Core: Implement Role based Access Control

- This system will give more control of actions an account can perform.

System defines:
- Permissions to perform some action
- Roles: a set of permissions that have some relation
- Groups: a set of roles that have some relation

Operations:
- Grant: Assign and allow
- Deny: Assign and do not allow
- Revoke: Remove

Precedence to know if something can be done: Grant, Deny. That means, if you are granted some action by a role but you have denied the permission, the action can not be done.

Some Rules:
- Groups can only have roles
- Roles can only have permissions
- An account can be assigned granted and denied roles. Permissions inherited from roles are granted if roles is granted and denied if roles is denied
- An account can be assigned granted and denied permissions
- An account can have multiple groups, roles and permissions
- An account can not have same role granted and denied at same time
- An acconnt can not have same permission granted and denied at same time
- Id 0 can not be used to define a group, role or permission

Added some permissions as a sample of use (Instant Logout, Skip Queue, Join BGs, Join DF) and some permissions as a workaround to commands till command system is modified to use RBAC
This commit is contained in:
Spp
2013-02-04 09:04:33 +01:00
parent db9b087550
commit b980aff83e
21 changed files with 625 additions and 87 deletions
+26 -3
View File
@@ -21,6 +21,7 @@
*/
#include "WorldSocket.h" // must be first to make ACE happy with ACE includes in it
#include "Config.h"
#include "Common.h"
#include "DatabaseEnv.h"
#include "Log.h"
@@ -115,7 +116,8 @@ WorldSession::WorldSession(uint32 id, WorldSocket* sock, AccountTypes sec, uint8
m_TutorialsChanged(false),
recruiterId(recruiter),
isRecruiter(isARecruiter),
timeLastWhoCommand(0)
timeLastWhoCommand(0),
_RBACData(NULL)
{
if (sock)
{
@@ -143,8 +145,8 @@ WorldSession::~WorldSession()
m_Socket = NULL;
}
if (_warden)
delete _warden;
delete _warden;
delete _RBACData;
///- empty incoming packet queue
WorldPacket* packet = NULL;
@@ -1200,3 +1202,24 @@ void WorldSession::InitWarden(BigNumber* k, std::string const& os)
// _warden->Init(this, k);
}
}
void WorldSession::LoadPermissions()
{
uint32 id = GetAccountId();
std::string name;
int32 realmId = ConfigMgr::GetIntDefault("RealmID", 0);
AccountMgr::GetName(id, name);
_RBACData = new RBACData(id, name, realmId);
_RBACData->LoadFromDB();
}
RBACData* WorldSession::GetRBACData()
{
return _RBACData;
}
bool WorldSession::HasPermission(uint32 permission)
{
return _RBACData->HasPermission(permission);
}