如果提供了断言器，则ZF2 /导航ACL /接受不起作用

Question

I have a member role with a resource platform.ticketing and a privilege access .

Acl is defined such as below :

$this->allow('member', 'platform.ticketing', 'access', new HasTicketing());

HasTicketing is a simple asserter returning true if member can access or false if not.

If I remove asserter, everything works fine but the menu appears ...

On my navigation config :

// ...
[
    'label'     => 'Ticketing',
    'route'     => 'platform/ticketing',
    'resource'  => 'platform.ticketing',
    'privilege' => 'access',
],
// ...

On navigation partial :

// ...
foreach($this->container->getPages() as $page) {
    if(!$page->isVisible() || !$this->navigation()->accept($page)) continue;
// ...

Please, check the Xdebug trace at the returning of accept() ZF AclListener class

Answer 1

I wasn't able to replicate the problem using Zend Framework v2.5.1 and the Skeleton Application:

module/Application/config/module.config.php

return array(
    // ...
    'navigation' => array(
        'default' => array(
            array(
                'label' => 'Home',
                'route' => 'home',
            ),
            array(
                'label' => 'Page #1',
                'route' => 'home',
                'resource'  => 'mvc:admin',
                'privilege' => 'access',
                'pages' => array(
                    array(
                        'label' => 'Child #1',
                        'route' => 'home',
                    ),
                ),
            ),
            array(
                'label' => 'Page #2',
                'route' => 'home',
            ),
        ),
    ),
    'service_manager' => array(
        // ...
        'factories' => array(
            'my-navigation' => 'Zend\Navigation\Service\DefaultNavigationFactory',
            // ...
        ),
    ),
    // ...
);

module/Application/Module.php

namespace Application;

use Application\Acl\Assertion;
use Zend\View\HelperPluginManager;
use Zend\Permissions\Acl as ZendAcl;

class Module
{
    // ...
    public function getViewHelperConfig()
    {
        return array(
            'factories' => array(
                // This will overwrite the native navigation helper
                'navigation' => function(HelperPluginManager $pm) {
                    $assertion = new Assertion\TestAssertion();

                    // Setup ACL:
                    $acl = new ZendAcl\Acl();
                    $acl->addRole(new ZendAcl\Role\GenericRole('member'));
                    $acl->addRole(new ZendAcl\Role\GenericRole('admin'));
                    $acl->addResource(new ZendAcl\Resource\GenericResource('mvc:admin'));
                    $acl->addResource(new ZendAcl\Resource\GenericResource('mvc:community.account'));
                    $acl->allow('member', 'mvc:community.account');

                    $acl->allow('admin', 'mvc:admin', 'access', $assertion);
//                    $acl->allow('admin', 'mvc:admin', 'access');

                    // Get an instance of the proxy helper
                    $navigation = $pm->get('Zend\View\Helper\Navigation');

                    // Store ACL and role in the proxy helper:
                    $navigation->setAcl($acl)->setRole('admin');

                    // Return the new navigation helper instance
                    return $navigation;
                }
            )
        );
    // ...
}

module/Application/src/Application/Acl/Assertion/TestAssertion.php

namespace Application\Acl\Assertion;

use Zend\Permissions\Acl as ZendAcl;

class TestAssertion implements ZendAcl\Assertion\AssertionInterface
{
    public function assert(ZendAcl\Acl $acl,
                           ZendAcl\Role\RoleInterface $role = null,
                           ZendAcl\Resource\ResourceInterface $resource = null,
                           $privilege = null)
    {
        return true;
    }
}

module/Application/view/application/index/index.phtml

<?php $this->navigation('my-navigation')->menu()->setPartial('application/partials/menu') ?>
<?php echo $this->navigation('my-navigation')->menu(); ?>

module/Application/view/application/partials/menu.phtml

<?php
foreach($this->container->getPages() as $page) {
    if (!$page->isVisible() || !$this->navigation()->accept($page)) {
        continue;
    }

    echo $this->navigation()->menu()->htmlify($page) . '<br />';
}

With Application\\Acl\\Assertion\\TestAssertion::assert() returning true , "Page #1" menu link is displayed.

With Application\\Acl\\Assertion\\TestAssertion::assert() returning false , "Page #1" menu link is not displayed.

If you remove the $assertion in Application\\Module::getViewHelperConfig() , $acl->allow('admin', 'mvc:admin', 'access'); , the link will render again. This is because the role (admin) will have access to the resource (mvc:admin) and privilege (access).

The above leads me to believe that you are either using a dated version of Zend Framework or Application\\Acl\\Asserter\\HasTracking::assert() isn't returning the boolean you are expecting.