rend-acl 0.0.2 → 0.0.3

data/README.md

@@ -22,4 +22,4 @@ Rend-Acl is a port of [Zend_Acl](http://framework.zend.com/manual/1.12/en/zend.a
 
 ## Acknowledgements
 * This project is **not** associated with, or endorsed by, Zend Technologies USA, Inc., nor any of its contributors.
-* Rend's modular design was heavily influced by [RSpec](https://github.com/rspec/rspec) approach.
+* Rend's modular design was heavily influced by [RSpec](https://github.com/rspec/rspec)'s approach.

data/lib/rend/acl.rb

@@ -1,4 +1,5 @@
 require 'rend/core'
+
 require 'rend/acl/version'
 require 'rend/acl/exception'
 require 'rend/acl/role'
@@ -76,7 +77,7 @@ module Rend
     # @param  Rend::Acl::Role|string role
     # @uses   Rend::Acl::Role::Registry::get!()
     # @return Rend::Acl::Role
-    def role(role)
+    def role!(role)
       role_registry.get!(role)
     end
 
@@ -174,14 +175,14 @@ module Rend
 
       resource_id = resource.id
 
-      raise Rend::Acl::Exception, "Resource id 'resource_id' already exists in the ACL" if has?(resource_id)
+      raise Rend::Acl::Exception, "Resource id 'resource_id' already exists in the ACL" if has_resource?(resource_id)
 
       resource_parent = nil
 
       if parent
         begin
           resource_parent_id  = (parent.class <= Rend::Acl::Resource) ? parent.id : parent
-          resource_parent     = get!(resource_parent_id)
+          resource_parent     = resource!(resource_parent_id)
         rescue Rend::Acl::Exception
           raise Rend::Acl::Exception, "Parent Resource id 'resource_parent_id' does not exist"
         end
@@ -200,9 +201,9 @@ module Rend
     # @throws Rend::Acl::Exception
     # @return Rend::Acl::Resource
 
-    def get!(resource)
+    def resource!(resource)
       resource_id = (resource.class <= Rend::Acl::Resource) ? resource.id : resource.to_s
-      raise Rend::Acl::Exception, "Resource 'resource_id' not found" unless has?(resource)
+      raise Rend::Acl::Exception, "Resource 'resource_id' not found" unless has_resource?(resource)
       @_resources[resource_id][:instance]
     end
 
@@ -212,7 +213,7 @@ module Rend
     #
     # @param  Rend::Acl::Resource|string resource
     # @return boolean
-    def has?(resource)
+    def has_resource?(resource)
       resource_id = (resource.class <= Rend::Acl::Resource) ? resource.id : resource.to_s
       @_resources.keys.include?(resource_id)
     end
@@ -230,9 +231,9 @@ module Rend
     # @param  boolean                    onlyParent
     # @throws Rend_Acl_Resource_Registry_Exception
     # @return boolean
-    def inherits?(resource, inherit, only_parent = false)
-      resource_id = get!(resource).id
-      inherit_id  = get!(inherit).id
+    def inherits_resource?(resource, inherit, only_parent = false)
+      resource_id = resource!(resource).id
+      inherit_id  = resource!(inherit).id
 
       if @_resources[resource_id][:parent]
         parent_id = @_resources[resource_id][:parent].id
@@ -256,8 +257,8 @@ module Rend
     # @param  Rend::Acl::Resource|string resource
     # @throws Rend::Acl::Exception
     # @return Rend::Acl Provides a fluent interface
-    def remove!(resource)
-      resource_id       = get!(resource).id
+    def remove_resource!(resource)
+      resource_id       = resource!(resource).id
       resources_removed = [resource_id]
 
       if resource_parent = @_resources[resource_id][:parent]
@@ -265,7 +266,7 @@ module Rend
       end
 
       @_resources[resource_id][:children].each do |child_id, child|
-        remove!(child_id)
+        remove_resource!(child_id)
         resources_removed.push(child_id)
       end
 
@@ -285,7 +286,7 @@ module Rend
     # Removes all Resources
     #
     # @return Rend::Acl Provides a fluent interface
-    def remove_all!
+    def remove_resource_all!
       @_resources.each do |resource_id, resource|
         @_rules[:by_resource_id].each do |resource_id_current, rules|
           @_rules[:by_resource_id].delete(resource_id_current) if resource_id == resource_id_current
@@ -402,12 +403,12 @@ module Rend
           resources = Array(resources)
           resources << nil if resources.empty?
           resources = resources.reduce([]) do |seed, resource|
-            seed << (resource ? get!(resource) : nil)
+            seed << (resource ? resource!(resource) : nil)
           end
         else
           # this might be used later if resource iteration is required
-          all_resources = @_resources.reduce([]) do |seed, resource|
-            seed << resource[:instance]
+          all_resources = @_resources.values.reduce([]) do |seed, r_target|
+            seed << r_target[:instance]
           end
         end
 
@@ -428,8 +429,8 @@ module Rend
               roles.each do |role|
                 rules = _rules(resource, role, true)
                 if privileges.empty?
-                  rules[:all_privileges][:type] = type
-                  rules[:by_privilege_id]       = {} unless rules.has_key?(:by_privilege_id)
+                  rules[:all_privileges]  = {:type => type}
+                  rules[:by_privilege_id] = {} unless rules.has_key?(:by_privilege_id)
                 else
                   privileges.each do |privilege|
                     rules[:by_privilege_id][privilege] = {:type => type}
@@ -468,7 +469,6 @@ module Rend
                     end
                     next
                   end
-
                   if rules[:all_privileges].has_key?(:type) && rules[:all_privileges][:type] == type
                     rules.delete(:all_privileges)
                   end
@@ -564,18 +564,21 @@ module Rend
       if resource
         # keep track of originally called resource
         @_is_allowed_resource = resource
-        resource = get!(resource)
+        resource = resource!(resource)
         unless @_is_allowed_resource.class <= Rend::Acl::Resource
           @_is_allowed_resource = resource
         end
       end
 
+
       if privilege.nil?
         # query on all privileges
         loop do # loop terminates at :all_resources pseudo-parent
           # depth-first search on role if it is not :all_roles pseudo-parent
-          result = _role_dfs_all_privileges(role, resource)
-          return result if role && result
+          if !role.nil? && !(result = _role_dfs_all_privileges(role, resource)).nil?
+            return result
+          end
+
 
           # look for rule on :all_roles psuedo-parent
           rules = _rules(resource, nil)
@@ -592,16 +595,14 @@ module Rend
           resource = @_resources[resource.id][:parent]
         end
       else
-        # IN HERE
         @_is_allowed_privilege = privilege
         # query on one privilege
         loop do # loop terminates at :all_resources pseudo-parent
           # depth-first search on role if it is not :all_roles pseudo-parent
-          if nil != role && nil != (result = _role_dfs_one_privilege(role, resource, privilege))
+          if !role.nil? && !(result = _role_dfs_one_privilege(role, resource, privilege)).nil?
             return result
           end
 
-
           # look for rule on 'allRoles' pseudo-parent
           if nil != (rule_type = _rule_type(resource, nil, privilege))
             return TYPE_ALLOW == rule_type
@@ -635,7 +636,7 @@ module Rend
     # @param  Rend::Acl::Resource resource
     # @return boolean|nil
     def _role_dfs_all_privileges(role, resource = nil)
-      type_hint! Rend::Acl::Role, role, :is_required => true
+      type_hint! Rend::Acl::Role,     role, :is_required => true
       type_hint! Rend::Acl::Resource, resource
 
       dfs = {:visited => {}, :stack => []}

data/lib/rend/acl/resource.rb

@@ -9,6 +9,10 @@ module Rend
         @id = id.to_s
       end
 
+      def to_s
+        @id
+      end
+
     end
   end
 end

data/lib/rend/acl/role.rb

@@ -1,17 +1,18 @@
 require 'rend/acl/role/registry'
+
 module Rend
   class Acl
     class Role
 
