浅谈Yii-admin的权限控制

1 php composer.phar require mdmsoft/yii2-admin "~2.0"
2 php composer.phar update

1 'aliases' => [
2     '@mdm/admin' => '@vendor/mdmsoft/yii2-admin',
3 ],

1 'admin' => [
2     'class' => 'mdm\admin\Module',
3     'layout' => '@app/views/layouts/main_nifty',//yii2-admin的导航菜单
4 ],

1 'authManager' => [
2     'class' => 'yii\rbac\DbManager', // or use 'yii\rbac\DbManager'
3 ],

 1 'as access' => [
 2     'class' => 'mdm\admin\components\AccessControl',
 3     'allowActions' => [
 4         // add or remove allowed actions to this list
 5         // 'admin/*',
 6         //'*',
 7         'site/*',
 8         'api/*',
 9     ]
10 ],

1 yii migrate --migrationPath=@yii/rbac/migrations
2 yii migrate --migrationPath=@mdm/admin/migrations 

1 menu             //菜单表
2 auth_rule        //规则表
3 auth_item_child  //角色对应的权限，parent角色，child权限名
4 auth_item        //角色、权限表,type=1表示角色,type=2表示权限
5 auth_assignment  //角色与用户对应关系表

'layout' => '@app/views/layouts/main_nifty',

1 echo Nav::widget(
2     [
3         "encodeLabels" => false,
4         "options" => ["class" => "sidebar-menu"],
5         "items" => MenuHelper::getAssignedMenu(Yii::$app->user->id),
6     ]
7 );

 1 
class="nav nav-list">
 2 php 
 3 $idx = 1;
 4 $request_url = '/' . $mod_id . '/' . $con_id . '/' . $act_id . '/';
 5 foreach ($menus_new['list'] as $label => $menu1): ?>
 6 php
 7     if (empty($menu1['label']) && empty($menu['url'][0])) {
 8         continue;
 9     }
10 ?>
11 if(!isset($menu1['items'])):?>
12     
class="13             if (isset($menu1['openurl']) && strstr($menu1['openurl'], $request_url)) {
14                 echo 'active';
15                 $breadcrumb[] = $menu1['label'];
16             }
17         ?>">
18         $menu1['url'][0] ?>">
19             class="menu-icon fa fa-$menu1['icon'] ?>">
20             class="menu-text"> echo $menu1['label'] ?> 
21         
22         class="arrow">
23     
24 else:?>
25     
class="26             if (isset($menu1['openurl']) && strstr($menu1['openurl'], $request_url)) {
27                 echo 'open';
28                 $breadcrumb[] = $menu1['label'];
29             }
30         ?>">
31         $idx ?>"class="dropdown-toggle">
32             class="menu-icon fa fa-$menu1['icon'] ?>">
33             class="menu-text"> 
34                 echo $menu1['label'] ?> 
35             
36             class="arrow fa fa-angle-down">
37         
38         class="arrow">
39         
$idx ?>" class="submenu">
40             foreach ($menu1['items'] as $label => $menu2): ?>
41             php 
42                 if (empty($menu2) || !is_array($menu2)) { continue; }
43                 if(!isset($menu2['items'])):?>
44                 
class="45                     if (isset($menu2['openurl']) && strstr($menu2['openurl'], $request_url)) {
46                         echo 'active';
47                         $breadcrumb[] = $menu2['label'];
48                     }
49                 ?>">
50                     $menu2['url'][0] ?>">
51                         class="menu-icon fa fa-caret-right">
52                         echo $menu2['label'] ?>
53                     
54                     class="arrow">
55                 
56             else:?>
57                 
class="58                     if (isset($menu2['openurl']) && strstr($menu2['openurl'], $request_url)) {
59                         echo 'open';
60                         $breadcrumb[] = $menu2['label'];
61                     }
62                     ?>">
63                     class="dropdown-toggle">
64                         class="menu-icon fa fa-caret-right">
65                         echo $menu2['label'] ?>
66                         class="arrow fa fa-angle-down">
67                     
68                     class="arrow">
69                     
class="submenu">
70                         foreach ($menu2['items'] as $label => $url): ?>
71                         if (empty($url) || !is_array($url)) { continue; } ?>
72                         
class="73                             if (isset($url['openurl']) && strstr($url['openurl'], $request_url)) {
74                                 echo 'active';
75                                 $breadcrumb[] = $url['label'];
76                             }
77                             ?>">
78                             $url['url'][0] ?>">
79                               class="menu-icon fa fa-caret-right">
80                               echo $url['label'] ?>
81                             
82                             class="arrow">
83                         
84                         endforeach ?>
85                     
86               　
87             endif?>
88             endforeach ?>
89         
90     
91 endif?>
92 $idx++; ?>
93 endforeach ?>
94 

