Ego_REST_Server.php

gehe zur Dokumentation dieser Datei

<?php
class Ego_REST_Server_Exception extends Exception {
    // Unbekannter Fehler
    const UNKNOWN = 0;
    const UNKNOWN_TEXT = 'Unknown error';

    // Nicht authorisiert
    const NOT_AUTHORIZED = 1;
    const NOT_AUTHORIZED_TEXT = 'Not authorized';

    // Ungültiger Benutzer
    const INVALID_USER = 2;
    const INVALID_USER_TEXT = 'Invalid user';

    // Ungültige Methode
    const INVALID_METHOD = 4;
    const INVALID_METHOD_TEXT = 'Invalid method';

    // Ungültige Parameter
    const INVALID_PARAMS = 8;
    const INVALID_PARAMS_TEXT = 'Invalid parameters';
}

class Ego_REST_Server {
    const BASE_URI = '/rest/';

    private $requestMethod;

    private $requestType = '';

    private $permissions = array();

    private $params = array();

    private $site = null;

    public function __construct() {
        $this->requestMethod = strtoupper($_SERVER['REQUEST_METHOD']);

        // Gesendete Parameter ermitteln
        $request = file_get_contents('php://input');
        switch ($this->requestMethod) {
            case 'PUT':
                parse_str($request, $_REQUEST);
                break;
            default:
                $_REQUEST = array_merge(array_merge($_GET, $_POST), (array) json_decode($request, true));
        }
        if (!is_array($_REQUEST)) {
            $_REQUEST = array();
        }

        // Parameter aus der URL ermitteln
        $uri = $_SERVER['REQUEST_URI'];
        if (strpos($uri, self::BASE_URI) === 0) {
            // Auszuwertenden URL Bestandteil ermitteln
            $uri = explode('/', substr(parse_url($uri, PHP_URL_PATH), strlen(self::BASE_URI)));

            if (sizeof($uri) > 1) {
                // Es gibt mehr als einen Bestandteil, dann herausfinden welches Objekt angesprochen wird
                switch ($uri[0]) {
                    // User_SQL
                    case '~user':
                        $this->requestType = 'user';
                        $this->params['user_id'] = (string) $uri[1]; // Benutzer ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // User_SQL Methode
                        }
                        break;
                    // Group_SQL
                    case '~group':
                        $this->requestType = 'group';
                        $this->params['group_id'] = (string) $uri[1]; // Gruppen ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // Group_SQL Methode
                        }
                        break;
                    // Role_SQL
                    case '~role':
                        $this->requestType = 'role';
                        $this->params['role_id'] = (string) $uri[1]; // Rollen ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // Role_SQL Methode
                        }
                        break;
                    case '~system':
                        $this->requestType = 'system';
                        if (isset($uri[1])) {
                            $this->params['method'] = (string) $uri[1]; // Ego_System Methode
                        }
                        break;
                    // Site und Page
                    default:
                        $this->requestType = 'site';

                        $this->params['site'] = $uri[0]; // Mandant
                        $this->params['lang'] = $uri[1]; // Sprache
                        if (is_numeric($uri[2])) {
                            $this->requestType = 'page';

                            $this->params['id'] = $uri[2]; // ID
                            if (isset($uri[3])) {
                                $this->params['method'] = (string) $uri[3]; // Page Methode
                            }
                        } else {
                            $this->params['method'] = (string) $uri[2]; // Site Methode
                        }
                }
            } else {
                // Gibt es nur einen Bestandteil, dann ist das eine Methode des Ego_REST Servers
                $this->params['method'] = $uri[0];
            }

            // Rechte Mapping ermitteln
            if (!$GLOBALS['auth']->isNobody()) {
                $cache = $GLOBALS['egotec_conf']['cache_dir'].'api-'.$GLOBALS['auth']->user->field['user_id'].'-'.$GLOBALS['auth']->user->extra['api_token'];
                if (Ego_System::file_exists($cache)) {
                    // Rechte Mapping aus der Cache verwenden
                    $this->permissions = (array) @json_decode(Ego_System::file_get_contents($cache), true);
                } else {
                    $permissions = array(
                        $GLOBALS['egotec_conf']['lib_dir'].'base/rest.ini',
                        $GLOBALS['egotec_conf']['site_dir'].'_global/rest.ini'
                    );
                    if (!empty($this->params['site'])) {
                        $permissions[] = $GLOBALS['egotec_conf']['site_dir'].$this->params['site'].'/rest.ini';