       # Unique id of Role
       attr_reader :id # @var string
-      # attr_accessor :parents  -- future
-      # attr_accessor :children -- future
 
       def initialize(id)
         @id = id.to_s
-        # @parents = {}  -- future
-        # @children = {} -- future
+      end
+
+      def to_s
+        @id
       end
 
     end

data/lib/rend/acl/version.rb

@@ -1,7 +1,7 @@
 module Rend
   class Acl
     module Version
-      STRING = "0.0.2"
+      STRING = "0.0.3"
     end
   end
 end

data/test/test_acl.rb

@@ -3,207 +3,998 @@ require 'rend/acl'
 
 class AclTest < Test::Unit::TestCase
 
-  # See: http://framework.zend.com/manual/1.12/en/zend.acl.introduction.html#zend.acl.introduction.roles
-  def test_multiple_inheritance_among_roles
+  def setup
     @acl = Rend::Acl.new
-    @acl.add_role!('guest').add_role!('member').add_role!('admin')
+  end
 
-    parents = %w[guest member admin]
-    @acl.add_role! 'Daniel Doezema', parents
+  def test_storing_acl_data_for_persistence_with_marshal
+    assert_use_case_1 Marshal.load( Marshal.dump(use_case_1) )
+  end
 
-    @acl.add_resource!('gold')
+  def test_storing_acl_data_for_persistence_with_yaml
+    require 'yaml'
+    assert_use_case_1 YAML.load( YAML.dump(use_case_1) )
+  end
 
-    @acl.deny!('guest', 'gold')
-    @acl.allow!('member', 'gold')
+  def test_acl_user_case_1
+    assert_use_case_1(use_case_1)
+  end
+
+  # ==== Orignal Zend_Acl Tests Below
 
-    assert_equal true, @acl.allowed?('Daniel Doezema', 'gold')
+  # Ensures that basic addition and retrieval of a single Role works
+  def test_role_registry_add_and_get_one
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    assert_equal role_guest, @acl.role!(role_guest.id)
   end
 
-  # http://framework.zend.com/manual/1.12/en/zend.acl.introduction.html#zend.acl.introduction.role_registry
-  def test_registering_roles
-    @acl = Rend::Acl.new
-    guest_role = Rend::Acl::Role.new('guest')
-    @acl.add_role! guest_role
-    @acl.add_role! Rend::Acl::Role.new('staff'), guest_role
-    @acl.add_role! Rend::Acl::Role.new('editor'), 'staff'
-    @acl.add_role! Rend::Acl::Role.new('administrator')
+  # Ensures that basic addition and retrieval of a single Resource works
+  def test_role_add_and_get_one_by_string
+    role = @acl.add_role!('area').role!('area')
+    assert_kind_of Rend::Acl::Role, role
+    assert_equal 'area', role.id
+  end
 
-    # Guest may only view content
-    @acl.allow! guest_role, nil, 'view'
+  # # Ensures that basic removal of a single Role works
+  def test_role_registry_remove_one
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest).remove_role!(role_guest)
+    assert_equal false, @acl.has_role?(role_guest)
+  end
 
-    # Staff inherits view privilege from guest, but also needs additional
-    # privileges
-    @acl.allow! 'staff', nil, %w[edit submit revise]
+  # Ensures that an exception is thrown when a non-existent Role is specified for removal
+  def test_role_registry_remove_one_non_existent
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.remove_role!('nonexistent')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon removing a non-existent Role')
+    end
+  end
 
-    # Editor inherits view, edit, submit, and revise privileges from
-    # staff, but also needs additional privileges
-    @acl.allow! 'editor', nil, %w[publish archive delete]
+  # # Ensures that removal of all Roles works
+  def test_role_registry_remove_all
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest).remove_role_all!
+    assert_equal false, @acl.has_role?(role_guest)
+  end
 
-    # Administrator inherits nothing, but is allowed all privileges
-    @acl.allow! 'administrator'
+  # Ensures that an exception is thrown when a non-existent Role is specified as a parent upon Role addition
+  def test_role_registry_add_inherits_non_existent
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.add_role!(Rend::Acl::Role.new('guest'), 'nonexistent')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon specifying a non-existent parent')
+    end
+  end
 
+  # Ensures that an exception is thrown when a non-existent Role is specified to each parameter of inherits
+  def test_role_registry_inherits_non_existent
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.inherits_role?('nonexistent', role_guest)
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon specifying a non-existent child Role')
+    end
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.inherits_role?(role_guest, 'nonexistent')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon specifying a non-existent parent Role')
+    end
+  end
 
-    assert_equal true,  @acl.allowed?('guest', nil, 'view')
-    assert_equal false, @acl.allowed?('staff', nil, 'publish')
-    assert_equal true,  @acl.allowed?('staff', nil, 'revise')
-    assert_equal true,  @acl.allowed?('editor', nil, 'view')          # allowed because of inheritance from guest
-    assert_equal false, @acl.allowed?('editor', nil, 'update')        # denied because no allow rule for 'update'
-    assert_equal true,  @acl.allowed?('administrator', nil, 'view')   # allowed because administrator is allowed all privileges
-    assert_equal true,  @acl.allowed?('administrator')                # allowed because administrator is allowed all privileges
-    assert_equal true,  @acl.allowed?('administrator', nil, 'update') # allowed because administrator is allowed all privileges
+  # Tests basic Role inheritance
+  def test_role_registry_inherits
+    role_guest  = Rend::Acl::Role.new('guest')
+    role_member = Rend::Acl::Role.new('member')
+    role_editor = Rend::Acl::Role.new('editor')
+
+    role_registry = Rend::Acl::Role::Registry.new
+    role_registry.add!(role_guest)
+    role_registry.add!(role_member, role_guest.id)
+    role_registry.add!(role_editor, role_member)
+
+    assert_equal 0, role_registry.parents(role_guest).length
+
+    role_member_parents = role_registry.parents(role_member)
+    assert_equal 1,     role_member_parents.length
+    assert_equal true,  role_member_parents.has_key?('guest')
+
+    role_editor_parents = role_registry.parents(role_editor)
+    assert_equal 1,     role_editor_parents.length
+    assert_equal true,  role_editor_parents.has_key?('member')
+    assert_equal true,  role_registry.inherits?(role_member, role_guest, true)
+    assert_equal true,  role_registry.inherits?(role_editor, role_member, true)
+    assert_equal true,  role_registry.inherits?(role_editor, role_guest)
+    assert_equal false, role_registry.inherits?(role_guest, role_member)
+    assert_equal false, role_registry.inherits?(role_member, role_editor)
+    assert_equal false, role_registry.inherits?(role_guest, role_editor)
+
+    role_registry.remove!(role_member)
+    assert_equal 0,     role_registry.parents(role_editor).length
+    assert_equal false, role_registry.inherits?(role_editor, role_guest)
   end
 
