Skip to content

Commit a716b8a

Browse files
hakasaplhakasapl
authored
Merge pull request #92 from sheldor1510/unity-perms
Created UnityPerms Class
2 parents 77d871d + 5e587f3 commit a716b8a

File tree

4 files changed

+365
-3
lines changed

4 files changed

+365
-3
lines changed

‎resources/lib/UnityPerms.php

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
<?php
2+
3+
namespace UnityWebPortal\lib;
4+
5+
class UnityPerms
6+
{
7+
private $SQL;
8+
private $USER;
9+
10+
public function __construct($SQL, $USER)
11+
{
12+
$this->SQL = $SQL;
13+
$this->USER = $USER;
14+
}
15+
16+
public function checkApproveUser($uid, $operated_on, $group)
17+
{
18+
if (!$this->USER->isInGroup($uid, $group)) {
19+
return false;
20+
}
21+
22+
$role = $this->SQL->getRole($uid, $group);
23+
24+
if ($this->SQL->hasPerm($role, 'unity.admin') || $this->SQL->hasPerm($role, 'unity.admin_no_grant')) {
25+
return true;
26+
}
27+
28+
if (!$this->SQL->hasPerm($role, 'unity.approve_user')) {
29+
return false;
30+
}
31+
32+
$operated_on_role = $this->SQL->getRole($operated_on, $group);
33+
34+
if ($this->SQL->getPriority($operated_on_role) >= $this->SQL->getPriority($role)) {
35+
return false;
36+
}
37+
38+
return true;
39+
}
40+
41+
public function checkDenyUser($uid, $operated_on, $group)
42+
{
43+
if (!$this->USER->isInGroup($uid, $group)) {
44+
return false;
45+
}
46+
47+
$role = $this->SQL->getRole($uid, $group);
48+
49+
if ($this->SQL->hasPerm($role, 'unity.admin') || $this->SQL->hasPerm($role, 'unity.admin_no_grant')) {
50+
return true;
51+
}
52+
53+
if (!$this->SQL->hasPerm($role, 'unity.deny_user')) {
54+
return false;
55+
}
56+
57+
$operated_on_role = $this->SQL->getRole($operated_on, $group);
58+
59+
if ($this->SQL->getPriority($operated_on_role) >= $this->SQL->getPriority($role)) {
60+
return false;
61+
}
62+
63+
return true;
64+
}
65+
66+
public function checkGrantRole($uid, $group, $role)
67+
{
68+
if (!$this->USER->isInGroup($uid, $group)) {
69+
return false;
70+
}
71+
72+
if (!$this->SQL->roleAvailableInGroup($uid, $group, $role)) {
73+
return false;
74+
}
75+
76+
$user_role = $this->SQL->getRole($uid, $group);
77+
78+
if ($this->SQL->hasPerm($user_role, 'unity.admin_no_grant') && $role == 'unity.admin') {
79+
return false;
80+
}
81+
82+
if ($this->SQL->hasPerm($user_role, 'unity.admin') || $this->SQL->hasPerm($user_role, 'unity.admin_no_grant')) {
83+
return true;
84+
}
85+
86+
if (!$this->SQL->hasPerm($user_role, 'unity.grant_role')) {
87+
return false;
88+
}
89+
90+
$role_to_grant = $this->SQL->getRole($role, $group);
91+
92+
if ($this->SQL->getPriority($role_to_grant) >= $this->SQL->getPriority($user_role)) {
93+
return false;
94+
}
95+
96+
return true;
97+
}
98+
99+
public function checkRevokeRole($uid, $group, $role)
100+
{
101+
if (!$this->USER->isInGroup($uid, $group)) {
102+
return false;
103+
}
104+
105+
if (!$this->SQL->roleAvailableInGroup($uid, $group, $role)) {
106+
return false;
107+
}
108+
109+
$user_role = $this->SQL->getRole($uid, $group);
110+
111+
if ($this->SQL->hasPerm($user_role, 'unity.admin_no_grant') && $role == 'unity.admin') {
112+
return false;
113+
}
114+
115+
if ($this->SQL->hasPerm($user_role, 'unity.admin') || $this->SQL->hasPerm($user_role, 'unity.admin_no_grant')) {
116+
return true;
117+
}
118+
119+
if (!$this->SQL->hasPerm($user_role, 'unity.revoke_role')) {
120+
return false;
121+
}
122+
123+
$role_to_revoke = $this->SQL->getRole($role, $group);
124+
125+
if ($this->SQL->getPriority($role_to_revoke) >= $this->SQL->getPriority($user_role)) {
126+
return false;
127+
}
128+
129+
return true;
130+
}
131+
}