                        // Rechte Mapping im Theme suchen
                        require_once('base/Site.php');
                        try {
                            $this->site = new Site($this->params['site'], (string) $this->params['lang']);
                            if ($this->site->theme) {
                                $permissions[] = $GLOBALS['egotec_conf']['pub_dir'].'theme/'.$this->site->theme.'/site/rest.ini';
                            }
                        } catch (Site_Exception $e) {
                            $this->sendError();
                            egotec_error_log($e->getMessage());
                            return array(
                                'error' => 'Unexpected error' . (Ego_System::isDevMode() ? ': ' . $e->getMessage() : ''),
                                'code' => -1
                            );
                        }
                    }
                    foreach ($permissions as $file) {
                        if (Ego_System::file_exists($file)) {
                            $data = (array) @parse_ini_file($file, true);
                            if (!empty($data)) {
                                $this->permissions = array_merge_recursive($this->permissions, $data);
                            }
                        }
                    }

                    // Rechte Mapping in die Cache schreiben
                    Ego_System::file_put_contents($cache, json_encode($this->permissions));
                }
            }
        }
    }

    public function getResponse() {
        $result = null;
        try {
            if ($this->requestType && $GLOBALS['auth']->isNobody()) {
                // Wenn ein Objekt angesprochen wird, muss man angemeldet sein
                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
            }
            switch ($this->requestType) {
                // Handling für Site und Page Anfragen
                case 'site':
                case 'page':
                    if ($this->site) {
                        // Das Site Objekt ist bereits bekannt
                        $site = $this->site;
                    } else {
                        require_once('base/Site.php');
                        $site = new Site($this->params['site'], (string) $this->params['lang']);
                    }
                    require_once('base/Page.php');

                    if (!$site->hasRight('view')) {
                        // Das Ansichtsrecht der Site wird nicht erfüllt
                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_PARAMS_TEXT, Ego_REST_Server_Exception::INVALID_PARAMS);
                    }
                    $page = null;
                    if (!empty($this->params['id'])) {
                        $page_param = [];
                        if (empty($this->params['method'])) {
                            // beim Aufruf von "/demo/de/1" sind alle übergebenen Parameter "param"
                            $page_param = $_REQUEST;
                        } elseif (isset($_REQUEST['page_param'])) {
                            // beim Aufruf von z.B. "/demo/de/1/getChildren" wird "page_param" zu "param"
                            $page_param = $_REQUEST['page_param'];
                            unset($_REQUEST['page_param']);
                        }
                        $page = $site->getPage($this->params['id'], $page_param);
                        if (!$page) {
                            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_PARAMS_TEXT, Ego_REST_Server_Exception::INVALID_PARAMS);
                        }
                    }

                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                if ($page) {
                                    // Eine Page Methode
                                    $result = $this->call($page, $this->params['method'], $_REQUEST);
                                } else {
                                    // Eine Site Methode
                                    $result = $this->call($site, $this->params['method'], $_REQUEST);
                                }
                            } else {
                                switch ($this->requestMethod) {
                                    case 'POST':
                                        if (!empty($this->params['id'])) {
                                            // Page anlegen
                                            $result = $this->call($page, 'newChild', $_REQUEST);
                                        } else {
                                            // Site anlegen
                                            if (!$GLOBALS['auth']->hasSuperuserPermission()) {
                                                // Mandanten dürfen nur Superuser anlegen
                                                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
                                            }
                                            $result = Site::createSite($_REQUEST);
                                        }
                                        break;
                                    case 'GET':
                                        if ($page) {
                                            // Page zurückliefern
                                            if (!$page->hasRights('view')) {
                                                // Page ermitteln ist nicht erlaubt
                                                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
                                            }
                                            $result = $page;
                                        } else {
                                            // Site zurückliefern
                                            $result = $site;
                                        }
                                }
                            }
                            break;
                        case 'PUT':
                            if ($page) {
                                // Page aktualisieren
                                $result = $this->call($page, 'update', $_REQUEST);
                            }
                            break;
                        case 'DELETE':
                            if ($page) {
                                // Page löschen
                                $result = $this->call($page, 'delete', $_REQUEST);
                            }
                    }
                    break;

