1:   2:   3:   4:   5:   6:   7:   8:   9:  10:  11:  12:  13:  14:  15:  16:  17:  18:  19:  20:  21:  22:  23:  24:  25:  26:  27:  28:  29:  30:  31:  32:  33:  34:  35:  36:  37:  38:  39:  40:  41:  42:  43:  44:  45:  46:  47:  48:  49:  50:  51:  52:  53:  54:  55:  56:  57:  58:  59:  60:  61:  62:  63:  64:  65:  66:  67:  68:  69:  70:  71:  72:  73:  74:  75:  76:  77:  78:  79:  80:  81:  82:  83:  84:  85:  86:  87:  88:  89:  90:  91:  92:  93:  94:  95:  96:  97:  98:  99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256: 257: 258: 259: 260: 261: 262: 263: 264: 265: 266: 267: 268: 269: 270: 271: 272: 273: 274: 275: 276: 277: 278: 279: 280: 281: 282: 283: 284: 285: 286: 287: 288: 289: 290: 291: 292: 293: 294: 295: 296: 297: 298: 299: 300: 301: 302: 303: 304: 305: 306: 307: 308: 309: 310: 311: 312: 313: 314: 315: 316: 317: 318: 319: 320: 321: 322: 323: 324: 325: 326: 327: 328: 329: 330: 331: 332: 333: 334: 335: 336: 337: 338: 339: 340: 341: 342: 343: 344: 345: 346: 347: 348: 349: 350: 351: 352: 353: 354: 355: 356: 357: 358: 359: 360: 361: 362: 363: 364: 365: 366: 367: 368: 369: 370: 371: 372: 373: 374: 375: 376: 377: 378: 379: 380: 381: 382: 383: 384: 385: 386: 387: 388: 389: 390: 391: 392: 393: 394: 395: 396: 397: 398: 399: 400: 401: 402: 403: 404: 405: 406: 407: 408: 409: 410: 411: 412: 413: 414: 415: 416: 417: 418: 419: 420: 421: 422: 423: 424: 425: 426: 427: 428: 429: 430: 431: 432: 433: 434: 435: 436: 437: 438: 439: 440: 441: 442: 443: 444: 445: 446: 447: 448: 449: 450: 451: 452: 453: 454: 455: 456: 457: 458: 459: 460: 461: 462: 463: 464: 465: 466: 467: 468: 469: 470: 471: 472: 473: 474: 475: 476: 477: 478: 479: 480: 481: 482: 483: 484: 485: 486: 487: 488: 489: 490: 491: 492: 493: 494: 495: 496: 497: 498: 499: 500: 501: 502: 503: 504: 505: 506: 507: 508: 509: 510: 511: 512: 513: 514: 515: 516: 517: 518: 519: 520: 521: 522: 523: 524: 525: 526: 527: 528: 529: 530: 531: 532: 533: 534: 535: 536: 537: 538: 539: 540: 541: 542: 543: 544: 545: 546: 547: 548: 549: 550: 551: 552: 553: 554: 555: 556: 557: 558: 559: 560: 561: 562: 563: 564: 565: 566: 567: 568: 569: 570: 571: 572: 573: 574: 575: 576: 577: 578: 579: 580: 581: 582: 583: 584: 585: 586: 587: 588: 589: 590: 591: 592: 593: 594: 595: 596: 597: 598: 599: 600: 601: 602: 603: 604: 605: 606: 607: 608: 609: 610: 611: 612: 613: 614: 615: 616: 617: 618: 619: 620: 621: 622: 623: 624: 625: 626: 627: 628: 629: 630: 631: 632: 633: 634: 635: 636: 637: 638: 639: 640: 641: 642: 643: 644: 645: 646: 647: 648: 649: 650: 651: 652: 653: 654: 655: 656: 657: 658: 659: 660: 661: 662: 663: 664: 665: 666: 667: 668: 669: 670: 671: 672: 673: 674: 675: 676: 677: 678: 679: 680: 681: 682: 683: 684: 685: 686: 687: 688: 689: 690: 691: 692: 693: 694: 695: 696: 697: 698: 699: 700: 701: 702: 703: 704: 705: 706: 707: 708: 709: 710: 711: 712: 713: 714: 715: 716: 717: 718: 719: 720: 721: 722: 723: 724: 725: 726: 727: 728: 729: 730: 731: 732: 733: 734: 735: 736: 737: 738: 739: 740: 741: 742: 743: 744: 745: 746: 747: 748: 749: 750: 751: 752: 753: 754: 755: 756: 757: 758: 759: 760: 761: 762: 763: 764: 765: 766: 767: 768: 769: 770: 771: 772: 773: 774: 775: 776: 777: 778: 779: 780: 781: 782: 783: 784: 785: 786: 787: 788: 789: 790: 791: 792: 793: 794: 795: 796: 797: 798: 799: 800: 801: 802: 803: 804: 
<?php
namespace Omeka\Service;

