db)
    {
         $this->db = $db;
    }

    /* Destructor. */
    public function __destruct() {}


    /**
     *  ROLES-RELATED FUNCTIONS
     */

    /* Add a new role. Returns the new role ID or 0 if the name already exists. */
    public function addRole(string $name, string $desc = ''): int
    {
        $ret = 0;

        /* Query to check whether a role with the same name exists. */
        $check_query = 'SELECT * FROM roles WHERE (role_name = :name)';
        $check_params = array(':name' => $name);

        try
        {
            $check_res = $this->db->prepare($check_query);
            $check_res->execute($check_params);
        }
        catch (PDOException $e)
        {
            $this->pdo_exception($e);
        }

        if (!is_array($check_res->fetch()))
        {
            /* A role with the same name does not exist; we can add one. */

            $add_query = 'INSERT INTO roles (role_name, role_desc) VALUES (:name, :desc)';
            $add_params = array(':name' => $name, ':desc' => $desc);

            try
            {
                $add_res = $this->db->prepare($add_query);
                $add_res->execute($add_params);
            }
            catch (PDOException $e)
            {
                $this->pdo_exception($e);
            }

            $ret = $this->getRoleId($name);
        }

        return $ret;
    }

    /* Deletes a role from the database. */
    public function deleteRole(int $role_id)
    {
        $query = 'DELETE FROM roles WHERE (role_id = :role_id) LIMIT 1';
        $params = array(':role_id' => $role_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Returns a role ID by its name, or 0 if no role with that name exists. */
    public function getRoleId(string $name): int
    {
        $id = 0;

        $query = 'SELECT * FROM roles WHERE (role_name = :name)';
        $params = array(':name' => $name);

        $res = $this->db->prepare($query);
        $res->execute($params);

        if (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $id = intval($row['role_id'], 10);
        }

        return $id;
    }

    /* Returns an array with a role info. */
    public function getRoleInfo(int $role_id): array
    {
        $info =
        [
            'id' => NULL,
            'name' => NULL,
            'desc' => NULL
        ];

        $query = 'SELECT * FROM roles WHERE (role_id = :role_id)';
        $params = array(':role_id' => $role_id);

        $res = $this->db->prepare($query);
        $res->execute($params);

        if (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $info['id'] = $role_id;
            $info['name'] = $row['role_name'];
            $info['desc'] = $row['role_desc'];
        }

        return $info;
    }

    /* Edits a role info from its ID. */
    public function editRoleInfo(int $role_id, string $name, string $desc)
    {
        $query = 'UPDATE roles SET role_name = :name, role_desc = :desc WHERE (role_id = :role_id) LIMIT 1';
        $params = array(':name' => $name, ':desc' => $desc, ':role_id' => $role_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Adds a role to an account. */
    public function addAccountRole(int $account_id, int $role_id)
    {
        $query = 'REPLACE INTO account_roles (ar_account_id, ar_role_id) VALUES (:account_id, :role_id)';
        $params = array(':account_id' => $account_id, ':role_id' => $role_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Removes a role from an account. */
    public function deleteAccountRole(int $account_id, int $role_id)
    {
        $query = 'DELETE FROM account_roles WHERE (ar_account_id = :account_id) AND (ar_role_id = :role_id) LIMIT 1';
        $params = array(':account_id' => $account_id, ':role_id' => $role_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Returns an array of role IDs for a specific account. */
    public function getAccountRoles(int $account_id): array
    {
        $roles = array();

        $query = 'SELECT * FROM account_roles WHERE (ar_account_id = :account_id)';
        $params = array(':account_id' => $account_id);

        try
        {
            $res = $this->db->prepare($query);
            $res->execute($params);
        }
        catch (PDOException $e)
        {
            $this->pdo_exception($e);
        }

        while (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $roles[] = $row['role_id'];
        }

        return $roles;
    }


     /**
     *  PERMISSIONS-RELATED FUNCTIONS
     */

    /* Add a new permission. Returns the new permission ID or 0 if the name already exists. */
    public function addPermission(string $name, string $desc = ''): int
    {
        $ret = 0;

        /* Query to check whether a permission with the same name exists. */
        $check_query = 'SELECT * FROM permissions WHERE (permission_name = :name)';
        $check_params = array(':name' => $name);

        try
        {
            $check_res = $this->db->prepare($check_query);
            $check_res->execute($check_params);
        }
        catch (PDOException $e)
        {
            $this->pdo_exception($e);
        }

        if (!is_array($check_res->fetch()))
        {
            /* A permission with the same name does not exist; we can add one. */