‎resources/lib/UnitySQL.php

+72
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ class UnitySQL
1414
private const TABLE_AUDIT_LOG = "audit_log";
1515
private const TABLE_ACCOUNT_DELETION_REQUESTS = "account_deletion_requests";
1616
private const TABLE_SITEVARS = "sitevars";
17+
private const TABLE_GROUP_ROLES = "groupRoles";
18+
private const TABLE_GROUP_TYPES = "groupTypes";
19+
private const TABLE_GROUP_ROLE_ASSIGNMENTS = "groupRoleAssignments";
20+
private const TABLE_GROUP_REQUESTS = "groupRequests";
21+
private const TABLE_GROUP_JOIN_REQUESTS = "groupJoinRequests";
22+
1723

1824
private const REQUEST_ADMIN = "admin";
1925

@@ -299,4 +305,70 @@ public function updateSiteVar($name, $value)
299305

300306
$stmt->execute();
301307
}
308+
309+
public function getRole($uid, $group)
310+
{
311+
$stmt = $this->conn->prepare(
312+
"SELECT * FROM " . self::TABLE_GROUP_ROLE_ASSIGNMENTS . " WHERE user=:uid AND `group`=:group"
313+
);
314+
$stmt->bindParam(":uid", $uid);
315+
$stmt->bindParam(":group", $group);
316+
317+
$stmt->execute();
318+
319+
return $stmt->fetchAll()[0]['role'];
320+
}
321+
322+
public function hasPerm($role, $perm)
323+
{
324+
$stmt = $this->conn->prepare(
325+
"SELECT * FROM " . self::TABLE_GROUP_ROLES . " WHERE slug=:role"
326+
);
327+
$stmt->bindParam(":role", $role);
328+
329+
$stmt->execute();
330+
331+
$row = $stmt->fetchAll()[0];
332+
$perms = explode(",", $row['perms']);
333+
return in_array($perm, $perms);
334+
}
335+
336+
public function getPriority($role)
337+
{
338+
$stmt = $this->conn->prepare(
339+
"SELECT * FROM " . self::TABLE_GROUP_ROLES . " WHERE slug=:role"
340+
);
341+
$stmt->bindParam(":role", $role);
342+
343+
$stmt->execute();
344+
345+
$row = $stmt->fetchAll()[0];
346+
return $row['priority'];
347+
}
348+
349+
public function roleAvailableInGroup($uid, $group, $role)
350+
{
351+
$stmt = $this->conn->prepare(
352+
"SELECT * FROM " . self::TABLE_GROUP_ROLE_ASSIGNMENTS . " WHERE user=:uid AND `group`=:group"
353+
);
354+
$stmt->bindParam(":uid", $uid);
355+
$stmt->bindParam(":group", $group);
356+
357+
$stmt->execute();
358+
$row = $stmt->fetchAll()[0];
359+
360+
$group_slug = $row['group'];
361+
362+
$stmt = $this->conn->prepare(
363+
"SELECT * FROM " . self::TABLE_GROUP_TYPES . " WHERE slug=:slug"
364+
);
365+
366+
$stmt->bindParam(":slug", $group_slug);
367+
$stmt->execute();
368+
369+
$row = $stmt->fetchAll()[0];
370+
$roles = explode(",", $row['roles']);
371+
372+
return in_array($role, $roles);
373+
}
302374
}

‎resources/lib/UnityUser.php

+25
Original file line numberDiff line numberDiff line change
@@ -671,4 +671,29 @@ public function hasRequestedAccountDeletion()
671671
{
672672
return $this->SQL->accDeletionRequestExists($this->getUID());
673673
}
674+
675+
/**
676+
* Checks whether a user is in a group or not
677+
* @param string $uid uid of the user
678+
* @param string or object $group group to check
679+
* @return boolean true if user is in group, false if not
680+
*/
681+
682+
public function isInGroup($uid, $group)
683+
{
684+
if (gettype($group) == "string") {
685+
$group_checked = new UnityGroup(
686+
$group,
687+
$this->LDAP,
688+
$this->SQL,
689+
$this->MAILER,
690+
$this->REDIS,
691+
$this->WEBHOOK
692+
);
693+
} else {
694+
$group_checked = $group;
695+
}
696+
697+
return in_array($uid, $group_checked->getGroupMemberUIDs());
698+
}
674699
}

0 commit comments

Comments
 (0)