-  # http://framework.zend.com/manual/1.12/en/zend.acl.introduction.html#zend.acl.introduction.role_registry
-  def test_precise_access_controls
-    @acl = Rend::Acl.new
-    guest_role = Rend::Acl::Role.new('guest')
-    @acl.add_role! guest_role
-    @acl.add_role! Rend::Acl::Role.new('staff'), guest_role
-    @acl.add_role! Rend::Acl::Role.new('editor'), 'staff'
-    @acl.add_role! Rend::Acl::Role.new('administrator')
+  # Tests basic Role multiple inheritance
+  def test_role_registry_inherits_multiple
+    role_parent0 = Rend::Acl::Role.new('parent0')
+    role_parent1 = Rend::Acl::Role.new('parent1')
+    role_child   = Rend::Acl::Role.new('child')
+
+    role_registry = Rend::Acl::Role::Registry.new
+    role_registry.add!(role_parent0)
+    role_registry.add!(role_parent1)
+    role_registry.add!(role_child, [role_parent0, role_parent1])
+
+    role_child_parents = role_registry.parents(role_child)
+    assert_equal 2,     role_child_parents.length
+    role_child_parents.each_with_index do |(role_parent_id, role_parent), i|
+      assert_equal "parent#{i}", role_parent_id
+    end
+    assert_equal true,  role_registry.inherits?(role_child, role_parent0)
+    assert_equal true,  role_registry.inherits?(role_child, role_parent1)
+
+    role_registry.remove!(role_parent0)
+    role_child_parents = role_registry.parents(role_child)
+    assert_equal 1,     role_child_parents.length
+    assert_equal true,  role_child_parents.has_key?('parent1')
+    assert_equal true,  role_registry.inherits?(role_child, role_parent1)
+  end
 
-    # Guest may only view content
-    @acl.allow! guest_role, nil, 'view'
+  # Ensures that the same Role cannot be registered more than once to the registry
+  def test_role_registry_duplicate
+    role_guest    = Rend::Acl::Role.new('guest')
+    role_registry = Rend::Acl::Role::Registry.new
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      role_registry.add!(role_guest).add!(role_guest)
+      flunk('Expected exception not thrown upon adding same Role twice')
+    end
+  end
 
-    # Staff inherits view privilege from guest, but also needs additional
-    # privileges
-    @acl.allow! 'staff', nil, %w[edit submit revise]
+  # Ensures that two Roles having the same ID cannot be registered
+  def test_role_registry_duplicate_id
+    role_guest1   = Rend::Acl::Role.new('guest')
+    role_guest2   = Rend::Acl::Role.new('guest')
+    role_registry = Rend::Acl::Role::Registry.new
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      role_registry.add!(role_guest1).add!(role_guest2)
+      flunk('Expected exception not thrown upon adding same Role twice')
+    end
+  end
 
-    # Editor inherits view, edit, submit, and revise privileges from
-    # staff, but also needs additional privileges
-    @acl.allow! 'editor', nil, %w[publish archive delete]
+  # Ensures that basic addition and retrieval of a single Resource works
+  def test_resource_add_and_get_one
+    resource_area = Rend::Acl::Resource.new('area')
+    @acl.add_resource!(resource_area)
 
-    # Administrator inherits nothing, but is allowed all privileges
-    @acl.allow! 'administrator'
+    resource = @acl.resource!(resource_area.id)
+    assert_equal resource_area, resource
 
-    # The new marketing group inherits permissions from staff
-    @acl.add_role!(Rend::Acl::Role.new('marketing'), 'staff')
+    resource = @acl.resource!(resource_area)
+    assert_equal resource_area, resource
+  end
 
-    # === Create Resources for the rules ===
+  # Ensures that basic addition and retrieval of a single Resource works
+  def test_resource_add_and_get_one_by_string
+    @acl.add_resource!('area')
 
-    # newsletter
-    @acl.add_resource!(Rend::Acl::Resource.new('newsletter'))
+    resource = @acl.resource!('area')
+    assert_kind_of Rend::Acl::Resource, resource
+    assert_equal 'area', resource.id
+  end
 
-    # news
-    @acl.add_resource!(Rend::Acl::Resource.new('news'))
+  # Ensures that basic removal of a single Resource works
+  def test_resource_remove_one
+    resource_area = Rend::Acl::Resource.new('area')
+    @acl.add_resource!(resource_area).remove_resource!(resource_area)
+    assert_equal false, @acl.has_resource?(resource_area)
+  end
 
-    # latest news
-    @acl.add_resource!(Rend::Acl::Resource.new('latest'), 'news')
+  # Ensures that an exception is thrown when a non-existent Resource is specified for removal
+  def test_resource_remove_one_non_existent
+    assert_raises Rend::Acl::Exception do
+      @acl.remove_resource!('nonexistent')
+      flunk('Expected Rend::Acl::Exception not thrown upon removing a non-existent Resource')
+    end
+  end
 
-    # announcement news
-    @acl.add_resource!(Rend::Acl::Resource.new('announcement'), 'news')
+  # Ensures that removal of all Resources works
+  def test_resource_remove_all
+    resource_area = Rend::Acl::Resource.new('area')
+    @acl.add_resource!(resource_area).remove_resource_all!
+    assert_equal false, @acl.has_resource?(resource_area)
+  end
 
-    # === Setting up access ====
+  # Ensures that an exception is thrown when a non-existent Resource is specified as a parent upon Resource addition
+  def test_resource_add_inherits_non_existent
+    assert_raises Rend::Acl::Exception do
+      @acl.add_resource!(Rend::Acl::Resource.new('area'), 'nonexistent')
+      flunk('Expected Rend::Acl::Exception not thrown upon specifying a non-existent parent')
+    end
+  end
 
-    # Marketing must be able to publish and archive newsletters and the latest news
-    @acl.allow!('marketing', ['newsletter', 'latest'], ['publish', 'archive'])
+  # Ensures that an exception is thrown when a non-existent Resource is specified to each parameter of inherits
+  def test_resource_inherits_non_existent
+    resource_area = Rend::Acl::Resource.new('area')
+    @acl.add_resource!(resource_area)
+    assert_raises Rend::Acl::Exception do
+      @acl.inherits_resource?('nonexistent', resource_area)
+      flunk('Expected Rend::Acl::Exception not thrown upon specifying a non-existent child Resource')
+    end
+    assert_raises Rend::Acl::Exception do
+      @acl.inherits_resource?(resource_area, 'nonexistent')
+      flunk('Expected Rend::Acl::Exception not thrown upon specifying a non-existent parent Resource')
+    end
+  end
 
-    # Staff (and marketing, by inheritance), are denied permission to revise the latest news
-    @acl.deny!('staff', 'latest', 'revise')
+  # Tests basic Resource inheritance
+  def test_resource_inherits
+    resource_city     = Rend::Acl::Resource.new('city')
+    resource_building = Rend::Acl::Resource.new('building')
+    resource_room     = Rend::Acl::Resource.new('room')
+
+    @acl.add_resource!(resource_city)
+    @acl.add_resource!(resource_building, resource_city.id)
+    @acl.add_resource!(resource_room,     resource_building)
+
+    assert_equal true,  @acl.inherits_resource?(resource_building, resource_city, true)
+    assert_equal true,  @acl.inherits_resource?(resource_room, resource_building, true)
+    assert_equal true,  @acl.inherits_resource?(resource_room, resource_city)
+    assert_equal false, @acl.inherits_resource?(resource_city, resource_building)
+    assert_equal false, @acl.inherits_resource?(resource_building, resource_room)
+    assert_equal false, @acl.inherits_resource?(resource_city, resource_room)
+
+    @acl.remove_resource!(resource_building)
+    assert_equal false, @acl.has_resource?(resource_room)
+  end
 
-    # Everyone (including administrators) are denied permission to archive news announcements
-    @acl.deny!(nil, 'announcement', 'archive')
+  # Ensures that the same Resource cannot be added more than once
+  def test_resource_duplicate
+    assert_raises Rend::Acl::Exception do
+      resource_area = Rend::Acl::Resource.new('area')
+      @acl.add_resource!(resource_area)
+      @acl.add_resource!(resource_area)
+      flunk('Expected exception not thrown upon adding same Resource twice')
+    end
+  end
 
