Ego_REST_Server.php

gehe zur Dokumentation dieser Datei

<?php
require_once 'base/Site.php';
require_once 'base/Page.php';
require_once 'rights/User_SQL.php';
require_once 'rights/Group_SQL.php';
require_once 'rights/Role_SQL.php';
 
class Ego_REST_Server_Exception extends Exception {
    // Unbekannter Fehler
    const UNKNOWN = 0;
    const UNKNOWN_TEXT = 'Unknown error';
 
    // Nicht authorisiert
    const NOT_AUTHORIZED = 1;
    const NOT_AUTHORIZED_TEXT = 'Not authorized';
 
    // Ungültiger Benutzer
    const INVALID_USER = 2;
    const INVALID_USER_TEXT = 'Invalid user';
 
    // Ungültige Methode
    const INVALID_METHOD = 4;
    const INVALID_METHOD_TEXT = 'Invalid method';
 
    // Ungültige Parameter
    const INVALID_PARAMS = 8;
    const INVALID_PARAMS_TEXT = 'Invalid parameters';
}
 
class Ego_REST_Server {
    const BASE_URI = '/rest/';
 
    private $requestMethod;
 
    private $requestType = '';
 
    private $permissions = array();
 
    private $params = array();
 
    private $site = null;
 
    public function __construct() {
        $this->requestMethod = strtoupper($_SERVER['REQUEST_METHOD']);
 
        // Gesendete Parameter ermitteln
        $request = file_get_contents('php://input');
        $_REQUEST = array_merge(array_merge($_GET, $_POST), (array) json_decode($request, true));
 
        if ($_REQUEST['@data']) {
            $_REQUEST = json_decode($_REQUEST['@data'], true);
        }
 
        if (!is_array($_REQUEST)) {
            $_REQUEST = array();
        }
 
        // Upload erkennen
        foreach ($_REQUEST as $key => $value) {
            if ($value == '@file' && !empty($source = array_shift($_FILES))) {
                $_REQUEST[$key] = $source['tmp_name'];
                break;
            }
        }
 
        $convert_pages = function ($values) use (&$convert_pages) {
            foreach ($values as $key => $value) {
                if (is_array($value)) {
                    $values[$key] = $convert_pages($value);
                } elseif (strpos($value, '@identity:') === 0) {
                    $values[$key] = Page::byIdentity(substr($value, 10), [
                        'auth_or' => '1=1',
                        'deleted_or' => '1=1',
                        'inactive' => true,
                        'only_active' => false
                    ]);
                }
            }
            return $values;
        };
        $_REQUEST = $convert_pages($_REQUEST);
 
        // Parameter aus der URL ermitteln
        $uri = $_SERVER['REQUEST_URI'];
        if (strpos($uri, self::BASE_URI) === 0) {
            // Auszuwertenden URL Bestandteil ermitteln
            $uri = explode('/', substr(parse_url($uri, PHP_URL_PATH), strlen(self::BASE_URI)));
 
            if (sizeof($uri) > 1) {
                // Es gibt mehr als einen Bestandteil, dann herausfinden welches Objekt angesprochen wird
                switch ($uri[0]) {
                    // User_SQL
                    case '~user':
                        $this->requestType = 'user';
                        $this->params['user_id'] = (string) $uri[1]; // Benutzer ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // User_SQL Methode
                        }
                        break;
                    // Group_SQL
                    case '~group':
                        $this->requestType = 'group';
                        $this->params['group_id'] = (string) $uri[1]; // Gruppen ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // Group_SQL Methode
                        }
                        break;
                    // Role_SQL
                    case '~role':
                        $this->requestType = 'role';
                        $this->params['role_id'] = (string) $uri[1]; // Rollen ID
                        if (isset($uri[2])) {
                            $this->params['method'] = (string) $uri[2]; // Role_SQL Methode
                        }
                        break;
                    case '~system':
                        $this->requestType = 'system';
                        if (isset($uri[1])) {
                            $this->params['method'] = (string) $uri[1]; // Ego_System Methode
                        }
                        break;
                    // Site und Page
                    default:
                        $this->requestType = 'site';
 
                        $this->params['site'] = $uri[0]; // Mandant
                        $this->params['lang'] = $uri[1]; // Sprache
                        if (is_numeric($uri[2])) {
                            $this->requestType = 'page';
 