use Interop\Container\ContainerInterface;
use Omeka\Permissions\Acl;
use Omeka\Permissions\Assertion\AssertionNegation;
use Omeka\Permissions\Assertion\HasSitePermissionAssertion;
use Omeka\Permissions\Assertion\SiteIsPublicAssertion;
use Omeka\Permissions\Assertion\IsSelfAssertion;
use Omeka\Permissions\Assertion\OwnsEntityAssertion;
use Omeka\Permissions\Assertion\UserIsAdminAssertion;
use Zend\Permissions\Acl\Assertion\AssertionAggregate;
use Zend\ServiceManager\Factory\FactoryInterface;

/**
 * Access control list factory.
 */
class AclFactory implements FactoryInterface
{
    /**
     * Create the access control list.
     *
     * @param ContainerInterface $serviceLocator
     * @return Acl
     */
    public function __invoke(ContainerInterface $serviceLocator, $requestedName, array $options = null)
    {
        $acl = new Acl;

        $auth = $serviceLocator->get('Omeka\AuthenticationService');
        $acl->setAuthenticationService($auth);

        $this->addRoles($acl);
        $this->addResources($acl, $serviceLocator);

        $status = $serviceLocator->get('Omeka\Status');
        if (!$status->isInstalled()
            || ($status->needsVersionUpdate() && $status->needsMigration())
        ) {
            // Allow all privileges during installation and migration.
            $acl->allow();
        } else {
            $this->addRules($acl);
        }

        return $acl;
    }

    /**
     * Add ACL roles.
     *
     * @param Acl $acl
     */
    protected function addRoles(Acl $acl)
    {
        $acl->addRole(Acl::ROLE_RESEARCHER)
            ->addRole(Acl::ROLE_AUTHOR)
            ->addRole(Acl::ROLE_REVIEWER)
            ->addRole(Acl::ROLE_EDITOR)
            ->addRole(Acl::ROLE_SITE_ADMIN)
            ->addRole(Acl::ROLE_GLOBAL_ADMIN);
    }

    /**
     * Add ACL resources.
     *
     * The following resources are added automatically:
     *
     * - API adapter classes that implement ResourceInterface
     * - Entity classes that implement ResourceInterface
     * - Controller classes
     *
     * @param Acl $acl
     * @param ContainerInterface $serviceLocator
     */
    protected function addResources(Acl $acl, ContainerInterface $serviceLocator)
    {
        $config = $serviceLocator->get('Config');

        // Add resources from configuration.
        if (isset($config['permissions']['acl_resources'])
            && is_array($config['permissions']['acl_resources'])
        ) {
            foreach ($config['permissions']['acl_resources'] as $resource) {
                $acl->addResource($resource);
            }
        }

        // Add API adapters as ACL resources. These resources are used to set
        // rules for general access to API resources.
        if (!isset($config['api_adapters']['invokables'])
            || !is_array($config['api_adapters']['invokables'])
        ) {
            throw new Exception\ConfigException('Missing API adapter configuration');
        }
        foreach ($config['api_adapters']['invokables'] as $adapterClass) {
            $acl->addResource($adapterClass);
        }