+  # Ensures that two Resources having the same ID cannot be added
+  def test_resource_duplicate_id
+    assert_raises Rend::Acl::Exception do
+      resource_area1 = Rend::Acl::Resource.new('area')
+      resource_area2 = Rend::Acl::Resource.new('area')
+      @acl.add_resource!(resource_area1)
+      @acl.add_resource!(resource_area2)
+      flunk('Expected exception not thrown upon adding two Resources with same ID')
+    end
+  end
 
-    # === Testing ===
+  # Ensures that an exception is thrown when a non-existent Role and Resource parameters are specified to is_allowed
+  def test_is_allowed_non_existent
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.allowed?('nonexistent')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon non-existent Role')
+    end
+    assert_raises Rend::Acl::Exception do
+      @acl.allowed?(nil, 'nonexistent')
+      flunk('Expected Rend::Acl::Exception not thrown upon non-existent Resource')
+    end
+  end
 
-    assert_equal false, @acl.allowed?('staff'         , 'newsletter'   , 'publish') # denied
-    assert_equal true,  @acl.allowed?('marketing'     , 'newsletter'   , 'publish') # allowed
-    assert_equal false, @acl.allowed?('staff'         , 'latest'       , 'publish') # denied
-    assert_equal true,  @acl.allowed?('marketing'     , 'latest'       , 'publish') # allowed
-    assert_equal true,  @acl.allowed?('marketing'     , 'latest'       , 'archive') # allowed
-    assert_equal false, @acl.allowed?('marketing'     , 'latest'       , 'revise')  # denied
-    assert_equal false, @acl.allowed?('editor'        , 'announcement' , 'archive') # denied
-    assert_equal false, @acl.allowed?('administrator' , 'announcement' , 'archive') # denied
+  # Ensures that by default, Zend_Acl denies access to everything by all
+  def test_default_deny
+    assert_equal false, @acl.allowed?
+  end
 
-    # === Removing Access Controls ===
-    # To remove one or more access rules from the ACL, simply use the available removeAllow()
-    # or removeDeny() methods. As with allow() and deny(), you may provide a NULL value to indicate
-    # application to all roles, resources, and/or privileges:
+  # Ensures that ACL-wide rules (all Roles, Resources, and privileges) work properly
+  def test_default_rule_set
+    @acl.allow!
+    assert_equal true, @acl.allowed?
+    @acl.deny!
+    assert_equal false, @acl.allowed?
+  end
 
-    # Remove the denial of revising latest news to staff (and marketing, by inheritance)
-    @acl.remove_deny!('staff', 'latest', 'revise')
-    assert_equal true, @acl.allowed?('marketing', 'latest', 'revise')
+  # Ensures that by default, Zend_Acl denies access to a privilege on anything by all
+  def test_default_privilege_deny
+    assert_equal false, @acl.allowed?(nil, nil, 'some_privilege')
+  end
 
-    # Remove the allowance of publishing and archiving newsletters to marketing
-    @acl.remove_allow!('marketing', 'newsletter', ['publish', 'archive'])
-    assert_equal false, @acl.allowed?('marketing', 'newsletter', 'publish')
-    assert_equal false, @acl.allowed?('marketing', 'newsletter', 'archive')
+  # Ensures that ACL-wide rules apply to privileges
+  def test_default_rule_set_privilege
+    @acl.allow!
+    assert_equal true, @acl.allowed?(nil, nil, 'some_privilege')
+    @acl.deny!
+    assert_equal false, @acl.allowed?(nil, nil, 'some_privilege')
+  end
 
-    # === Modifying Access Controls ===
-    # Privileges may be modified incrementally as indicated above, but a NIL
-    # value for the privileges overrides such incremental changes:
+  # Ensures that a privilege allowed for all Roles upon all Resources works properly
+  def test_privilege_allow
+    @acl.allow!(nil, nil, 'some_privilege')
+    assert_equal true, @acl.allowed?(nil, nil, 'some_privilege')
+  end
 
-    # Allow marketing all permissions upon the latest news
-    @acl.allow!('marketing', 'latest')
-    assert_equal true, @acl.allowed?('marketing', 'latest', 'publish')  # allowed
-    assert_equal true, @acl.allowed?('marketing', 'latest', 'archive')  # allowed
-    assert_equal true, @acl.allowed?('marketing', 'latest', 'anything') # allowed
+  # Ensures that a privilege denied for all Roles upon all Resources works properly
+  def test_privilege_deny
+    @acl.allow!
+    @acl.deny!(nil, nil, 'some_privilege')
+    assert_equal false, @acl.allowed?(nil, nil, 'some_privilege')
   end
 