 1 $user_id = Yii::$app->user->id;
 2 $breadcrumb = [];
 3 $menus_new['list'] = MenuHelper::getAssignedMenu($user_id);
 4 
 5 $redis_key = MenuHelper::getMenuKeyByUserId($user_id);
 6 $redis_menu = Yii::$app->redis->get($redis_key);
 7 $redis_varsion = getVersion();
 8 
 9 if (!empty($redis_menu)) {
10     $menus_new = json_decode($redis_menu, true);
11     $old_version = isset($menus_new['version']) ? $menus_new['version'] : '';
12 
13     //判断菜单的版本号，便于及时更新缓存
14     if (!isset($menus_new['list']) || empty($old_version) || intval($old_version) != $redis_varsion) {
15         $menus_new = getMenu($user_id, $redis_varsion, $redis_key);
16         $log = json_encode([
17             'user_id' => $user_id,
18             'varsion' => $redis_varsion,
19             'redis_key' => $redis_key,
20             'value' => $menus_new
21         ]);
22         writeLog($log, 'update_menu');
23     }
24 } else {
25     $menus_new = getMenu($user_id, $redis_varsion, $redis_key);
26 }
27 
28 function getMenu($user_id, $varsion, $redis_key)
29 {
30     $menus_new['list'] = MenuHelper::getAssignedMenu($user_id);
31     $menus_new['version'] = $varsion;
32     Yii::$app->redis->set($redis_key, json_encode($menus_new));
33     Yii::$app->redis->expire($redis_key, 300);
34     return $menus_new;
35 }
36 
37 //设置更新key便于时时更新redis
38 function getVersion()
39 {
40     $version_key = Yii::$app->params['redis_key']['menu_prefix'] . md5(Yii::$app->params['redis_key']['menu_version'] . Yii::$app->db->dsn);
41     $version_val = Yii::$app->redis->get($version_key);
42 
43     return empty($version_val) ? 1 : $version_val;
44 }

 1 /**
 2  * get menu one user by the id
 3  * @param  $user_id
 4  * @return key string
 5  */
 6 public static function getMenuKeyByUserId($user_id)
 7 {
 8     if (empty($user_id)) {
 9         return false;
10     }
11 
12     $list = (new \yii\db\Query())->select('**')
13                                  ->from('**')
14                                  ->where(['user_id' => $user_id])
15                                  ->all();
16 
17     if (empty($list)) {
18         return false;
19     }
20 
21     $role_str = '';
22     foreach ($list as $key => $value) {
23         $role_str .= $value['item_name'];
24     }
25 
26     $redis_key = Yii::$app->params['key'] . md5($role_str . Yii::$app->db->dsn);
27 
28     return $redis_key;
29 }
30 
31 /**
32  * 修改菜单更新状态，更新redis
33  */
34 public static function UpdateMenuVersion()
35 {
36     $version_key = Yii::$app->params['key'] . md5(Yii::$app->params['key'] . Yii::$app->db->dsn);
37     $version_val = Yii::$app->redis->get($version_key);
38 
39     if (empty($version_val)) {
40         $version_val = '1';
41     } else {
42         $version_val++;
43     }
44 
45     $log = json_encode([
46         'user_id' => Yii::$app->user->id, 
47         'version_key' => $version_key, 
48         'version_val' => $version_val
49     ]);
50     writeLog($log, 'update_menu_version');
51 
52     Yii::$app->redis->set($version_key, $version_val);
53 }