        // Add Doctrine entities as ACL resources. These resources are used to
        // set rules for access to specific entities.
        $entities = $serviceLocator->get('Omeka\EntityManager')->getConfiguration()
            ->getMetadataDriverImpl()->getAllClassNames();
        foreach ($entities as $entityClass) {
            if (is_subclass_of($entityClass, 'Zend\Permissions\Acl\Resource\ResourceInterface')) {
                $acl->addResource($entityClass);
            }
        }

        // Add controllers as ACL resources. These rules are used to set rules
        // for access to controllers and their actions.
        $controllers = array_merge(
            array_keys($config['controllers']['invokables']),
            array_keys($config['controllers']['factories'])
        );
        foreach ($controllers as $controller) {
            $acl->addResource($controller);
        }
    }

    /**
     * Add ACL rules.
     *
     * @param Acl $acl
     */
    protected function addRules(Acl $acl)
    {
        $this->addRulesForSites($acl);
        $this->addRulesForAllRoles($acl);
        $this->addRulesForResearcher($acl);
        $this->addRulesForAuthor($acl);
        $this->addRulesForReviewer($acl);
        $this->addRulesForEditor($acl);
        $this->addRulesForSiteAdmin($acl);
        $this->addRulesForGlobalAdmin($acl);
    }

    /**
     * Add rules for sites.
     *
     * @param Acl $acl
     */
    protected function addRulesForSites(Acl $acl)
    {
        $acl->allow(
            null,
            [
                'Omeka\Controller\SiteAdmin\Index',
                'Omeka\Controller\SiteAdmin\Page',
                'Omeka\Controller\Site\Index',
                'Omeka\Controller\Site\Item',
                'Omeka\Controller\Site\ItemSet',
                'Omeka\Controller\Site\Media',
                'Omeka\Controller\Site\Page',
            ]
        );
        $acl->allow(
            null,
            [
                'Omeka\Api\Adapter\SiteAdapter',
                'Omeka\Api\Adapter\SitePageAdapter',
            ]
        );

        $acl->allow(
            'editor',
            'Omeka\Entity\Site',
            'create'
        );

        $acl->allow(
            null,
            'Omeka\Entity\SitePage',
            'create'
        );

        $acl->allow(
            null,
            'Omeka\Entity\Site',
            'delete',
            new OwnsEntityAssertion
        );

        $adminAssertion = $this->aggregate([
            new OwnsEntityAssertion,
            new HasSitePermissionAssertion('admin'),
        ], AssertionAggregate::MODE_AT_LEAST_ONE);
        $acl->allow(
            null,
            'Omeka\Entity\Site',
            'update',
            $adminAssertion
        );

        $editorAssertion = $this->aggregate([
                new OwnsEntityAssertion,
                new HasSitePermissionAssertion('editor'),
            ], AssertionAggregate::MODE_AT_LEAST_ONE);
        $acl->allow(
            null,
            'Omeka\Entity\Site',
            'add-page',
            $editorAssertion
        );
        $acl->allow(
            null,
            'Omeka\Entity\SitePage',
            ['update', 'delete'],
            $editorAssertion
        );

        $viewerAssertion = $this->aggregate([
            new SiteIsPublicAssertion,
            new OwnsEntityAssertion,
            new HasSitePermissionAssertion('viewer'),
        ], AssertionAggregate::MODE_AT_LEAST_ONE);
        $acl->allow(
            null,
            ['Omeka\Entity\Site', 'Omeka\Entity\SitePage'],
            'read',
            $viewerAssertion
        );
    }