            $add_query = 'INSERT INTO permissions (permission_name, permission_desc) VALUES (:name, :desc)';
            $add_params = array(':name' => $name, ':desc' => $desc);

            try
            {
                $add_res = $this->db->prepare($add_query);
                $add_res->execute($add_params);
            }
            catch (PDOException $e)
            {
                $this->pdo_exception($e);
            }

            $ret = $this->getPermissionId($name);
        }

        return $ret;
    }

    /* Deletes a permission from the database. */
    public function deletePermission(int $permission_id)
    {
        $query = 'DELETE FROM permissions WHERE (permission_id = :permission_id) LIMIT 1';
        $params = array(':permission_id' => $permission_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Returns a permission ID by its name, or 0 if no permission with that name exists. */
    public function getPermissionId(string $name): int
    {
        $id = 0;

        $query = 'SELECT * FROM permissions WHERE (permission_name = :name)';
        $params = array(':name' => $name);

        $res = $this->db->prepare($query);
        $res->execute($params);

        if (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $id = intval($row['permission_id'], 10);
        }

        return $id;
    }

    /* Returns an array with a permission info. */
    public function getPermissionInfo(int $permission_id): array
    {
        $info =
        [
            'id' => NULL,
            'name' => NULL,
            'desc' => NULL
        ];

        $query = 'SELECT * FROM permissions WHERE (permission_id = :permission_id)';
        $params = array(':permission_id' => $permission_id);

        $res = $this->db->prepare($query);
        $res->execute($params);

        if (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $info['id'] = $permission_id;
            $info['name'] = $row['permission_name'];
            $info['desc'] = $row['permission_desc'];
        }

        return $info;
    }

    /* Edits a permission info from its ID. */
    public function editPermissionInfo(int $permission_id, string $name, string $desc)
    {
        $query = 'UPDATE permissions SET permission_name = :name, permission_desc = :desc WHERE (permission_id = :permission_id) LIMIT 1';
        $params = array(':name' => $name, ':desc' => $desc, ':permission_id' => $permission_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Adds a permission to an role. */
    public function addRolePermission(int $role_id, int $permission_id)
    {
        $query = 'REPLACE INTO role_permissions (rp_role_id, rp_permission_id) VALUES (:role_id, :permission_id)';
        $params = array(':role_id' => $role_id, ':permission_id' => $permission_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Removes a permission from an role. */
    public function deleteRolePermission(int $role_id, int $permission_id)
    {
        $query = 'DELETE FROM role_permissions WHERE (rp_role_id = :role_id) AND (rp_permission_id = :permission_id) LIMIT 1';
        $params = array(':role_id' => $role_id, ':permission_id' => $permission_id);

        $res = $this->db->prepare($query);
        $res->execute($params);
    }

    /* Returns an array of permission IDs for a specific role. */
    public function getRolePermissions(int $role_id): array
    {
        $permissions = array();

        $query = 'SELECT * FROM role_permissions WHERE (rp_role_id = :role_id)';
        $params = array(':role_id' => $role_id);

        try
        {
            $res = $this->db->prepare($query);
            $res->execute($params);
        }
        catch (PDOException $e)
        {
            $this->pdo_exception($e);
        }

        while (is_array($row = $res->fetch(PDO::FETCH_ASSOC)))
        {
            $permissions[] = $row['permission_id'];
        }

        return $permissions;
    }


    /**
     *  ACCOUNT-RELATED FUNCTIONS
     */

   /* Returns true if a specific account has a specific role. */
   public function accountHasRole(int $account_id, int $role_id)
   {
       $ret = FALSE;

       $account_roles = $this->getAccountRoles($account_id);

       if (in_array($role_id, $account_roles))
       {
           $ret = TRUE;
       }

       return $ret;
   }

   /* Returns true if a specific account has a specific permission. */
   public function accountHasPermission(int $account_id, int $permission_id)
   {
       $ret = FALSE;

       $account_roles = $this->getAccountRoles($account_id);

       foreach ($account_roles as $role_id)
       {
           $role_permissions = $this->getRolePermissions($role_id);

           if (in_array($permission_id, $role_permissions))
           {
               $ret = TRUE;
               break 1;
           }
       }

       return $ret;
   }


   /*
   * PRIVATE FUNCTIONS
   */

    /* Function for handling database exceptions. */
    private function pdo_exception(PDOException $e)
    {
        echo 'PDO exception. Error message: "' . $e->getMessage() . '". Error code: ' . strval($e->getCode()) . '.';
        die();
    }
}