{"icon": "fa fa-home", "visible": true, "openurl":"/web/site/index/"}

 1 $user_type = Yii::$app->user->identity->type;
 2 $customer_id = Yii::$app->user->identity->customer_id;
 3 
 4 $callback_func = function($menu) use ($user_type, $customer_id) {
 5     $data = json_decode($menu['data'], true);
 6     $items = $menu['children'];
 7 
 8     $return = [
 9         'label' => $menu['name'],
10         'url' => [$menu['route']],
11     ];
12 
13     $return['visible'] = isset($data['visible']) ? $data['visible'] : '';
14 
15     //菜单隐藏的逻辑
16     if (empty($return['visible'])) {
17         return false;
18     }
19 
20     $return['icon'] = isset($data['icon']) ? $data['icon'] : '';
21 
22     //控制菜单打开的逻辑
23     $return['openurl'] = isset($data['openurl']) ? $data['openurl'] : '';
24 
25     $items && $return['items'] = $items;
26     return $return;
27 };

 1 /**
 2  * @inheritdoc
 3  */
 4 public function beforeAction($action)
 5 {
 6     $actionId = $action->getUniqueId();
 7     $user = $this->getUser();
 8 
 9     //预留系统检查权限的逻辑，一旦重写检查权限失败，调用系统检查权限的方法
10     if ($user->can('/' . $actionId)) {
11         return true;
12     }
13     $obj = $action->controller;
14     do {
15         if ($user->can('/' . ltrim($obj->getUniqueId() . '/*', '/'))) {
16             return true;
17         }
18         $obj = $obj->module;
19     } while ($obj !== null);
20 
21     $this->denyAccess($user);
22 }

  1 /**
  2  * 权限判断方法 (先不要使用该方法，用的系统方法，效率极低，等有时间重写之后再用)
  3  * @param string/array $permission_name 权限值（URL 或者 权限名）/批量检测可以传入数组
  4  * @param int $user 用户id，不传值会取当前的登陆用户
  5  * @return boolen
  6  * @author zhaoyafei
  7  */
  8 public static function permissionCheck($permission_name, $user = 0)
  9 {
 10     //检查是否登陆过
 11     if (Yii::$app->user->isGuest) {
 12         Yii::$app->response->redirect('/site/login');
 13     }
 14 
 15     if (empty($permission_name)) {
 16         return false;
 17     }
 18 
 19     if (empty($user)) {
 20         $user = Yii::$app->user->id;
 21     }
 22 
 23     //管理员权限不能直接返回true，会存在管理员type = 1分到非管理员权限的人员（有坑）
 24 
 25     //匿名方法，处理管理员返回值的情况
 26     /*$setAdminSet = function($param) use ($permission_name) {
 27         $paramtmp = $permission_name;
 28         if (is_array($paramtmp)) {
 29             if (count($paramtmp) == 1) {
 30                 return true;
 31             }
 32 
 33             $paramtmp = array_flip($paramtmp);
 34             foreach ($paramtmp as $key => &$value) {
 35                 $value = true;
 36             }
 37         } else {
 38             $paramtmp = true;
 39         }
 40         return $paramtmp;
 41     };*/
 42 
 43     //检查是否是管理员, 管理员都有权限
 44     /*if (empty($user)) {
 45         $user = Yii::$app->user->id;
 46         $user_type = Yii::$app->user->identity->type;
 47 
 48         if ($user_type == TYPE_ADMIN) {
 49             return $setAdminSet($permission_name);
 50         }
 51 
 52     } else {
 53         $user_sql = "SELECT type FROM xm_user WHERE id = :id";
 54         $user_info = Yii::$app->db->createCommand($user_sql)->bindValue(":id", $user)->queryOne();
 55         if (empty($user_info)) {
 56             return false;
 57         }
 58 
 59         if ($user_info['type'] == TYPE_ADMIN) {
 60             return $setAdminSet($permission_name);
 61         }
 62     }*/
 63 
 64     //根据用户去取权限
 65     $permission_list = [];
 66     $sql = "SELECT xc.child, xc1.child as role_name FROM xm_auth_assignment xa 
 67             INNER JOIN xm_auth_item_child xc ON xa.item_name = xc.parent
 68             LEFT JOIN xm_auth_item_child xc1 ON xc.child = xc1.parent
 69             WHERE xa.user_id = :user_id";
 70     $permission = Yii::$app->db->createCommand($sql)
 71                           ->bindValue(":user_id", $user)
 72                           ->queryAll();
 73 
 74     if (empty($permission)) {
 75         return false;
 76     }
 77 
 78     //组合权限列表
 79     foreach ($permission