-  def test_storing_acl_data_for_persistence_with_marshal
-    @acl = Rend::Acl.new
-    guest_role = Rend::Acl::Role.new('guest')
-    @acl.add_role! guest_role
-    @acl.add_role! Rend::Acl::Role.new('staff'), guest_role
-    @acl.add_role! Rend::Acl::Role.new('editor'), 'staff'
-    @acl.add_role! Rend::Acl::Role.new('administrator')
+  # Ensures that multiple privileges work properly
+  def test_privileges
+    @acl.allow!(nil, nil, ['p1', 'p2', 'p3'])
+    assert_equal true,  @acl.allowed?(nil, nil, 'p1')
+    assert_equal true,  @acl.allowed?(nil, nil, 'p2')
+    assert_equal true,  @acl.allowed?(nil, nil, 'p3')
+    assert_equal false, @acl.allowed?(nil, nil, 'p4')
+
+    @acl.deny!(nil, nil, 'p1')
+    assert_equal false, @acl.allowed?(nil, nil, 'p1')
+
+    @acl.deny!(nil, nil, ['p2', 'p3'])
+    assert_equal false, @acl.allowed?(nil, nil, 'p2')
+    assert_equal false, @acl.allowed?(nil, nil, 'p3')
+  end
+
+  # # [NOT IMPLEMENTED YET] Ensures that assertions on privileges work properly
+  # def test_privilege_assert
+  #   @acl.allow!(nil, nil, 'some_privilege', Rend::Acl::Mock_assertion.new(true))
+  #   assert_equal true, @acl.allowed?(nil, nil, 'some_privilege')
+  #   @acl.allow!(nil, nil, 'some_privilege', Rend::Acl::Mock_assertion.new(false))
+  #   assert_equal false, @acl.allowed?(nil, nil, 'some_privilege')
+  # end
+
+  # Ensures that by default, Zend_Acl denies access to everything for a particular Role
+  def test_role_default_deny
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    assert_equal false, @acl.allowed?(role_guest)
+  end
+
+  # Ensures that ACL-wide rules (all Resources and privileges) work properly for a particular Role
+  def test_role_default_rule_set
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.allow!(role_guest)
+    assert_equal true, @acl.allowed?(role_guest)
+    @acl.deny!(role_guest)
+    assert_equal false, @acl.allowed?(role_guest)
+  end
+
+  # Ensures that by default, Zend_Acl denies access to a privilege on anything for a particular Role
+  def test_role_default_privilege_deny
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    assert_equal false, @acl.allowed?(role_guest, nil, 'some_privilege')
+  end
+
+  # Ensures that ACL-wide rules apply to privileges for a particular Role
+  def test_role_default_rule_set_privilege
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.allow!(role_guest)
+    assert_equal true, @acl.allowed?(role_guest, nil, 'some_privilege')
+    @acl.deny!(role_guest)
+    assert_equal false, @acl.allowed?(role_guest, nil, 'some_privilege')
+  end
+
+  # Ensures that a privilege allowed for a particular Role upon all Resources works properly
+  def test_role_privilege_allow
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.allow!(role_guest, nil, 'some_privilege')
+    assert_equal true, @acl.allowed?(role_guest, nil, 'some_privilege')
+  end
+
+  # Ensures that a privilege denied for a particular Role upon all Resources works properly
+  def test_role_privilege_deny
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.allow!(role_guest)
+    @acl.deny!(role_guest, nil, 'some_privilege')
+    assert_equal false, @acl.allowed?(role_guest, nil, 'some_privilege')
+  end
+
+  # Ensures that multiple privileges work properly for a particular Role
+  def test_role_privileges
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.allow!(role_guest, nil, ['p1', 'p2', 'p3'])
+    assert_equal true, @acl.allowed?(role_guest, nil, 'p1')
+    assert_equal true, @acl.allowed?(role_guest, nil, 'p2')
+    assert_equal true, @acl.allowed?(role_guest, nil, 'p3')
+    assert_equal false, @acl.allowed?(role_guest, nil, 'p4')
+    @acl.deny!(role_guest, nil, 'p1')
+    assert_equal false, @acl.allowed?(role_guest, nil, 'p1')
+    @acl.deny!(role_guest, nil, ['p2', 'p3'])
+    assert_equal false, @acl.allowed?(role_guest, nil, 'p2')
+    assert_equal false, @acl.allowed?(role_guest, nil, 'p3')
+  end
+
+  # Ensures that removing the default deny rule results in default deny rule
+  def test_remove_default_deny
+    assert_equal false, @acl.allowed?
+    @acl.remove_deny!
+    assert_equal false, @acl.allowed?
+  end
+
+
+  # Ensures that removing the default allow rule results in default deny rule being assigned
+  def test_remove_default_allow
+    @acl.allow!
+    assert_equal true, @acl.allowed?
+    @acl.remove_allow!
+    assert_equal false, @acl.allowed?
+  end
+
+  # Ensures that removing non-existent default allow rule does nothing
+  def test_remove_default_allow_non_existent
+    @acl.remove_allow!
+    assert_equal false, @acl.allowed?
+  end
+
+  # Ensures that removing non-existent default deny rule does nothing
+  def test_remove_default_deny_non_existent
+    @acl.allow!
+    @acl.remove_deny!
+    assert_equal true, @acl.allowed?
+  end
+
+  # # Ensure that basic rule removal works
+  def test_rules_remove
+    @acl.allow!(nil, nil, ['privilege1', 'privilege2'])
+    assert_equal false, @acl.allowed?
+    assert_equal true,  @acl.allowed?(nil, nil, 'privilege1')
+    assert_equal true,  @acl.allowed?(nil, nil, 'privilege2')
+
+    @acl.remove_allow!(nil, nil, 'privilege1')
+    assert_equal false, @acl.allowed?(nil, nil, 'privilege1')
+    assert_equal true,  @acl.allowed?(nil, nil, 'privilege2')
+  end
+
+  # # Ensures that removal of a Role results in its rules being removed
+  def test_rule_role_remove
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    @acl.allow!('guest')
+    assert_equal true, @acl.allowed?('guest')
+
+    @acl.remove_role!('guest')
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.allowed?('guest')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon is_allowed on non-existent Role')
+    end
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    assert_equal false, @acl.allowed?('guest')
+  end
+
+  # Ensures that removal of all Roles results in Role-specific rules being removed
+  def test_rule_role_remove_all
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    @acl.allow!('guest')
+    assert_equal true, @acl.allowed?('guest')
+    @acl.remove_role_all!
+    assert_raises Rend::Acl::Role::Registry::Exception do
+      @acl.allowed?('guest')
+      flunk('Expected Rend::Acl::Role::Registry::Exception not thrown upon is_allowed on non-existent Role')
+    end
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    assert_equal false, @acl.allowed?('guest')
+  end
+
+  # Ensures that removal of a Resource results in its rules being removed
+  def test_rules_resource_remove
+    @acl.add_resource!(Rend::Acl::Resource.new('area'))
+    @acl.allow!(nil, 'area')
+    assert_equal true, @acl.allowed?(nil, 'area')
+    @acl.remove_resource!('area')
+    assert_raises Rend::Acl::Exception do
+        @acl.allowed?(nil, 'area')
+        flunk('Expected Rend::Acl::Exception not thrown upon is_allowed on non-existent Resource')
+    end
+    @acl.add_resource!(Rend::Acl::Resource.new('area'))
+    assert_equal false, @acl.allowed?(nil, 'area')
+  end
+
+  # Ensures that removal of all Resources results in Resource-specific rules being removed
+  def test_rules_resource_remove_all
+    @acl.add_resource!(Rend::Acl::Resource.new('area'))
+    @acl.allow!(nil, 'area')
+    assert_equal true, @acl.allowed?(nil, 'area')
+    @acl.remove_resource_all!
+    assert_raises Rend::Acl::Exception do
+        @acl.allowed?(nil, 'area')
+        flunk('Expected Rend::Acl::Exception not thrown upon is_allowed on non-existent Resource')
+    end
+    @acl.add_resource!(Rend::Acl::Resource.new('area'))
+    assert_equal false, @acl.allowed?(nil, 'area')
+  end
+
+  # Ensures that an example for a content management system is operable
+  def test_cms_example
+    # Add some roles to the Role registry
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    @acl.add_role!(Rend::Acl::Role.new('staff'), 'guest')  # staff inherits permissions from guest
+    @acl.add_role!(Rend::Acl::Role.new('editor'), 'staff') # editor inherits permissions from staff
+    @acl.add_role!(Rend::Acl::Role.new('administrator'))
 
     # Guest may only view content
-    @acl.allow! guest_role, nil, 'view'
+    @acl.allow!('guest', nil, 'view')
 
-    # Staff inherits view privilege from guest, but also needs additional
-    # privileges
-    @acl.allow! 'staff', nil, %w[edit submit revise]
+    # Staff inherits view privilege from guest, but also needs additional privileges
+    @acl.allow!('staff', nil, ['edit', 'submit', 'revise'])
 
-    # Editor inherits view, edit, submit, and revise privileges from
-    # staff, but also needs additional privileges
-    @acl.allow! 'editor', nil, %w[publish archive delete]
+    # Editor inherits view, edit, submit, and revise privileges, but also needs additional privileges
+    @acl.allow!('editor', nil, ['publish', 'archive', 'delete'])
 
-    # Administrator inherits nothing, but is allowed all privileges
-    @acl.allow! 'administrator'
+    # Administrator inherits nothing but is allowed all privileges
+    @acl.allow!('administrator')
 
