-
Notifications
You must be signed in to change notification settings - Fork 245
Expand file tree
/
Copy pathHasAuthorization.php
More file actions
144 lines (124 loc) · 4.45 KB
/
HasAuthorization.php
File metadata and controls
144 lines (124 loc) · 4.45 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
<?php
namespace ProcessMaker\Traits;
use Illuminate\Support\Facades\Log;
use ProcessMaker\Models\Group;
use ProcessMaker\Models\Permission;
use ProcessMaker\Services\PermissionCacheService;
use ProcessMaker\Services\PermissionServiceManager;
trait HasAuthorization
{
private ?PermissionServiceManager $permissionService = null;
/**
* Get or create permission service manager
*/
private function getPermissionService(): PermissionServiceManager
{
if ($this->permissionService === null) {
$this->permissionService = app(PermissionServiceManager::class);
}
return $this->permissionService;
}
public function loadPermissions()
{
// Use the new optimized service
return $this->getPermissionService()->getUserPermissions($this->id);
}
public function loadUserPermissions()
{
$user = $this;
$permissions = app(PermissionCacheService::class)->rememberLegacyUserPermissions(
$user->id,
86400,
function () use ($user) {
return $user->permissions()->pluck('name')->toArray();
}
);
return $this->addCategoryViewPermissions($permissions);
}
public function loadGroupPermissions()
{
$processedGroups = [];
$permissions = [];
foreach ($this->groupMembersFromMemberable as $gm) {
$group = $gm->group;
$permissions = $this->loadPermissionOfGroups($group, $permissions, $processedGroups);
$names = $group->permissions->pluck('name')->toArray();
$permissions = array_merge($permissions, $names);
}
return $this->addCategoryViewPermissions($permissions);
}
public function loadPermissionOfGroups(Group $group, array $permissions = [], array $processedGroups = [])
{
try {
// Check if the group was proccessed
if (in_array($group->id, $processedGroups)) {
return $permissions;
}
// Add the group in the processedList
$processedGroups[] = $group->id;
// Load permissions
$groupPermissions = $group->permissions->pluck('name')->toArray();
$permissions = array_merge($permissions, $groupPermissions);
// Review groups
foreach ($group->groupMembersFromMemberable as $member) {
$memberGroup = $member->group;
$permissions = $this->loadPermissionOfGroups(
$memberGroup,
$permissions,
$processedGroups
);
}
return array_unique($permissions);
} catch (\Exception $e) {
Log::error('Error loading group permissions: ' . $e->getMessage());
return $permissions;
}
}
public function hasPermission($permissionString)
{
// Use the new optimized service for permission checking
return $this->getPermissionService()->userHasPermission($this->id, $permissionString);
}
/**
* Invalidate permission cache for this user
*/
public function invalidatePermissionCache(): void
{
$this->getPermissionService()->invalidateUserCache($this->id);
}
/**
* If a user can create or edit a resource,
* they should be able to view its categories.
*
* @param array $permissions
* @return array $permissions
*/
private function addCategoryViewPermissions($permissions)
{
$addFor = [
'processes' => 'view-process-categories',
'scripts' => 'view-script-categories',
'screens' => 'view-screen-categories',
];
foreach ($addFor as $resource => $categoryPermission) {
if (
in_array('create-' . $resource, $permissions) ||
in_array('edit-' . $resource, $permissions)
) {
if (!in_array($categoryPermission, $permissions)) {
$permissions[] = $categoryPermission;
}
}
}
return $permissions;
}
public function giveDirectPermission($permissionNames)
{
foreach ((array) $permissionNames as $permissionName) {
$permissionId = Permission::byName($permissionName)->id;
$this->permissions()->attach($permissionId);
}
// Invalidate cache after giving new permissions
$this->invalidatePermissionCache();
}
}