                            $this->params['id'] = $uri[2]; // ID
                            if (isset($uri[3])) {
                                if ($uri[3] == 'pool' && isset($uri[4])) {
                                    $this->requestType = 'pool';
                                    $this->params['method'] = (string) $uri[4]; // Mediapool Methode
                                } else {
                                    $this->params['method'] = (string) $uri[3]; // Page Methode
                                }
                            }
                        } else {
                            $this->params['method'] = (string) $uri[2]; // Site Methode
                        }
                }
            } else {
                // Gibt es nur einen Bestandteil, dann ist das eine Methode des Ego_REST Servers
                $this->params['method'] = $uri[0];
            }
 
            // Rechte Mapping ermitteln
            if (!$GLOBALS['auth']->isNobody()) {
                $cache = $GLOBALS['egotec_conf']['cache_dir'].'api-' . md5(serialize([
                    $GLOBALS['auth']->user->field['user_id'],
                    $GLOBALS['auth']->user->extra['api_token'],
                    (string) $this->params['site']
                ]));
                if (Ego_System::file_exists($cache)) {
                    // Rechte Mapping aus der Cache verwenden
                    $this->permissions = (array) @json_decode(Ego_System::file_get_contents($cache), true);
                } else {
                    $permissions = array(
                        $GLOBALS['egotec_conf']['lib_dir'].'base/rest.ini',
                        $GLOBALS['egotec_conf']['site_dir'].'_global/rest.ini'
                    );
                    if (!empty($this->params['site'])) {
                        $permissions[] = $GLOBALS['egotec_conf']['site_dir'].$this->params['site'].'/rest.ini';
 
                        // Rechte Mapping im Theme suchen
                        require_once('base/Site.php');
                        try {
                            $this->site = new Site($this->params['site'], (string) $this->params['lang']);
                            if ($this->site->theme) {
                                $permissions[] = $GLOBALS['egotec_conf']['pub_dir'].'theme/'.$this->site->theme.'/site/rest.ini';
                            }
                        } catch (Site_Exception $e) {
                            $this->sendError();
                            egotec_error_log($e->getMessage());
                            return array(
                                'error' => 'Unexpected error' . (Ego_System::isDevMode() ? ': ' . $e->getMessage() : ''),
                                'code' => -1
                            );
                        }
                    }
                    foreach ($permissions as $file) {
                        if (Ego_System::file_exists($file)) {
                            $data = (array) @parse_ini_file($file, true);
                            if (!empty($data)) {
                                $this->permissions = array_merge_recursive($this->permissions, $data);
                            }
                        }
                    }
 
                    // Rechte Mapping in die Cache schreiben
                    Ego_System::file_put_contents($cache, json_encode($this->permissions));
                }
            }
        }
    }
 
    public function getResponse() {
        $result = null;
        try {
            if ($this->requestType && $GLOBALS['auth']->isNobody()) {
                // Wenn ein Objekt angesprochen wird, muss man angemeldet sein
                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
            }
            switch ($this->requestType) {
                // Handling für Site und Page Anfragen
                case 'site':
                case 'page':
                case 'pool':
                if ($this->site) {
                    // Das Site Objekt ist bereits bekannt
                    $site = $this->site;
                } else {
                    require_once('base/Site.php');
                    $site = new Site($this->params['site'], (string) $this->params['lang']);
                }
                require_once('base/Page.php');
 
                // Standardmäßig werden keine Seiten gefunden, die nicht in der Sitemap angezeigt werden
                if (!isset($this->params['sitemap'])) {
                    $site->addParam(['sitemap' => true]);
                }
 
                if (!$site->hasRight('view')) {
                        // Das Ansichtsrecht der Site wird nicht erfüllt
                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_PARAMS_TEXT, Ego_REST_Server_Exception::INVALID_PARAMS);
                    }
                    $page = null;
                    if (!empty($this->params['id'])) {
                        $page_param = [];
                        if (empty($this->params['method'])) {
                            // beim Aufruf von "/demo/de/1" sind alle übergebenen Parameter "param"
                            $page_param = $_REQUEST;
                        } elseif (isset($_REQUEST['page_param'])) {
                            // beim Aufruf von z.B. "/demo/de/1/getChildren" wird "page_param" zu "param"
                            $page_param = $_REQUEST['page_param'];
                            unset($_REQUEST['page_param']);
                        }
 
