/**
  * Get acl for role
  *
  * @param Zend_Acl_Role_Interface $role
  * @return Zend_Acl
  */
 public function getAcl(Zend_Acl_Role_Interface $role)
 {
     if (isset($this->cache[$role->getRoleId()])) {
         return $this->cache[$role->getRoleId()];
     }
     $acl = new Zend_Acl();
     // set resources
     $resources = $this->getResources();
     foreach (array_keys($resources) as $resource) {
         $acl->addResource($resource);
     }
     // get role parents if possible
     $method = self::PARENTS_METHOD;
     $parents = NULL;
     if (method_exists($role, $method)) {
         foreach ($role->{$method}() as $parent) {
             $parents[] = $parent;
             $acl->addRole($parent);
             $this->addRules($acl, $parent);
         }
     }
     // set role
     $acl->addRole($role, $parents);
     $this->addRules($acl, $role);
     return $this->cache[$role->getRoleId()] = $acl;
 }

 /**
  * Add parent to the $role node
  *
  * @param \Zend_Acl_Role_Interface|string $role
  * @param array|\Zend_Acl_Role_Interface|string $parents
  * @return $this
  * @throws \Zend_Acl_Role_Registry_Exception
  */
 public function addParent($role, $parents)
 {
     try {
         if ($role instanceof \Zend_Acl_Role_Interface) {
             $roleId = $role->getRoleId();
         } else {
             $roleId = $role;
             $role = $this->get($role);
         }
     } catch (\Zend_Acl_Role_Registry_Exception $e) {
         throw new \Zend_Acl_Role_Registry_Exception("Child Role id '{$roleId}' does not exist");
     }
     if (!is_array($parents)) {
         $parents = [$parents];
     }
     foreach ($parents as $parent) {
         try {
             if ($parent instanceof \Zend_Acl_Role_Interface) {
                 $roleParentId = $parent->getRoleId();
             } else {
                 $roleParentId = $parent;
             }
             $roleParent = $this->get($roleParentId);
         } catch (\Zend_Acl_Role_Registry_Exception $e) {
             throw new \Zend_Acl_Role_Registry_Exception("Parent Role id '{$roleParentId}' does not exist");
         }
         $this->_roles[$roleId]['parents'][$roleParentId] = $roleParent;
         $this->_roles[$roleParentId]['children'][$roleId] = $role;
     }
     return $this;
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     if (!$resource instanceof WatcherModel) {
         throw new Exception('Resource must be an instance of WatcherModel');
     }
     switch ($resource->scope) {
         case 'user':
             return $role->id == $resource->scopeId;
         case 'apiId':
             if (!$role instanceof \Application\Model\CurrentUserModel || !$role->isApiAuthUser()) {
                 return FALSE;
             }
             return $role->apiId == $resource->scopeId;
         case 'token':
             if (Zend_Auth::getInstance()->hasIdentity() && ($ident = Zend_Auth::getInstance()->getIdentity()) && isset($ident['token'])) {
                 return $ident['token'] === $resource->scopeId;
             }
             return false;
         case 'organization':
             return $role->organizationId === $resource->scopeId;
     }
     return false;
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     // Get the organization
     $orgService = \Application\Service\OrgService::getInstance();
     $org = $orgService->load($role->getOrganizationId());
     if ($org->getType() != OrgCustomerModel::ORG_TYPE) {
         $org = $orgService->getParentByType($org, OrgCustomerModel::ORG_TYPE);
     }
     if ($org && !is_null($org->getSupplementaryServicesId())) {
         // Check if the customer has supplementary services configured
         // with application originated SMS option activated
         $supplSrv = \Application\Service\SupplServicesService::getInstance();
         $services = $supplSrv->load($org->getSupplementaryServicesId());
         if ($services && $services->getApplicationOriginatedSms() == SupplServicesModel::ST_ACTIVATED) {
             return true;
         }
     }
     throw new Exception('Role must have applicationOriginatedSms activated');
 }

 /**
  * 判断是否有访问某个游戏的条件
  * 
  * @see Zend_Acl_Assert_Interface::assert()
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if ($this->_request->has('gametype')) {
         $roleData = ZtChart_Model_Acl_Loader::getInstance()->getRole($role->getRoleId());
         return in_array($this->_request->getParam('gametype'), $roleData['role_gametype']);
     }
     return true;
 }

 /**
  * Get rules for role
  *
  * @param Zend_Acl_Role_Interface $role
  * @return array
  */
 public function getRules(\Zend_Acl_Role_Interface $role)
 {
     $em = $this->doctrine->getManager();
     $queryBuilder = $em->getRepository('Newscoop\\Entity\\Acl\\Rule')->createQueryBuilder('r')->select('r.resource, r.action, r.type')->where('r.role = :role')->setParameter('role', $role->getRoleId());
     if (is_a($role, '\\Newscoop\\Entity\\User\\Group')) {
         // @fix WOBS-568: ignore deny rules for roles
         $queryBuilder->andWhere('r.type = :allow')->setParameter('allow', 'allow');
     }
     return $queryBuilder->getQuery()->getArrayResult();
 }