-    # The new marketing group inherits permissions from staff
+    # Access control checks based on above permission sets
+    assert_equal true,  @acl.allowed?('guest', nil, 'view')
+    assert_equal false, @acl.allowed?('guest', nil, 'edit')
+    assert_equal false, @acl.allowed?('guest', nil, 'submit')
+    assert_equal false, @acl.allowed?('guest', nil, 'revise')
+    assert_equal false, @acl.allowed?('guest', nil, 'publish')
+    assert_equal false, @acl.allowed?('guest', nil, 'archive')
+    assert_equal false, @acl.allowed?('guest', nil, 'delete')
+    assert_equal false, @acl.allowed?('guest', nil, 'unknown')
+    assert_equal false, @acl.allowed?('guest')
+
+    assert_equal true,  @acl.allowed?('staff', nil, 'view')
+    assert_equal true,  @acl.allowed?('staff', nil, 'edit')
+    assert_equal true,  @acl.allowed?('staff', nil, 'submit')
+    assert_equal true,  @acl.allowed?('staff', nil, 'revise')
+    assert_equal false, @acl.allowed?('staff', nil, 'publish')
+    assert_equal false, @acl.allowed?('staff', nil, 'archive')
+    assert_equal false, @acl.allowed?('staff', nil, 'delete')
+    assert_equal false, @acl.allowed?('staff', nil, 'unknown')
+    assert_equal false, @acl.allowed?('staff')
+
+    assert_equal true,  @acl.allowed?('editor', nil, 'view')
+    assert_equal true,  @acl.allowed?('editor', nil, 'edit')
+    assert_equal true,  @acl.allowed?('editor', nil, 'submit')
+    assert_equal true,  @acl.allowed?('editor', nil, 'revise')
+    assert_equal true,  @acl.allowed?('editor', nil, 'publish')
+    assert_equal true,  @acl.allowed?('editor', nil, 'archive')
+    assert_equal true,  @acl.allowed?('editor', nil, 'delete')
+    assert_equal false, @acl.allowed?('editor', nil, 'unknown')
+    assert_equal false, @acl.allowed?('editor')
+
+    assert_equal true,  @acl.allowed?('administrator', nil, 'view')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'edit')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'submit')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'revise')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'publish')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'archive')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'delete')
+    assert_equal true,  @acl.allowed?('administrator', nil, 'unknown')
+    assert_equal true,  @acl.allowed?('administrator')
+
+    # Some checks on specific areas, which inherit access controls from the root ACL node
+    @acl.add_resource!(Rend::Acl::Resource.new('newsletter'))
+    @acl.add_resource!(Rend::Acl::Resource.new('pending'), 'newsletter')
+    @acl.add_resource!(Rend::Acl::Resource.new('gallery'))
+    @acl.add_resource!(Rend::Acl::Resource.new('profiles'), 'gallery')
+    @acl.add_resource!(Rend::Acl::Resource.new('config'))
+    @acl.add_resource!(Rend::Acl::Resource.new('hosts'), 'config')
+
+    assert_equal true,  @acl.allowed?('guest', 'pending', 'view')
+    assert_equal true,  @acl.allowed?('staff', 'profiles', 'revise')
+    assert_equal true,  @acl.allowed?('staff', 'pending', 'view')
+    assert_equal true,  @acl.allowed?('staff', 'pending', 'edit')
+    assert_equal false, @acl.allowed?('staff', 'pending', 'publish')
+    assert_equal false, @acl.allowed?('staff', 'pending')
+    assert_equal false, @acl.allowed?('editor', 'hosts', 'unknown')
+    assert_equal true,  @acl.allowed?('administrator', 'pending')
+
+    # Add a new group, marketing, which bases its permissions on staff
     @acl.add_role!(Rend::Acl::Role.new('marketing'), 'staff')
 
-    # === Create Resources for the rules ===
+    # Refine the privilege sets for more specific needs
 
-    # newsletter
-    @acl.add_resource!(Rend::Acl::Resource.new('newsletter'))
+    # Allow marketing to publish and archive newsletters
+    @acl.allow!('marketing', 'newsletter', ['publish', 'archive'])
 
-    # news
+    # Allow marketing to publish and archive latest news
     @acl.add_resource!(Rend::Acl::Resource.new('news'))
-
-    # latest news
     @acl.add_resource!(Rend::Acl::Resource.new('latest'), 'news')
+    @acl.allow!('marketing', 'latest', ['publish', 'archive'])
+
+    # Deny staff (and marketing, by inheritance) rights to revise latest news
+    @acl.deny!('staff', 'latest', 'revise')
 
