<?php
class FM_Controller_Plugin_ACL extends Zend_Controller_Plugin_Abstract
{
    protected $_defaultRole = 'guest';
    protected $_acl = null;

    public function preDispatch(Zend_Controller_Request_Abstract $request)
    {
        $auth = Zend_Auth::getInstance();
        $this->_acl = new FM_Acl();
        $mysession = new Zend_Session_Namespace('mysession');
        $ressource = $request->getControllerName() . '::' . $request->getActionName();

        if($auth->hasIdentity()) {
            $bootstrap = Zend_Controller_Front::getInstance()
                         ->getParam('bootstrap');

            $aConfig = $bootstrap->getOptions();
            $filelist = isset($aConfig['editor']) ? $aConfig['editor'] : false;

            // In-Place Edit aktivieren
            if (is_array($filelist)) {
                $view = $bootstrap->getResource('view');
                foreach($filelist as $type => $files) {
                    if (!is_array($files)) {
                        continue;
                    }
                    foreach ($files as $file) {
                        if ($type == 'scripts') {
                            $view->headScript()->appendFile($view->baseUrl($file));
                        } elseif ($type == 'styles') {
                            $view->headLink()->appendStylesheet($view->baseUrl($file));
                        }
                    }
                }
                $helper = Zend_Controller_Action_HelperBroker::getStaticHelper('ViewRenderer');
                $view->headScript()->appendScript(sprintf('var _template="%s";', $helper->getViewScript()));
            }

            $user = $auth->getIdentity();
            if(!$this->isAllowed($user['role'], $ressource)) {
                $mysession->destination_url = $request->getPathInfo();

                return Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->gotoRoute(array('backend'));
            }
        } else {
            if(!$this->isAllowed($this->_defaultRole, $ressource)) {
                $mysession->destination_url = $request->getPathInfo();

                return Zend_Controller_Action_HelperBroker::getStaticHelper('redirector')->setGotoUrl('/');
            }
        }
    }

    public function isAllowed($user, $ressource) {
        // Grundsätzlich Zugriff gewähren, außer die Ressource ist expliziert definiert
        if (!$this->_acl->has($ressource)) {
            return true;
        }
        try {
            return $this->_acl->isAllowed($user, $ressource);
        } catch (Exception $e) {}
    }
}