    /**
     * Add rules for all roles, including users that aren't authenticated.
     *
     * @param Acl $acl
     */
    protected function addRulesForAllRoles(Acl $acl)
    {
        $acl->allow(
            null,
            [
                'Omeka\Controller\Api',
                'Omeka\Controller\Index',
                'Omeka\Controller\Login',
                'Omeka\Controller\Maintenance',
                'Omeka\Controller\Migrate',
            ]
        );
        $acl->allow(
            null,
            [
                'Omeka\Api\Adapter\ItemSetAdapter',
                'Omeka\Api\Adapter\ItemAdapter',
                'Omeka\Api\Adapter\MediaAdapter',
                'Omeka\Api\Adapter\VocabularyAdapter',
                'Omeka\Api\Adapter\ResourceClassAdapter',
                'Omeka\Api\Adapter\PropertyAdapter',
                'Omeka\Api\Adapter\ResourceTemplateAdapter',
                'Omeka\Api\Adapter\AssetAdapter',
                'Omeka\Api\Adapter\ApiResourceAdapter',
            ],
            [
                'search',
                'read',
            ]
        );
        $acl->allow(
            null,
            [
                'Omeka\Api\Adapter\ResourceAdapter',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Item',
                'Omeka\Entity\Media',
                'Omeka\Entity\Vocabulary',
                'Omeka\Entity\ResourceClass',
                'Omeka\Entity\Property',
                'Omeka\Entity\ResourceTemplate',
                'Omeka\Entity\Asset',
            ],
            [
                'read',
            ]
        );
    }

    /**
     * Add rules for "researcher" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForResearcher(Acl $acl)
    {
        $acl->allow(
            'researcher',
            [
                'Omeka\Controller\Admin\Index',
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
                'Omeka\Controller\Admin\Vocabulary',
                'Omeka\Controller\Admin\ResourceClass',
                'Omeka\Controller\Admin\Property',
                'Omeka\Controller\Admin\SystemInfo',
            ],
            [
                'index',
                'browse',
                'show',
                'show-details',
            ]
        );
        $acl->allow(
            'researcher',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
            ],
            ['sidebar-select', 'search']
        );
        $acl->allow(
            'researcher',
            'Omeka\Controller\Admin\Asset',
            'sidebar-select'
        );
        $acl->allow(
            'researcher',
            'Omeka\Controller\Admin\Vocabulary',
            ['classes', 'properties']
        );
        $acl->allow(
            'researcher',
            'Omeka\Controller\Admin\User'
        );
        $acl->allow(
            'researcher',
            'Omeka\Api\Adapter\UserAdapter',
            ['read', 'update', 'search']
        );
        $acl->allow(
            'researcher',
            'Omeka\Entity\User',
            'read'
        );
        $acl->allow(
            'researcher',
            'Omeka\Entity\User',
            ['update', 'change-password', 'edit-keys'],
            new IsSelfAssertion
        );
    }

    /**
     * Add rules for "author" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForAuthor(Acl $acl)
    {
        $acl->allow(
            'author',
            [
                'Omeka\Controller\Admin\Index',
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
                'Omeka\Controller\Admin\Vocabulary',
                'Omeka\Controller\Admin\ResourceClass',
                'Omeka\Controller\Admin\Property',
                'Omeka\Controller\Admin\SystemInfo',
            ],
            [
                'index',
                'browse',
                'show',
                'show-details',
            ]
        );
        $acl->allow(
            'author',
            'Omeka\Controller\Admin\ResourceTemplate',
            ['add-new-property-row', 'import']
        );
        $acl->allow(
            'author',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
            ],
            ['sidebar-select', 'search']
        );
        $acl->allow(
            null,
            'Omeka\Controller\Admin\Asset',
            'sidebar-select'
        );
        $acl->allow(
            'author',
            'Omeka\Controller\Admin\Vocabulary',
            ['classes', 'properties']
        );
        $acl->allow(
            'author',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
            ],
            [
                'add',
                'edit',
                'delete',
                'delete-confirm',
            ]
        );
        $acl->allow(
            'author',
            [
                'Omeka\Api\Adapter\ItemAdapter',
                'Omeka\Api\Adapter\ItemSetAdapter',
                'Omeka\Api\Adapter\MediaAdapter',
                'Omeka\Api\Adapter\ResourceTemplateAdapter',
            ],
            [
                'create',
                'update',
                'delete',
            ]
        );
        $acl->allow(
            'author',
            [
                'Omeka\Entity\Item',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Media',
                'Omeka\Entity\ResourceTemplate',
            ],
            [
                'create',
            ]
        );
        $acl->allow(
            'author',
            [
                'Omeka\Entity\Item',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Media',
                'Omeka\Entity\ResourceTemplate',
            ],
            [
                'update',
                'delete',
            ],
            new OwnsEntityAssertion
        );
        $acl->allow(
            'author',
            'Omeka\Controller\Admin\User'
        );
        $acl->allow(
            'author',
            'Omeka\Api\Adapter\UserAdapter',
            ['read', 'update', 'search']
        );
        $acl->allow(
            'author',
            'Omeka\Entity\User',
            'read'
        );
        $acl->allow(
            'author',
            'Omeka\Entity\User',
            ['update', 'change-password', 'edit-keys'],
            new IsSelfAssertion
        );
    }