 /**
  * Get rules for role
  *
  * @param Zend_Acl_Role_Interface $role
  * @return array
  */
 public function getRules(\Zend_Acl_Role_Interface $role)
 {
     $em = $this->doctrine->getManager();
     $repository = $em->getRepository('Newscoop\\Entity\\Acl\\Rule');
     $criteria = array('role' => $role->getRoleId());
     if (is_a($role, '\\Newscoop\\Entity\\User\\Group')) {
         // @fix WOBS-568: ignore deny rules for roles
         $criteria['type'] = 'allow';
     }
     return $repository->findBy($criteria);
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     return $role->isImpersonating();
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     if (!$resource instanceof App_ListFilter) {
         throw new Exception('Resource must be an instance of App_ListFilter');
     }
     $filter = $resource->getOneFilterByFieldName(SimFilterFields::SERVICE_PROVIDER_COMM);
     if (!$filter) {
         return false;
     }
     return $filter->getValue() == $role->getOrganizationId();
 }

 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if (NULL === $role) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof \Application\Model\UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $org = $role->getOrganization();
     $orgConfig = \Application\Service\OrgService::getInstance()->getOrgConfig($org);
     $keyConfig = $this->getKey();
     $valueConfig = $this->getValue();
     return $orgConfig->getConfig($keyConfig) == $valueConfig;
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  null                        $privilege
  * @return bool
  * @throws Exception
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof \Application\Model\UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $org = $role->getOrganization();
     if (!$org instanceof \Application\Model\Organization\OrgServiceProviderModel) {
         throw new Exception('Org must be an instance of OrgServiceProviderModel');
     }
     return \Application\Service\OrgService::getInstance()->isEnabler($org);
 }

 /**
  * This assertion should receive the actual User objects.
  *
  * @param Zend_Acl $acl
  * @param Zend_Acl_Role_Interface $user
  * @param Zend_Acl_Resource_Interface $model
  * @param $privilege
  * @return bool
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $user = null, Zend_Acl_Resource_Interface $model = null, $privilege = null)
 {
     if ($user) {
         $sessions = $user->getSessionsToChair();
     } else {
         return false;
     }
     $request = Zend_Controller_Front::getInstance()->getRequest();
     $param = $request->getParam('id') ? $request->getParam('id') : $request->getParam('session_id');
     // perform check
     if ($param !== null && in_array((int) $param, $sessions, true)) {
         return true;
     } else {
         return false;
     }
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $orgId = $role->getOrganizationId();
     if (!$resource instanceof SimModel) {
         throw new Exception('Resource must be an instance of SimModel');
     }
     return $orgId === $resource->getServiceProviderCommercialId();
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     if (!$resource instanceof OrgModelAbstract) {
         throw new Exception('Resource must be an instance of OrgModelAbstract');
     }
     $type = $resource->getType();
     if (!isset($this->_types[$type])) {
         throw new Exception('Resource has an undefined organization type');
     }
     $org = $role->getOrganization();
     $orgType = $org->getType();
     return $this->_diff($this->_types[$orgType], $this->_types[$type]);
 }

 /**
  * This assertion should receive the actual Presentation objects.
  *
  * @param Zend_Acl $acl
  * @param Zend_Acl_Role_Interface $user
  * @param Zend_Acl_Resource_Interface $model
  * @param $privilege
  * @return bool
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $user = null, Zend_Acl_Resource_Interface $model = null, $privilege = null)
 {
     if ($user) {
         $presentations = $user->getMyPresentations();
     } else {
         return false;
     }
     $request = Zend_Controller_Front::getInstance()->getRequest();
     $param = $request->getParam('id') ? $request->getParam('id') : $request->getParam('presentation_id');
     $presentation = $model->getPresentationById($param);
     // perform check
     if ($param !== null && $presentation->isBeforeEditDeadline() && in_array((int) $param, $presentations, true)) {
         return true;
     } else {
         return false;
     }
 }