                // Handling für Benutzer Anfragen
                case 'user':
                    require_once('rights/User_SQL.php');
                    $user = new User_SQL($this->params['user_id']);

                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine User_SQL Methode
                                $result = $this->call($user, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Benutzer anlegen
                                    if (!empty($user->field['user_id'])) {
                                        $user = new User_SQL();
                                    }
                                    $this->call($user, 'update', $_REQUEST);
                                }

                                // Benutzer zurückliefern
                                $result = $user;
                            }
                            break;
                        case 'PUT':
                            // Benutzer aktualisieren
                            $result = $this->call($user, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Benutzer löschen
                            $result = $this->call($user, 'delete', $_REQUEST);
                    }
                    break;

                // Handling für Gruppen Anfragen
                case 'group':
                    require_once('rights/Group_SQL.php');
                    $group = new Group_SQL($this->params['group_id']);

                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine Group_SQL Methode
                                $result = $this->call($group, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Gruppe anlegen
                                    $new_group = new Group_SQL();
                                    if ($this->call($group, 'addChild', array($new_group))) {
                                        $new_group = new Group_SQL($new_group->field['group_id']);
                                        $this->call($new_group, 'update', $_REQUEST);
                                        $group = $new_group;
                                    } else {
                                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::UNKNOWN_TEXT, Ego_REST_Server_Exception::UNKNOWN);
                                    }
                                }

                                // Gruppe zurückliefern
                                $result = $group;
                            }
                            break;
                        case 'PUT':
                            // Gruppe aktualisieren
                            $result = $this->call($group, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Gruppe löschen
                            $result = $this->call($group, 'delete', $_REQUEST);
                    }
                    break;

                // Handling für Rollen Anfragen
                case 'role':
                    require_once('rights/Role_SQL.php');
                    $role = new Role_SQL($this->params['role_id']);

                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine Role_SQL Methode
                                $result = $this->call($role, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Rolle anlegen
                                    $new_role = new Role_SQL();
                                    if ($this->call($role, 'addChild', array($new_role))) {
                                        $new_role = new Role_SQL($new_role->field['role_id']);
                                        $this->call($new_role, 'update', $_REQUEST);
                                        $role = $new_role;
                                    } else {
                                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::UNKNOWN_TEXT, Ego_REST_Server_Exception::UNKNOWN);
                                    }
                                }

                                // Rolle zurückliefern
                                $result = $role;
                            }
                            break;
                        case 'PUT':
                            // Rolle aktualisieren
                            $result = $this->call($role, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Rolle löschen
                            $result = $this->call($role, 'delete', $_REQUEST);
                    }
                    break;

                // Handling für Ego_System Anfragen
                case 'system':
                    // Nur für Superuser zulassen
                    if (!$GLOBALS['auth']->hasSuperuserPermission()) {
                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
                    }
                    $result = $this->call('Ego_System', $this->params['method'], $_REQUEST);
                    break;

                // Handling für Ego_REST Server Anfragen
                default:
                    // Ego_REST Server Methode
                    $result = $this->call($this, $this->params['method'], $_REQUEST);
            }
            $this->sendSuccess();
        } catch (Ego_REST_Server_Exception $e) {
            // Ein Ego_REST Server Fehler wird ausgegeben
            switch ($e->getCode()) {
                case Ego_REST_Server_Exception::NOT_AUTHORIZED:
                    Ego_System::header(401);
                    exit;
                default:
                    $this->sendError();
            }
            return array(
                'error' => $e->getMessage(),
                'code' => $e->getCode()
            );
        } catch (Exception $e) {
            // Jeder andere Fehler wird in die Errorlog geschrieben
            $this->sendError();
            egotec_error_log($e->getMessage());
            return array(
                'error' => 'Unexpected error' . (Ego_System::isDevMode() ? ': ' . $e->getMessage() : ''),
                'code' => -1
            );
        }

        return $this->toJSON($result);
    }

    private function call($object, $method, $params = array()) {
        if (empty($method) || !method_exists($object, $method)) {
            // Ungültiger Aufruf
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_METHOD_TEXT, Ego_REST_Server_Exception::INVALID_METHOD);
        }

