How to detect specific deny on a role?

Question

Zend_Acl by default disallow every role to every resource on every privilege untill or unless they are specifically allowed. In my system a user can have many roles and permission are assinged to these roles. I simply get all user roles iterate over all of them and check isAllowed() for given resourse and privilege for every role.

for e.g if current resourse is 'foo' and privilege is 'bar'

public function checkAllow($roles, $resouse, $privilege)
{

    foreach ($roles as $role) {
        if ($acl->isAllowed($role, 'foo', 'bar') === true)
            return true;
    }
    return false;
}

Now I want to implement sort order on these roles i.e first role assinged will have more preference then second and so forth.

Problem comes how can I detect specific deny to some roles like

$this->deny('member','foo','bar');

While iterating over all roles how can I know the given role was specificly "denyied"? So at that point I can break out of foreach loop and return false.

Answer 1

Ok I found the solution myself by going into Zend_Acl code well its come out to be Zend_Acl is missing isDenied() Method , it has isAllowed() but not isDenied()

Heres my implementation of isDenied() method in class which extends Zend_Acl

public function isDenied($roleId,$resource,$privilege)
    {

        if($this->has($resource) && $this->hasRole($roleId))
        {

         $roleId = $this->getRole($roleId)->getRoleId();
         $resourceId = $this->get($resource)->getResourceId();   

       return @$this->_rules['byResourceId'][$resourceId]['byRoleId'][$roleId]['byPrivilegeId'][$privilege]['type'] === 'TYPE_DENY';
        }

        return false;
    }

Answer 2

Ok, so assuming I undertand the question, is something like this what you are looking for? if not, please explain the question a little better so i can assist better.

psuedo-code

// User starts without permission
$has_permission = false

// if any of the users roles have permission set true
foreach $user->roles as $role
    // if any of the user's roles allow this permission
    if $role->has_permission() == true
        $has_permission = true

    // if a user is specifically denied a permission that takes precedence
    // and immediately kicks the user out
    if $role->is_specifically_denied_permission() == true
        return  false

// return whatever value (true or false) is in $has_permission
return $has_permission