                        // Bei einer Live Replikation müssen alle Seiten ermitteln werden können
                        if ($_SERVER['HTTP_X_REPLICATION']) {
                            $page_param = array_merge($page_param, [
                                'inactive' => true,
                                'only_active' => false,
                                'auth_or' => '1=1',
                                'deleted_or' => '1=1'
                            ]);
                        }
 
                        $page = $GLOBALS['page'] = $site->getPage($this->params['id'], $page_param);
                        if (!$page) {
                            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_PARAMS_TEXT, Ego_REST_Server_Exception::INVALID_PARAMS);
                        }
                    }
 
                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                if ($page) {
                                    if ($this->requestType == 'pool') {
                                        // Eine Mediapool Methode
                                        $result = $this->call($page->getMediapool(), $this->params['method'], $_REQUEST);
                                    } else {
                                        // Eine Page Methode
                                        $result = $this->call($page, $this->params['method'], $_REQUEST);
                                    }
                                } else {
                                    // Eine Site Methode
                                    $result = $this->call($site, $this->params['method'], $_REQUEST);
                                }
                            } else {
                                switch ($this->requestMethod) {
                                    case 'POST':
                                        if (!empty($this->params['id'])) {
                                            if ($this->requestType == 'pool') {
                                                // In Mediapool hochladen
                                                $result = $this->call($page->getMediapool(), 'put', $_REQUEST);
                                            } else {
                                                // Page anlegen
                                                $result = $this->call($page, 'newChild', $_REQUEST);
                                            }
                                        } else {
                                            // Site anlegen
                                            if (!$GLOBALS['auth']->hasSuperuserPermission()) {
                                                // Mandanten dürfen nur Superuser anlegen
                                                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
                                            }
                                            $result = Site::createSite($_REQUEST);
                                        }
                                        break;
                                    case 'GET':
                                        if ($page) {
                                            if (!$page->hasRights('view')) {
                                                // Page ermitteln ist nicht erlaubt
                                                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
                                            }
                                            if ($this->requestType == 'pool') {
                                                // Mediapool zurückliefern
                                                $result = $this->call($page->getMediapool(), 'list', $_REQUEST);
                                            } else {
                                                // Page zurückliefern
                                                $result = $page;
                                            }
                                        } else {
                                            // Site zurückliefern
                                            $result = $site;
                                        }
                                }
                            }
                            break;
                        case 'PUT':
                            if ($page) {
                                if (empty($this->params['method'])) {
                                    if ($this->requestType == 'pool') {
                                        // Mediapool aktualisieren
                                        $result = $this->call($page->getMediapool(), 'edit', $_REQUEST);
                                    } else {
                                        // Page aktualisieren
                                        $result = $this->call($page, 'update', $_REQUEST);
                                    }
                                } else {
                                    if ($this->requestType == 'pool') {
                                        // Eine Pool Methode
                                        $result = $this->call($page->getMediapool(), $this->params['method'], $_REQUEST);
                                    } else {
                                        // Eine Page Methode
                                        $result = $this->call($page, $this->params['method'], $_REQUEST);
                                    }
                                }
                            }
                            break;
                        case 'DELETE':
                            if ($page) {
                                if ($this->requestType == 'pool') {
                                    // Eine Mediapool Datei löschen
                                    $result = $this->call($page->getMediapool(), 'delete', $_REQUEST);
                                } else {
                                    // Page löschen
                                    $result = $this->call($page, 'delete', $_REQUEST);
                                }
                            }
                    }
                    break;
 
                // Handling für Benutzer Anfragen
                case 'user':
                    $user = new User_SQL($this->params['user_id']);
 
                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine User_SQL Methode
                                $result = $this->call($user, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Benutzer anlegen
                                    if (!empty($user->field['user_id'])) {
                                        $user = new User_SQL();
                                    }
                                    $this->call($user, 'update', $_REQUEST);
                                }
 
                                // Benutzer zurückliefern
                                $result = $user;
                            }
                            break;
                        case 'PUT':
                            // Benutzer aktualisieren
                            $result = $this->call($user, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Benutzer löschen
                            $result = $this->call($user, 'delete', $_REQUEST);
                    }
                    break;
 
                // Handling für Gruppen Anfragen
                case 'group':
                    $group = new Group_SQL($this->params['group_id']);
 