        // Berechtigung prüfen
        $authorized = true;
        if (!empty($this->requestType)) {
            if (isset($this->permissions[$this->requestType]) && isset($this->permissions[$this->requestType][$method])) {
                $values = explode(':', $this->permissions[$this->requestType][$method]);
                $methods = explode(',', $values[0]);
                $perms = explode(',', $values[1]);

                if (!empty($methods) && !in_array($this->requestMethod, $methods)) {
                    // Request Methode ist für diesen Aufruf nicht erlaubt
                    $authorized = false;
                }

                // Prüfen, ob der aktive Benutzer das notwendige Recht für diesen Aufruf besitzt
                if ($authorized && !empty($perms)) {
                    // Die Site Methode mit diesen Rechten aufrufen
                    if (is_a($object, 'Site')) {
                        $object->setRights($perms);
                    }

                    // Rechte für diese Page prüfen
                    if (is_a($object, 'Page') && !$object->hasRights($perms)) {
                        $authorized = false;
                    }
                }

                // Rechte für diesen Benutzer prüfen
                if (
                    $authorized
                    && (is_a($object, 'User_SQL')
                        || is_a($object, 'Group_SQL')
                        || is_a($object, 'Role_SQL'))
                    && !$GLOBALS['auth']->hasPermissionOn($object)
                ) {
                    $authorized = false;
                }
            } else {
                // Ist ein Request Typ gesetzt, dann müssen die erlaubten Methoden definiert sein
                $authorized = false;
            }
            if (!$authorized) {
                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
            }
        }

        if (!is_array($params)) {
            $params = array();
        }
        return @call_user_func_array(array($object, $method), $params);
    }

    private function toJSON($object) {
        // Page, User_SQL, Group_SQL und Role_SQL umwandeln
        if (
            is_a($object, 'Page')
            || is_a($object, 'User_SQL')
            || is_a($object, 'Group_SQL')
            || is_a($object, 'Role_SQL')
        ) {
            return array(
                'field' => $object->field,
                'extra' => $object->extra
            );
        }

        // Page_Iterator, User_Iterator, Group_Iterator und Role_Iterator umwandeln
        if (
            is_a($object, 'Page_Iterator')
            || is_a($object, 'User_Iterator')
            || is_a($object, 'Group_Iterator')
            || is_a($object, 'Role_Iterator')
        ) {
            $results = array();
            foreach ($object as $item) {
                $results[] = $this->toJSON($item);
            }
            return $results;
        }

        return $object;
    }

    private function sendSuccess() {
        switch ($this->requestMethod) {
            case 'POST':
                Ego_System::header(201);
                break;
            case 'GET':
                Ego_System::header(200);
                break;
            case 'PUT':
                Ego_System::header(202);
                break;
            case 'DELETE':
                Ego_System::header(204);
                break;
            default:
                Ego_System::header(405);
                exit;
        }
    }

    private function sendError() {
        switch ($this->requestMethod) {
            case 'GET':
                Ego_System::header(204);
                break;
            case 'DELETE':
                Ego_System::header(400);
                break;
            case 'PUT':
            case 'POST':
                Ego_System::header(409);
                break;
            default:
                Ego_System::header(405);
                exit;
        }
    }

    private function startSession($user_id, $token) {
        $user = new User_SQL($user_id);
        if (!empty($token) && !empty($user->extra['api_token']) && $user->extra['api_token'] == $token) {
            // Der Benutzer darf sich über die REST API anmelden
            Auth_Factory::login($user_id);
            return !$GLOBALS['auth']->isNobody() ? session_id() : null;
        } else {
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_USER_TEXT, Ego_REST_Server_Exception::INVALID_USER);
        }
    }

    private function closeSession() {
        if (!empty($_SESSION['auth_id'])) {
            Auth_Factory::start($GLOBALS['egotec_conf']['auth']['type'], $_SESSION['auth_id'], false, 'logout');
            return true;
        } else {
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_USER_TEXT, Ego_REST_Server_Exception::INVALID_USER);
        }
    }
}
?>