    /**
     * Add rules for "reviewer" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForReviewer(Acl $acl)
    {
        $acl->allow(
            'reviewer',
            [
                'Omeka\Controller\Admin\Index',
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
                'Omeka\Controller\Admin\Vocabulary',
                'Omeka\Controller\Admin\ResourceClass',
                'Omeka\Controller\Admin\Property',
                'Omeka\Controller\Admin\SystemInfo',
            ],
            [
                'index',
                'browse',
                'show',
                'show-details',
            ]
        );
        $acl->allow(
            'reviewer',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
            ],
            ['sidebar-select', 'search']
        );
        $acl->allow(
            null,
            'Omeka\Controller\Admin\Asset',
            'sidebar-select'
        );
        $acl->allow(
            'reviewer',
            'Omeka\Controller\Admin\Vocabulary',
            ['classes', 'properties']
        );
        $acl->allow(
            'reviewer',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
            ],
            [
                'add',
                'edit',
                'delete',
                'delete-confirm',
            ]
        );
        $acl->allow(
            'reviewer',
            [
                'Omeka\Api\Adapter\ItemAdapter',
                'Omeka\Api\Adapter\ItemSetAdapter',
                'Omeka\Api\Adapter\MediaAdapter',
            ],
            [
                'create',
                'update',
                'delete',
            ]
        );
        $acl->allow(
            'reviewer',
            [
                'Omeka\Entity\Item',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Media',
            ],
            [
                'create',
                'update',
            ]
        );
        $acl->allow(
            'reviewer',
            [
                'Omeka\Entity\Item',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Media',
            ],
            [
                'delete',
            ],
            new OwnsEntityAssertion
        );
        $acl->allow(
            'reviewer',
            'Omeka\Entity\Resource',
            'view-all'
        );
        $acl->allow(
            'reviewer',
            'Omeka\Controller\Admin\User'
        );
        $acl->allow(
            'reviewer',
            'Omeka\Api\Adapter\UserAdapter',
            ['read', 'update', 'search']
        );
        $acl->allow(
            'reviewer',
            'Omeka\Entity\User',
            'read'
        );
        $acl->allow(
            'reviewer',
            'Omeka\Entity\User',
            ['update', 'change-password', 'edit-keys'],
            new IsSelfAssertion
        );
    }