                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine Group_SQL Methode
                                $result = $this->call($group, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Gruppe anlegen
                                    $new_group = new Group_SQL();
                                    if ($this->call($group, 'addChild', array($new_group))) {
                                        $new_group = new Group_SQL($new_group->field['group_id']);
                                        $this->call($new_group, 'update', $_REQUEST);
                                        $group = $new_group;
                                    } else {
                                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::UNKNOWN_TEXT, Ego_REST_Server_Exception::UNKNOWN);
                                    }
                                }
 
                                // Gruppe zurückliefern
                                $result = $group;
                            }
                            break;
                        case 'PUT':
                            // Gruppe aktualisieren
                            $result = $this->call($group, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Gruppe löschen
                            $result = $this->call($group, 'delete', $_REQUEST);
                    }
                    break;
 
                // Handling für Rollen Anfragen
                case 'role':
                    $role = new Role_SQL($this->params['role_id']);
 
                    switch ($this->requestMethod) {
                        case 'POST':
                        case 'GET':
                            if (!empty($this->params['method'])) {
                                // Eine Role_SQL Methode
                                $result = $this->call($role, $this->params['method'], $_REQUEST);
                            } else {
                                if ($this->requestMethod == 'POST') {
                                    // Rolle anlegen
                                    $new_role = new Role_SQL();
                                    if ($this->call($role, 'addChild', array($new_role))) {
                                        $new_role = new Role_SQL($new_role->field['role_id']);
                                        $this->call($new_role, 'update', $_REQUEST);
                                        $role = $new_role;
                                    } else {
                                        throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::UNKNOWN_TEXT, Ego_REST_Server_Exception::UNKNOWN);
                                    }
                                }
 
                                // Rolle zurückliefern
                                $result = $role;
                            }
                            break;
                        case 'PUT':
                            // Rolle aktualisieren
                            $result = $this->call($role, 'update', $_REQUEST);
                            break;
                        case 'DELETE':
                            // Rolle löschen
                            $result = $this->call($role, 'delete', $_REQUEST);
                    }
                    break;
 
                // Handling für Ego_System Anfragen
                case 'system':
                    $result = $this->call('Ego_System', $this->params['method'], $_REQUEST);
                    break;
 
                // Handling für Ego_REST Server Anfragen
                default:
                    // Ego_REST Server Methode
                    $result = $this->call($this, $this->params['method'], $_REQUEST);
            }
            $this->sendSuccess();
        } catch (Ego_REST_Server_Exception $e) {
            // Ein Ego_REST Server Fehler wird ausgegeben
            switch ($e->getCode()) {
                case Ego_REST_Server_Exception::NOT_AUTHORIZED:
                    Ego_System::header(401);
                    exit;
                default:
                    $this->sendError();
            }
            return array(
                'error' => $e->getMessage(),
                'code' => $e->getCode()
            );
        } catch (Exception $e) {
            // Jeder andere Fehler wird in die Errorlog geschrieben
            $this->sendError();
            egotec_error_log($e->getMessage());
            return array(
                'error' => 'Unexpected error' . (Ego_System::isDevMode() ? ': ' . $e->getMessage() : ''),
                'code' => -1
            );
        }
 
        return $this->toJSON($result);
    }
 
    private function call($object, $method, $params = array()) {
        if (empty($method) || !method_exists($object, $method)) {
            // Ungültiger Aufruf
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_METHOD_TEXT, Ego_REST_Server_Exception::INVALID_METHOD);
        }
 
        // Berechtigung prüfen
        $authorized = true;
        if (!empty($this->requestType)) {
            if (isset($this->permissions[$this->requestType]) && isset($this->permissions[$this->requestType][$method])) {
                $values = explode(':', $this->permissions[$this->requestType][$method]);
                $methods = explode(',', $values[0]);
                $perms = array_filter(explode(',', $values[1]), function($value) {
                    return trim($value) != '';
                });
 
                if (!empty($methods) && !in_array($this->requestMethod, $methods)) {
                    // Request Methode ist für diesen Aufruf nicht erlaubt
                    $authorized = false;
                }
 
                // Prüfen, ob der aktive Benutzer das notwendige Recht für diesen Aufruf besitzt
                if ($authorized && !empty($perms)) {
                    // Die Site Methode mit diesen Rechten aufrufen
                    if (is_a($object, 'Site')) {
                        $object->setRights($perms);
                    }
 
