mBlog Authentication Library

<?php if (!defined('BASEPATH')) exit('No direct script access allowed');
/**
 * mBlog Authentication Library
 * Mark LaDoux <http://markladoux.com/>
 *
 * Inspired by the DBlog Authentication Library
 * David Behler <http://www.davidbehler.de/>
 *
 * Handles authentication and authorization requests for mBlog.
 *
 * Changes:
 *
 * Change hashing method from md5 to use the PHPass Framework
 * <http://www.openwall.com/phpass/>
 * 
 * Removed some unnecessary functions as they are for features that I
 * have not yet implemented.
 *
 * Simplified a few things here and there.
 *
 * Added a registration function
 *
 * @version		1.0.1
 * @author		Mark LaDoux <[email protected]>
 * @copyright	Copyright (c) 2012, Mark LaDoux
 * @license		http://www.gnu.org/licenses/gpl.html
 */
class Auth
{
	/**
	 * CodeIgniter object
	 *
	 * @access	protected
	 * @var		object
	 * @since	1.0
	 */
	protected $ci;
 
	/**
	 * User information
	 *
	 * @access	protected
	 * @static	array
	 * @since	1.0
	 */
	protected static $user = FALSE; // default to not logged in
 
	/**
	 * User Rights
	 *
	 * @access	protected
	 * @static	array
	 * @since	1.0
	 */
	protected static $rights = FALSE; // default to no rights
 
	/**
	 * __construct
	 *
	 * Prepares library for use
	 *
	 * @access	public
	 * @return	void
	 * @since	1.0
	 */
 
	public function __construct()
	{
		// Load the CodeIgniter object
		$this->ci =& get_instance();
 
		// Ensure library requirements are loaded
		$this->ci->load->database();
		$this->ci->load->library('session');
		$this->ci->load->library('PasswordHash');
 
		// TODO: Add email verification support
		// $this->ci->load->library('email');
 
		// Prepare configuration options
		$user = $this->ci->session->userdata('user');
 
		// get user data
		if($user != FALSE)
		{
			self::$user = $this->get_user($user['user_id']);
		}
		$this->_get_rights($this->get_user_id());
	}
 
	/**
	 * is_logged_in
	 *
	 * Reports whether a user is logged in or not.
	 *
	 * @access	public
	 * @return	bool 
	 * @since	1.0
	 */
 
	public function is_logged_in()
	{
		return is_array(self::$user);
	}
 
	/**
	 * login
	 *
	 * Verifies user credentials
	 *
	 * @access	public
	 * @param	string	$username
	 * @param	string	$password
	 * @return	bool
	 * @since	1.0
	 */
 
	public function login($username, $password)
	{
		// retrieve data for processing.
		$this->ci->db->where('username', $username);
		$result = $this->ci->db->get('users');
 
		// initialize check data as failed
		$valid = FALSE;
 
		// check user password
		if($result->num_rows() ==1)
		{
			$user = $result->row_array();
			if($this->PasswordHash->CheckPassword($password, $user['password']))
			{
				$valid = TRUE;
			}
		}
 
		// if password checks out, let's get this session started!
		if($valid)
		{
			$this->ci->session->set_userdata('user', $user);
			self::$user 	= $user;
			self::$rights	= $this->_get_rights();
		}
 
		// return results
		return $valid;
	}
 
	/**
	 * register
	 *
	 * Registers a new user
	 *
	 * @access	public
	 * @param	string	$username
	 * @param	string	$password
	 * @param	string	$email
	 * @return	bool
	 * @since	1.0
	 */
 
	public function register($username, $password, $email)
	{
		// check if user exists
		$this->ci->db->where('username', $username);
		$result = $this->ci->db->get('users');
		if($result->num_rows() == 1)
		{
			return FALSE;
		}
 
		// verify email address
		if(! filtervar($email, FILTERVALIDATE_EMAIL))
		{
			return FALSE;
		}
 
		// empty query
		$result->free_result();
 
		// make password hash
		$password_hash = $this->PasswordHash->HashPassword($password);
 
		// prepare data for insertion
		$user['username']	= $username;
		$user['password']	= $password_hash;
		$user['email']		= $email;
 
		// insert data into the database.
		$this->ci->db->insert('users', $user);
	}
 
	/**
	 * logout
	 *
	 * logs a user out and destroys session data
	 *
	 * @access	public
	 * @return	void 
	 * @since	1.0
	 */
 
	public function logout()
	{
		self::$user		= FALSE; 			// clear user data
		self::$rights	= FALSE; 			// clear user permissions
		$this->ci->session->sess_destroy();	// destroy session
	}
 
	/**
	 * get_user_name
	 *
	 * retrieves the current user name
	 *
	 * @access	public
	 * @return	string
	 * @since	1.0
	 */
 
	public function get_user_name()
	{
		if($this->is_logged_in())
		{
			return self::$user['username'];
		}
		return FALSE;
	}
 
	/**
	 * get_user_id
	 *
	 * retrieves the current user id
	 *
	 * @access	public
	 * @return	int
	 * @since	1.0
	 */
 
	public function get_user_id()
	{
		if($this->logged_in())
		{
			return self::$user['user_id'];
		}
		return FALSE;
	}
 
	/**
	 * get_user
	 *
	 * Retrieves user information from database
	 *
	 * @access	public
	 * @param	int		$user_id
	 * @return	array
	 * @since	1.0
	 */
 
	public function get_user($user_id = '')
	{
		// if $user_id not set, assume that we
		// are looking for ourselves
		if($this->logged_in() && $user_id == '')
		{
			$user_id = $this->get_user_id();
		}
 
		// retrieve data
		$this->ci->db->where('user_id', $user_id);
		$result	= $this->ci->db->get('users');
 
		// check results
		if($result->num_rows() == 1)
		{
			return $result->row_array();
		}
 
		return FALSE;
	}
 
	/**
	 * _get_rights
	 *
	 * Retrieves users permissions from database
	 *
	 * @access	protected
	 * @param	int		$user_id
	 * @return	void
	 * @since	1.0
	 */
 
	protected function _get_rights($user_id = FALSE)
    {
    	if($this->is_logged_in())
    	{
	    	$this->ci->db->distinct();
	    	$this->ci->db->where('user_group_user_id', $user_id);
	    	$this->ci->db->from('user_group');
	    	$this->ci->db->join(
	    		'group_right', 
	    		'group_right_group_id = user_group_group_id'
	    		);
	    	$this->ci->db->join('right', 'right_id = group_right_right_id');
    	}
    	else
    	{
    		$this->ci->db->distinct();
    		$this->ci->db->from('config');
    		$this->ci->db->join(
    			'group_right', 
    			'config_not_logged_in_user_group_id = group_right_group_id'
    			);
    		$this->ci->db->join('right', 'right_id = group_right_right_id');
    	}
    	$result = $this->ci->db->get();
    	if($result->num_rows() > 0)
    	{
    		self::$rights = array();
			foreach($result->result_array() as $right)
			{
				self::$rights[$right['right_name']] = TRUE;
			}
    	}
    	else
    	{
    		self::$rights = FALSE;
    	}
    }
 
    /**
     * has_right
     *
     * reports whether user has permission to view item, or perform
     * an operation
     *
     * @access	public
     * @return	bool
	 * @since	1.0
     */
 
    public function has_right($right)
    {
 		if(isset(self::$rights[$right]) || isset(self::$rights['admin']))
 		{
 			return TRUE;
 		}
 		return FALSE;
    }
}