-    # announcement news
+    # Deny everyone access to archive news announcements
     @acl.add_resource!(Rend::Acl::Resource.new('announcement'), 'news')
+    @acl.deny!(nil, 'announcement', 'archive')
+
+    # Access control checks for the above refined permission sets
+    assert_equal true,  @acl.allowed?('marketing', nil, 'view')
+    assert_equal true,  @acl.allowed?('marketing', nil, 'edit')
+    assert_equal true,  @acl.allowed?('marketing', nil, 'submit')
+    assert_equal true,  @acl.allowed?('marketing', nil, 'revise')
+    assert_equal false, @acl.allowed?('marketing', nil, 'publish')
+    assert_equal false, @acl.allowed?('marketing', nil, 'archive')
+    assert_equal false, @acl.allowed?('marketing', nil, 'delete')
+    assert_equal false, @acl.allowed?('marketing', nil, 'unknown')
+    assert_equal false, @acl.allowed?('marketing')
+
+    assert_equal true,  @acl.allowed?('marketing', 'newsletter', 'publish')
+    assert_equal false, @acl.allowed?('staff', 'pending', 'publish')
+    assert_equal true,  @acl.allowed?('marketing', 'pending', 'publish')
+    assert_equal true,  @acl.allowed?('marketing', 'newsletter', 'archive')
+    assert_equal false, @acl.allowed?('marketing', 'newsletter', 'delete')
+    assert_equal false, @acl.allowed?('marketing', 'newsletter')
+
+    assert_equal true,  @acl.allowed?('marketing', 'latest', 'publish')
+    assert_equal true,  @acl.allowed?('marketing', 'latest', 'archive')
+    assert_equal false, @acl.allowed?('marketing', 'latest', 'delete')
+    assert_equal false, @acl.allowed?('marketing', 'latest', 'revise')
+    assert_equal false, @acl.allowed?('marketing', 'latest')
+
+    assert_equal false, @acl.allowed?('marketing', 'announcement', 'archive')
+    assert_equal false, @acl.allowed?('staff', 'announcement', 'archive')
+    assert_equal false, @acl.allowed?('administrator', 'announcement', 'archive')
+
+    assert_equal false, @acl.allowed?('staff', 'latest', 'publish')
+    assert_equal false, @acl.allowed?('editor', 'announcement', 'archive')
+
+    # Remove some previous permission specifications
+
+    # Marketing can no longer publish and archive newsletters
+    @acl.remove_allow!('marketing', 'newsletter', ['publish', 'archive'])
+
+    # Marketing can no longer archive the latest news
+    @acl.remove_allow!('marketing', 'latest', 'archive')
+
+    # Now staff (and marketing, by inheritance) may revise latest news
+    @acl.remove_deny!('staff', 'latest', 'revise')
+
+    # Access control checks for the above refinements
+
+    assert_equal false, @acl.allowed?('marketing', 'newsletter', 'publish')
+    assert_equal false, @acl.allowed?('marketing', 'newsletter', 'archive')
+    assert_equal false, @acl.allowed?('marketing', 'latest', 'archive')
+    assert_equal true,  @acl.allowed?('staff', 'latest', 'revise')
+    assert_equal true,  @acl.allowed?('marketing', 'latest', 'revise')
+
+    # Grant marketing all permissions on the latest news
+    @acl.allow!('marketing', 'latest')
+
+    # Access control checks for the above refinement
+    assert_equal true, @acl.allowed?('marketing', 'latest', 'archive')
+    assert_equal true, @acl.allowed?('marketing', 'latest', 'publish')
+    assert_equal true, @acl.allowed?('marketing', 'latest', 'edit')
+    assert_equal true, @acl.allowed?('marketing', 'latest')
+
+  end
+
+  # [NOT IMPLEMENTED YET] Ensures that the default rule obeys its assertion
+  # def test_default_assert
+  #   @acl.deny!(nil, nil, nil, Rend::Acl::Mock_assertion.new(false))
+  #   assert_equal true, @acl.allowed?
+  #   assert_equal true, @acl.allowed?(nil, nil, 'some_privilege')
+  # end
+
+  # Ensures that the only_parents argument to inherits_role? works
+  # @group ZF-2502
+  def test_role_inheritance_supports_checking_only_parents
+    @acl.add_role!(Rend::Acl::Role.new('grandparent'))
+    @acl.add_role!(Rend::Acl::Role.new('parent'), 'grandparent')
+    @acl.add_role!(Rend::Acl::Role.new('child'), 'parent')
+    assert_equal false, @acl.inherits_role?('child', 'grandparent', true)
+  end
+
+  # Returns an array of registered roles
+  # @expected_exception PHPUnit_Framework_Error
+  # @group ZF-5638
+  # Porter Note: Seems like an odd test... investigate more
+  def test_get_registered_roles
+    @acl.add_role!('developer')
+
+    roles = @acl.roles
+    assert_kind_of Array, roles
+    assert_equal false, roles.empty?
+  end
+
+  # Confirm that deleting a role after allowing access to all roles
+  # raise undefined index error
+  # @group ZF-5700
+  # Porter Note: Seems like an odd test... investigate more
+  def test_removing_role_after_it_was_allowed_access_to_all_resources_gives_error
+    @acl.add_role!(Rend::Acl::Role.new('test0'))
+    @acl.add_role!(Rend::Acl::Role.new('test1'))
+    @acl.add_role!(Rend::Acl::Role.new('test2'))
+    @acl.add_resource!(Rend::Acl::Resource.new('Test'))
+
+    @acl.allow!(nil,'Test','xxx')
+
+    # error test
+    @acl.remove_role!('test0')
+
+    # Check after fix
+    assert_equal false, @acl.has_role?('test0')
+  end
+
+  # @group ZF-8039
+  # Meant to test for the (in)existance of this notice:
+  #   "Notice: Undefined index: all_privileges in lib/Zend/Acl.php on line 682"
+  # Porter Note: Seems like an odd test... investigate more
+  def test_method_remove_allow_does_not_throw_notice
+    acl = Rend::Acl.new
+    acl.add_role!('admin')
+    acl.add_resource!('blog')
+    acl.allow!('admin', 'blog', 'read')
+    acl.remove_allow!(['admin'], ['blog'], nil)
+  end
+
+  def test_role_object_implements_to_string
+    role = Rend::Acl::Role.new('_foo_bar_')
+    assert_equal '_foo_bar_', role.to_s
+  end
+
+  def test_resource_object_implements_to_string
+    resource = Rend::Acl::Resource.new('_foo_bar_')
+    assert_equal '_foo_bar_', resource.to_s
+  end
+
+
+  # @group ZF-8468
+  def test_roles
+    assert_equal [], @acl.roles
+
+    role_guest = Rend::Acl::Role.new('guest')
+    @acl.add_role!(role_guest)
+    @acl.add_role!(Rend::Acl::Role.new('staff'), role_guest)
+    @acl.add_role!(Rend::Acl::Role.new('editor'), 'staff')
+    @acl.add_role!(Rend::Acl::Role.new('administrator'))
+
+    expected = %w[guest staff editor administrator]
+    assert_equal expected, @acl.roles
+  end
+
+  # @group ZF-8468
+  def test_resources
+    assert_equal [], @acl.resources
+
+    @acl.add_resource!(Rend::Acl::Resource.new('some_resource'))
+    @acl.add_resource!(Rend::Acl::Resource.new('some_other_resource'))
+
+    expected = ['some_resource', 'some_other_resource']
+    assert_equal expected, @acl.resources
+  end
+
+  # @group ZF-9643
+  def test_remove_allow_with_nil_resource_after_resource_specific_rules_applies_to_all_resources
+    @acl.add_role!('guest')
+    @acl.add_resource!('blogpost')
+    @acl.add_resource!('newsletter')
+    @acl.allow!('guest', 'blogpost', 'read')
+    @acl.allow!('guest', 'newsletter', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'newsletter', 'read')
+
+    @acl.remove_allow!('guest', 'newsletter', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal false, @acl.allowed?('guest', 'newsletter', 'read')
+
+    @acl.remove_allow!('guest', nil, 'read')
+    assert_equal false, @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal false, @acl.allowed?('guest', 'newsletter', 'read')
+
+    # ensure allow nil/all resoures works
+    @acl.allow!('guest', nil, 'read')
+    assert_equal true,  @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'newsletter', 'read')
+  end
+
+  # @group ZF-9643
+  def test_remove_deny_with_nil_resource_after_resource_specific_rules_applies_to_all_resources
+    @acl.add_role!('guest')
+    @acl.add_resource!('blogpost')
+    @acl.add_resource!('newsletter')
+
+    @acl.allow!
+    @acl.deny!('guest', 'blogpost', 'read')
+    @acl.deny!('guest', 'newsletter', 'read')
+    assert_equal false, @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal false, @acl.allowed?('guest', 'newsletter', 'read')
+
+    @acl.remove_deny!('guest', 'newsletter', 'read')
+    assert_equal false, @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'newsletter', 'read')
+
+    @acl.remove_deny!('guest', nil, 'read')
+    assert_equal true,  @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal true,  @acl.allowed?('guest', 'newsletter', 'read')
+
+    # ensure deny nil/all resources works
+    @acl.deny!('guest', nil, 'read')
+    assert_equal false, @acl.allowed?('guest', 'blogpost', 'read')
+    assert_equal false, @acl.allowed?('guest', 'newsletter', 'read')
+  end
+
+  # Ensures that for a particular Role, a deny rule on a specific Resource is honored before an allow rule on the entire ACL
+  def test_role_default_allow_rule_with_resource_deny_rule
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    @acl.add_role!(Rend::Acl::Role.new('staff'), 'guest')
+    @acl.add_resource!(Rend::Acl::Resource.new('area1'))
+    @acl.add_resource!(Rend::Acl::Resource.new('area2'))
+    @acl.deny!
+    @acl.allow!('staff')
+    @acl.deny!('staff', ['area1', 'area2'])
+    assert_equal false, @acl.allowed?('staff', 'area1')
+  end
+
+  # Ensures that for a particular Role, a deny rule on a specific privilege is honored before an allow rule on the entire ACL
+  def test_role_default_allow_rule_with_privilege_deny_rule
+    @acl.add_role!(Rend::Acl::Role.new('guest'))
+    @acl.add_role!(Rend::Acl::Role.new('staff'), 'guest')
+    @acl.deny!
+    @acl.allow!('staff')
+    @acl.deny!('staff', nil, ['privilege1', 'privilege2'])
+    assert_equal false, @acl.allowed?('staff', nil, 'privilege1')
+  end
+
+  # @group ZF-10649
+  def test_allow_and_deny_with_nil_for_resources_will_apply_to_all_resources
+    @acl.add_role!('guest')
+    @acl.add_resource!('blogpost')
+
+    @acl.allow!('guest')
+    assert_equal true, @acl.allowed?('guest')
+    assert_equal true, @acl.allowed?('guest', 'blogpost')
+    assert_equal true, @acl.allowed?('guest', 'blogpost', 'read')
+
+    @acl.deny!('guest')
+    assert_equal false, @acl.allowed?('guest')
+    assert_equal false, @acl.allowed?('guest', 'blogpost')
+    assert_equal false, @acl.allowed?('guest', 'blogpost', 'read')
+  end
+
+  #### [TESTS TO BE IMPLEMENTED LATER] ####
+
+  # # Ensures that assertions on privileges work properly for a particular Role
+  # def test_role_privilege_assert
+  #   role_guest = Rend::Acl::Role.new('guest')
+  #   @acl.add_role!(role_guest)
+  #              .allow!(role_guest, nil, 'some_privilege', Rend::Acl::Mock_assertion.new(true))
+  #   assert_equal true, @acl.allowed?(role_guest, nil, 'some_privilege')
+  #   @acl.allow!(role_guest, nil, 'some_privilege', Rend::Acl::Mock_assertion.new(false))
+  #   assert_equal false, @acl.allowed?(role_guest, nil, 'some_privilege')
+  # end
+
+  # # Ensures that removing the default deny rule results in assertion method being removed
+  # def test_remove_default_deny_assert
+  #   @acl.deny!(nil, nil, nil, Rend::Acl::Mock_assertion.new(false))
+  #   assert_equal true, @acl.allowed?
+  #   @acl.remove_deny
+  #   assert_equal false, @acl.allowed?
+  # end
+
+
+  # # @group ZF-1721
+  # def test_acl_assertions_get_proper_role_when_inheritence_is_used
+  #   acl = this._load_use_case1
+
+  #   user = Rend::Acl::Role.new('publisher')
+  #   blog_post = Rend::Acl::Resource.new('blog_post')
+
+  #   # @var Zend_Acl_Use_case1_User_is_blog_post_owner_assertion
+  #   assertion = acl.custom_assertion
+
+  #   assert_equal true, acl.is_allowed(user, blog_post, 'modify')
+
+  #   assert_equal 'publisher', assertion.last_assert_role.id
+
+  # end
+
+  # # @group ZF-1722
+  # def test_acl_assertions_get_original_is_allowed_objects
+  #   acl = this._load_use_case1
+
+  #   user = Rend::Acl_Use_case1::User.new
+  #   blog_post = Rend::Acl_Use_case1::Blog_post.new
+
+  #   assert_equal true, acl.is_allowed(user, blog_post, 'view')
+
+  #   /**
+  #    * @var Zend_Acl_Use_case1_User_is_blog_post_owner_assertion
+  #    */
+  #   assertion = acl.custom_assertion
+
+  #   assertion.assert_return_value = true
+  #   user.role = 'contributor'
+  #   assert_equal true, acl.is_allowed(user, blog_post, 'modify'), 'Assertion should return true'
+  #   assertion.assert_return_value = false
+  #   assert_equal false, acl.is_allowed(user, blog_post, 'modify'), 'Assertion should return false'
+
+  #   # check to see if the last assertion has the proper objets
+  #   assert_kind_of Zend_Acl_Use_case1_User, assertion.last_assert_role, 'Assertion did not recieve proper role object'
+  #   assert_kind_of Zend_Acl_Use_case1_Blog_post, assertion.last_assert_resource, 'Assertion did not recieve proper resource object'
+
+  # end
+
+  # # @group ZF-7973
+  # def test_acl_passes_privilege_to_assert_class {
+  #   require_once dirname(__FILE__) . '/_files/Assertion_z_f7973.php'
+  #   assertion = Rend::Acl_Acl_test::Assertion_z_f7973.new
+
+  #   acl = Rend::Acl.new
+  #   acl.add_role!('role')
+  #   acl.add_resource!('resource')
+  #   acl.allow!('role',nil,nil,assertion)
+  #   allowed = acl.is_allowed('role','resource','privilege',assertion)
+
+  #   assert_equal true, allowed
+  # end
+
+
+  protected
+
+  # def use_case_2
+  #   @acl.add_role!('guest')
+  #   @acl.add_role!('contributor', 'guest')
+  #   @acl.add_role!('publisher', 'contributor')
+  #   @acl.add_role!('admin')
+  #   @acl.add_resource!('blogPost')
+  #   @acl.allow!('guest', 'blogPost', 'view')
+  #   @acl.allow!('contributor', 'blogPost', 'contribute')
+  #   @acl.allow!('contributor', 'blogPost', 'modify', @acl.customAssertion)
+  #   @acl.allow!('publisher', 'blogPost', 'publish')
+  # end
+
+  # http:#framework.zend.com/manual/1.12/en/zend.acl.introduction.html#zend.acl.introduction.role_registry
+  def use_case_1
+    acl = Rend::Acl.new
+
+    guest_role = Rend::Acl::Role.new('guest')
+
+    acl.add_role! guest_role
+    acl.add_role! Rend::Acl::Role.new('staff'), guest_role
+    acl.add_role! Rend::Acl::Role.new('editor'), 'staff'
+    acl.add_role! Rend::Acl::Role.new('administrator')
+
+    # Guest may only view content
+    acl.allow! guest_role, nil, 'view'
+
+    # Staff inherits view privilege from guest, but also needs additional privileges
+    acl.allow! 'staff', nil, %w[edit submit revise]
+
+    # Editor inherits view, edit, submit, and revise privileges from staff, but also needs additional privileges
+    acl.allow! 'editor', nil, %w[publish archive delete]
+
+    # Administrator inherits nothing, but is allowed all privileges
+    acl.allow! 'administrator'
+
+    # Add new marketing group that inherits permissions from staff
+    acl.add_role!(Rend::Acl::Role.new('marketing'), 'staff')
+
+    # == Create Resources for the rules ===
+
+    acl.add_resource!(Rend::Acl::Resource.new('newsletter'))
+    acl.add_resource!(Rend::Acl::Resource.new('news'))
+    acl.add_resource!(Rend::Acl::Resource.new('latest'), 'news')
+    acl.add_resource!(Rend::Acl::Resource.new('announcement'), 'news')
 