                    // Rechte für diese Page prüfen
                    if (is_a($object, 'Page') && !$object->hasRights($perms)) {
                        $authorized = false;
                    }
 
                    // Rechte für diesen Mediapool prüfen
                    if (is_a($object, 'Mediapool') && ($page = $object->getPage()) && !$page->hasRights($perms)) {
                        $authorized = false;
                    }
                }
 
                // Rechte für diesen Benutzer prüfen
                if (
                    $authorized
                    && (is_a($object, 'User_SQL')
                        || is_a($object, 'Group_SQL')
                        || is_a($object, 'Role_SQL'))
                    && !$GLOBALS['auth']->hasPermissionOn($object)
                ) {
                    $authorized = false;
                }
 
                // Rechte für "Ego_System" prüfen
                if ($this->requestType == 'system') {
                    if (!empty($perms)) {
                        $authorized = false;
                        foreach ($perms as $perm) {
                            list($group, $role) = explode(';', $perm);
                            if ($GLOBALS['auth']->hasPermission($group, $role)) {
                                $authorized = true;
                                break;
                            }
                        }
                    } elseif (!$GLOBALS['auth']->hasSuperuserPermission()) {
                        // Standardmäßig nur für Superuser zulassen
                        $authorized = false;
                    }
                }
            } else {
                // Ist ein Request Typ gesetzt, dann müssen die erlaubten Methoden definiert sein
                $authorized = false;
            }
            if (!$authorized) {
                throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::NOT_AUTHORIZED_TEXT, Ego_REST_Server_Exception::NOT_AUTHORIZED);
            }
        }
 
        if (!is_array($params)) {
            $params = array();
        }
        return @call_user_func_array(array($object, $method), $params);
    }
 
    private function toJSON($object) {
        // Page, User_SQL, Group_SQL und Role_SQL umwandeln
        if (
            is_a($object, 'Page')
            || is_a($object, 'User_SQL')
            || is_a($object, 'Group_SQL')
            || is_a($object, 'Role_SQL')
        ) {
            return array(
                'field' => $object->field,
                'extra' => $object->extra
            );
        }
 
        // Page_Iterator, User_Iterator, Group_Iterator und Role_Iterator umwandeln
        if (
            is_a($object, 'Page_Iterator')
            || is_a($object, 'User_Iterator')
            || is_a($object, 'Group_Iterator')
            || is_a($object, 'Role_Iterator')
        ) {
            $results = array();
            foreach ($object as $item) {
                $results[] = $this->toJSON($item);
            }
            return $results;
        }
 
        return $object;
    }
 
    private function sendSuccess() {
        switch ($this->requestMethod) {
            case 'POST':
                Ego_System::header(201);
                break;
            case 'GET':
                Ego_System::header(200);
                break;
            case 'PUT':
                Ego_System::header(202);
                break;
            case 'DELETE':
                Ego_System::header(204);
                break;
            default:
                Ego_System::header(405);
                exit;
        }
    }
 
    private function sendError() {
        switch ($this->requestMethod) {
            case 'GET':
                Ego_System::header(204);
                break;
            case 'DELETE':
                Ego_System::header(400);
                break;
            case 'PUT':
            case 'POST':
                Ego_System::header(409);
                break;
            default:
                Ego_System::header(405);
                exit;
        }
    }
 
    private function startSession($user_id, $token) {
        $user = new User_SQL($user_id);
        if (!empty($token) && !empty($user->extra['api_token']) && $user->extra['api_token'] == $token) {
            // Der Benutzer darf sich über die REST API anmelden
            Auth_Factory::login($user_id);
            return !$GLOBALS['auth']->isNobody() ? session_id() : null;
        } else {
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_USER_TEXT, Ego_REST_Server_Exception::INVALID_USER);
        }
    }
 
    private function closeSession() {
        if (!empty($_SESSION['auth_id'])) {
            Auth_Factory::start($GLOBALS['egotec_conf']['auth']['type'], $_SESSION['auth_id'], false, 'logout');
            return true;
        } else {
            throw new Ego_REST_Server_Exception(Ego_REST_Server_Exception::INVALID_USER_TEXT, Ego_REST_Server_Exception::INVALID_USER);
        }
    }
}
?>