RESTfulAPI::api_access_control PHP 메소드

    public static function api_access_control($model, $httpMethod = 'GET')
    {
        $policy = self::config()->access_control_policy;
        if ($policy === false) {
            return true;
        } else {
            $policy = constant('self::' . $policy);
        }
        if ($policy === self::ACL_CHECK_MODEL_ONLY) {
            $access = true;
        } else {
            $access = false;
        }
        if ($policy === self::ACL_CHECK_CONFIG_ONLY || $policy === self::ACL_CHECK_CONFIG_AND_MODEL) {
            if (!is_string($model)) {
                $className = $model->className;
            } else {
                $className = $model;
            }
            $access = self::api_access_config_check($className, $httpMethod);
        }
        if ($policy === self::ACL_CHECK_MODEL_ONLY || $policy === self::ACL_CHECK_CONFIG_AND_MODEL) {
            if ($access) {
                $access = self::model_permission_check($model, $httpMethod);
            }
        }
        return $access;
    }

 /**
  * Checks that api access config check works
  */
 public function testDataObjectAPIEnaled()
 {
     Config::inst()->update('RESTfulAPI', 'access_control_policy', 'ACL_CHECK_CONFIG_ONLY');
     // ----------------
     // Method Calls
     // Disabled by default
     $enabled = RESTfulAPI::api_access_control('ApiTest_Author');
     $this->assertFalse($enabled, 'Access control should return FALSE by default');
     // Enabled
     Config::inst()->update('ApiTest_Author', 'api_access', true);
     $enabled = RESTfulAPI::api_access_control('ApiTest_Author');
     $this->assertTrue($enabled, 'Access control should return TRUE when api_access is enbaled');
     // Method specific
     Config::inst()->update('ApiTest_Author', 'api_access', 'GET,POST');
     $enabled = RESTfulAPI::api_access_control('ApiTest_Author');
     $this->assertTrue($enabled, 'Access control should return TRUE when api_access is enbaled with default GET method');
     $enabled = RESTfulAPI::api_access_control('ApiTest_Author', 'POST');
     $this->assertTrue($enabled, 'Access control should return TRUE when api_access match HTTP method');
     $enabled = RESTfulAPI::api_access_control('ApiTest_Author', 'PUT');
     $this->assertFalse($enabled, 'Access control should return FALSE when api_access does not match method');
     // ----------------
     // API Calls
     /*
     // Access authorised
     $response = Director::test('api/ApiTest_Author/1', null, null, 'GET'); 
     $this->assertEquals(
       $response->getStatusCode(),
       200
     );
     
     // Access denied
     Config::inst()->update('ApiTest_Author', 'api_access', false);
     $response = Director::test('api/ApiTest_Author/1', null, null, 'GET');
     $this->assertEquals(
       $response->getStatusCode(),
       403
     );
     
     // Access denied
     Config::inst()->update('ApiTest_Author', 'api_access', 'POST');
     $response = Director::test('api/ApiTest_Author/1', null, null, 'GET');
     $this->assertEquals(
       $response->getStatusCode(),
       403
     );
     */
 }