 /**
  * Returns true if and only if the assertion conditions are met
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  null                        $privilege
  * @return bool
  * @throws Exception
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $orgId = $role->getOrganizationId();
     switch (true) {
         case $resource instanceof OrgModelAbstract:
             return $orgId === $resource->getParentId();
         case $resource instanceof Model\PreBillModel:
             return true;
             //TODO: we need serviceProviderId from ericsson
             return $orgId === $resource->getServiceProvider()->getId();
         case $resource instanceof UserModel:
             try {
                 $org = $resource->getOrganization();
                 if (NULL !== $org) {
                     return $orgId === $org->getParentId();
                 }
                 App::log()->err("User (" . $resource->getId() . ") organization (" . $resource->getOrganizationId() . ") doesn't exist");
                 return false;
             } catch (Exception $e) {
                 return false;
             }
         case $resource instanceof Model\CommercialGroupModel:
             // customerId is one of service provider customers?
             // TODO aggregatorId case?
             $org = OrgService::getInstance()->load($resource->getCustomerId());
             return $org && $orgId === $org->getParentId();
         case $resource instanceof Model\ReportModel:
             $params = $resource->getParams();
             if (isset($params['orgId']) && !empty($params['orgId'])) {
                 $org = OrgService::getInstance()->load($params['orgId']);
                 return $org && $orgId === $org->getParentId();
             } else {
                 return true;
             }
     }
     throw new Exception('Resource must be an instance of OrgModelAbstract or UserModel');
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     if (!$resource instanceof SimModel) {
         throw new Exception('Resource must be an instance of SimModel');
     }
     // Get the organization
     $orgService = \Application\Service\OrgService::getInstance();
     if ($orgService->getTypeById($role->getOrganizationId()) == OrgServiceProviderModel::ORG_TYPE) {
         $org = $orgService->load($resource->customerId);
     } else {
         $org = $orgService->load($role->getOrganizationId());
     }
     if ($org->getType() != OrgCustomerModel::ORG_TYPE) {
         $org = $orgService->getParentByType($org, OrgCustomerModel::ORG_TYPE);
     }
     if ($org && !is_null($org->getSupplementaryServicesId())) {
         // Check if the customer has supplementary services configured
         // with application originated SMS option activated
         $supplSrv = \Application\Service\SupplServicesService::getInstance();
         try {
             if ($orgService->getTypeById($role->getOrganizationId()) == OrgAggregatorModel::ORG_TYPE) {
                 $services = $supplSrv->load($org->getSupplementaryServicesId(), $org);
             } else {
                 $services = $supplSrv->load($org->getSupplementaryServicesId());
             }
         } catch (\Exception $e) {
             \App::log()->warn($e);
             return False;
         }
         if ($services && $services->advancedSupervision == SupplServicesModel::ST_ACTIVATED) {
             return true;
         }
     }
     return false;
 }

 /**
  * This assertion should receive the actual User objects.
  *
  * @param Zend_Acl $acl
  * @param Zend_Acl_Role_Interface $user
  * @param Zend_Acl_Resource_Interface $model
  * @param $privilege
  * @return bool
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $user = null, Zend_Acl_Resource_Interface $model = null, $privilege = null)
 {
     if ($user) {
         $presentations = $user->getMyPresentations();
     } else {
         return false;
     }
     $param = Zend_Controller_Front::getInstance()->getRequest()->getParam('id', null);
     if (!$param) {
         return false;
     }
     // get presentation_id
     $presentation = $model->getResource('presentationsusers')->getItemById($param)->presentation_id;
     // perform check
     if ($presentation !== null && in_array((int) $presentation, $presentations, true)) {
         return true;
     } else {
         return false;
     }
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  null                        $privilege
  * @return bool
  * @throws Exception
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof \Application\Model\UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $org = $role->getOrganization();
     if ($org instanceof \Application\Model\Organization\OrgServiceProviderModel) {
         $orgConfigValidator = new App_Acl_Assert_OrgConfig(array('key' => OrgConfigModel::ORG_CONFIG_LTE_ENABLED, 'value' => true));
         return $orgConfigValidator->assert($acl, $role, $resource, $privilege);
     } else {
         if ($org instanceof \Application\Model\Organization\OrgCustomerModel) {
             return $org->lteEnabled;
         }
     }
     return false;
 }

 /**
  * Returns true if and only if the assertion conditions are met
  *
  * This method is passed the ACL, Role, Resource, and privilege to which
  * the authorization query applies. If the $role, $resource, or $privilege
  * parameters are null, it means that the query applies to all Roles,
  * Resources, or privileges, respectively.
  *
  * @param  Zend_Acl                    $acl
  * @param  Zend_Acl_Role_Interface     $role
  * @param  Zend_Acl_Resource_Interface $resource
  * @param  string                      $privilege
  * @return boolean
  */
 public function assert(Zend_Acl $acl, Zend_Acl_Role_Interface $role = null, Zend_Acl_Resource_Interface $resource = null, $privilege = null)
 {
     // We need specific objects to check against each other
     if (NULL === $role || NULL === $resource) {
         return false;
     }
     // Ensure we're handled User models
     if (!$role instanceof Model\UserModel) {
         throw new Exception('Role must be an instance of UserModel');
     }
     $orgId = $role->getOrganizationId();
     switch (true) {
         case $resource instanceof OrgModelAbstract:
             $parent = OrgService::getInstance()->load($resource->getParentId());
             if ($parent) {
                 return $orgId === $parent->getParentId();
             }
             return false;
     }
     throw new Exception('Resource must be an instance of OrgModelAbstract');
 }