PHP と SOAP: ロールベースのアクセス制御を実装する方法

CREATE TABLE roles (
  id INT PRIMARY KEY,
  name VARCHAR(50)
);

CREATE TABLE permissions (
  id INT PRIMARY KEY,
  name VARCHAR(50)
);

CREATE TABLE role_permission (
  role_id INT,
  permission_id INT,
  FOREIGN KEY (role_id) REFERENCES roles(id),
  FOREIGN KEY (permission_id) REFERENCES permissions(id)
);

INSERT INTO roles (id, name) VALUES (1, '管理员');
INSERT INTO roles (id, name) VALUES (2, '版主');
INSERT INTO roles (id, name) VALUES (3, '普通用户');

INSERT INTO permissions (id, name) VALUES (1, '删除帖子');
INSERT INTO permissions (id, name) VALUES (2, '封禁用户');
INSERT INTO permissions (id, name) VALUES (3, '编辑帖子');
INSERT INTO permissions (id, name) VALUES (4, '浏览帖子');
INSERT INTO permissions (id, name) VALUES (5, '发表帖子');

INSERT INTO role_permission (role_id, permission_id) VALUES (1, 1);
INSERT INTO role_permission (role_id, permission_id) VALUES (1, 2);
INSERT INTO role_permission (role_id, permission_id) VALUES (2, 3);
INSERT INTO role_permission (role_id, permission_id) VALUES (3, 4);
INSERT INTO role_permission (role_id, permission_id) VALUES (3, 5);

$ sudo apt-get install php-soap

<?php
// 导入SOAP类
require_once('lib/nusoap.php');

// 创建一个新的SOAP服务器
$server = new soap_server;

// 定义命名空间
$namespace = "http://www.example.com/roles/";

// 注册"check_permission"方法
$server->register('check_permission', // 方法名
  array('role' => 'xsd:string', 'permission' => 'xsd:string'), // 方法参数
  array('return' => 'xsd:boolean'), // 返回值
  $namespace, // 命名空间
  $namespace.'#check_permission', // 方法详细描述
  'rpc', // 方法调用方式
  'encoded', // 参数编码方式
  'Check if the role has the permission' // 方法解释
);

// 实现"check_permission"方法
function check_permission($role, $permission) {
  $conn = new mysqli('localhost', 'username', 'password', 'database');
  $role = $conn->real_escape_string($role);
  $permission = $conn->real_escape_string($permission);

  // 查询角色和权限的关联关系
  $result = $conn->query("SELECT COUNT(*) AS count
                         FROM role_permission
                         WHERE role_id = (SELECT id FROM roles WHERE name='$role')
                         AND permission_id = (SELECT id FROM permissions WHERE name='$permission')");

  // 检查是否有结果
  if ($result && $result->num_rows > 0) {
    $row = $result->fetch_assoc();
    $count = $row['count'];
    $result->free();

    // 如果关联关系存在，则返回true
    if ($count > 0) {
      return true;
    }
  }

  return false;
}

// 监听和处理SOAP请求
$server->service(file_get_contents("php://input"));
?>

<?php
// 导入SOAP类
require_once('lib/nusoap.php');

// 创建一个新的SOAP客户端
$client = new nusoap_client('http://localhost/soap_server.php');

// 调用服务器上的"check_permission"方法
$response = $client->call('check_permission', array('role' => '管理员', 'permission' => '删除帖子'));

// 检查返回值
if ($client->fault) {
  echo "SOAP Fault: ".$response;
} else {
  // 解析返回值
  $result = $response['return'];

  // 根据返回值进行相应操作
  if ($result) {
    echo "有权限访问";
  } else {
    echo "没有权限访问";
  }
}
?>