    /**
     * Add rules for "editor" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForEditor(Acl $acl)
    {
        $acl->allow(
            'editor',
            [
                'Omeka\Controller\Admin\Index',
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
                'Omeka\Controller\Admin\Vocabulary',
                'Omeka\Controller\Admin\ResourceClass',
                'Omeka\Controller\Admin\Property',
                'Omeka\Controller\Admin\SystemInfo',
            ],
            [
                'index',
                'browse',
                'show',
                'show-details',
            ]
        );
        $acl->allow(
            'editor',
            'Omeka\Controller\Admin\ResourceTemplate',
            ['add-new-property-row', 'import']
        );
        $acl->allow(
            'editor',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
            ],
            ['sidebar-select', 'search']
        );
        $acl->allow(
            null,
            'Omeka\Controller\Admin\Asset',
            'sidebar-select'
        );
        $acl->allow(
            'editor',
            'Omeka\Controller\Admin\Vocabulary',
            ['classes', 'properties']
        );
        $acl->allow(
            'editor',
            [
                'Omeka\Controller\Admin\Item',
                'Omeka\Controller\Admin\ItemSet',
                'Omeka\Controller\Admin\Media',
                'Omeka\Controller\Admin\ResourceTemplate',
            ],
            [
                'add',
                'edit',
                'delete',
                'delete-confirm',
            ]
        );
        $acl->allow(
            'editor',
            [
                'Omeka\Api\Adapter\ItemAdapter',
                'Omeka\Api\Adapter\ItemSetAdapter',
                'Omeka\Api\Adapter\MediaAdapter',
                'Omeka\Api\Adapter\ResourceTemplateAdapter',
            ],
            [
                'create',
                'update',
                'delete',
            ]
        );
        $acl->allow(
            'editor',
            [
                'Omeka\Entity\Item',
                'Omeka\Entity\ItemSet',
                'Omeka\Entity\Media',
                'Omeka\Entity\ResourceTemplate',
            ],
            [
                'create',
                'update',
                'delete',
            ]
        );
        $acl->allow(
            'editor',
            'Omeka\Entity\Resource',
            'view-all'
        );
        $acl->allow(
            'editor',
            'Omeka\Controller\Admin\User'
        );
        $acl->allow(
            'editor',
            'Omeka\Api\Adapter\UserAdapter'
        );
        $acl->allow(
            'editor',
            'Omeka\Entity\User',
            ['read']
        );
        $acl->allow(
            'editor',
            'Omeka\Entity\User',
            ['update', 'change-password', 'edit-keys'],
            new IsSelfAssertion
        );
    }

    /**
     * Add rules for "site_admin" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForSiteAdmin(Acl $acl)
    {
        $acl->allow('site_admin');
        $acl->deny(
            'site_admin',
            ['Omeka\Module\Manager', 'Omeka\Controller\Admin\Module'],
            ['activate', 'deactivate', 'install', 'uninstall', 'upgrade', 'configure']
        );
        $acl->deny(
            'site_admin',
            'Omeka\Controller\Admin\Vocabulary',
            ['import']
        );
        $acl->deny(
            'site_admin',
            'Omeka\Controller\Admin\Setting'
        );
        $acl->deny(
            'site_admin',
            'Omeka\Api\Adapter\VocabularyAdapter',
            ['create', 'update', 'delete']
        );

        $acl->deny(
            'site_admin',
            'Omeka\Entity\User',
            'change-role-admin'
        );
        $acl->deny(
            'site_admin',
            'Omeka\Entity\User',
            ['change-role', 'activate-user', 'delete'],
            new IsSelfAssertion
        );

        // Site admins should not be able to edit other admin users but should
        // be able to edit themselves
        $denyEdit = new AssertionAggregate;
        $denyEdit->addAssertions([
            new UserIsAdminAssertion,
            new AssertionNegation(new IsSelfAssertion),
        ]);
        $acl->deny(
            'site_admin',
            'Omeka\Entity\User',
            ['update', 'delete', 'change-password', 'edit-keys'],
            $denyEdit
        );
    }

    /**
     * Add rules for "global_admin" role.
     *
     * @param Acl $acl
     */
    protected function addRulesForGlobalAdmin(Acl $acl)
    {
        $acl->allow('global_admin');
        $acl->deny(
            'global_admin',
            'Omeka\Entity\User',
            ['change-role', 'activate-user', 'delete'],
            new IsSelfAssertion
        );
    }

    /**
     * Create an assertion aggregate from the given assertions and the given mode.
     *
     * This is just a convenience method to avoid having to write the somewhat verbose aggregate
     * code over and over within the grants.
     *
     * @param array $assertions Array of Assertion objects to be aggregated
     * @param string $mode Aggregation mode
     * @return AssertionAggregate
     */
    protected function aggregate(array $assertions, $mode = AssertionAggregate::MODE_ALL)
    {
        $aggregate = new AssertionAggregate;
        $aggregate->addAssertions($assertions);
        $aggregate->setMode($mode);
        return $aggregate;
    }
}