     # === Setting up access ====
 
     # Marketing must be able to publish and archive newsletters and the latest news
-    @acl.allow!('marketing', ['newsletter', 'latest'], ['publish', 'archive'])
+    acl.allow!('marketing', ['newsletter', 'latest'], ['publish', 'archive'])
 
     # Staff (and marketing, by inheritance), are denied permission to revise the latest news
-    @acl.deny!('staff', 'latest', 'revise')
+    acl.deny!('staff', 'latest', 'revise')
 
     # Everyone (including administrators) are denied permission to archive news announcements
-    @acl.deny!(nil, 'announcement', 'archive')
+    acl.deny!(nil, 'announcement', 'archive')
 
-    encoded_acl = Marshal.dump(@acl)
-    decoded_acl = Marshal.load(encoded_acl)
-
-    # === Testing ===
-
-    assert_equal false, decoded_acl.allowed?('staff'         , 'newsletter'   , 'publish') # denied
-    assert_equal true,  decoded_acl.allowed?('marketing'     , 'newsletter'   , 'publish') # allowed
-    assert_equal false, decoded_acl.allowed?('staff'         , 'latest'       , 'publish') # denied
-    assert_equal true,  decoded_acl.allowed?('marketing'     , 'latest'       , 'publish') # allowed
-    assert_equal true,  decoded_acl.allowed?('marketing'     , 'latest'       , 'archive') # allowed
-    assert_equal false, decoded_acl.allowed?('marketing'     , 'latest'       , 'revise')  # denied
-    assert_equal false, decoded_acl.allowed?('editor'        , 'announcement' , 'archive') # denied
-    assert_equal false, decoded_acl.allowed?('administrator' , 'announcement' , 'archive') # denied
+    acl
+  end
 
+  def assert_use_case_1(acl)
+    assert_equal false, acl.allowed?('staff'         , 'newsletter'   , 'publish') # denied
+    assert_equal true,  acl.allowed?('marketing'     , 'newsletter'   , 'publish') # allowed
+    assert_equal false, acl.allowed?('staff'         , 'latest'       , 'publish') # denied
+    assert_equal true,  acl.allowed?('marketing'     , 'latest'       , 'publish') # allowed
+    assert_equal true,  acl.allowed?('marketing'     , 'latest'       , 'archive') # allowed
+    assert_equal false, acl.allowed?('marketing'     , 'latest'       , 'revise')  # denied
+    assert_equal false, acl.allowed?('editor'        , 'announcement' , 'archive') # denied
+    assert_equal false, acl.allowed?('administrator' , 'announcement' , 'archive') # denied
   end
 end