src/Repository/PermissionSet.php

   1 <?php
   2
   3 namespace Friendica\Repository;
   4
   5 use Friendica\BaseRepository;
   6 use Friendica\Collection;
   7 use Friendica\Database\Database;
   8 use Friendica\Model;
   9 use Friendica\Model\Group;
  10 use Friendica\Network\HTTPException;
  11 use Friendica\Util\ACLFormatter;
  12 use Psr\Log\LoggerInterface;
  13
  14 class PermissionSet extends BaseRepository
  15 {
  16         /** @var int Virtual permission set id for public permission */
  17         const PUBLIC = 0;
  18
  19         protected static $table_name = 'permissionset';
  20
  21         protected static $model_class = Model\PermissionSet::class;
  22
  23         protected static $collection_class = Collection\PermissionSets::class;
  24
  25         /** @var ACLFormatter */
  26         private $aclFormatter;
  27
  28         public function __construct(Database $dba, LoggerInterface $logger, ACLFormatter $aclFormatter)
  29         {
  30                 parent::__construct($dba, $logger);
  31
  32                 $this->aclFormatter = $aclFormatter;
  33         }
  34
  35         /**
  36          * @param array $data
  37          * @return Model\PermissionSet
  38          */
  39         protected function create(array $data)
  40         {
  41                 return new Model\PermissionSet($this->dba, $this->logger, $data);
  42         }
  43
  44         /**
  45          * @param array $condition
  46          * @return Model\PermissionSet
  47          * @throws \Friendica\Network\HTTPException\NotFoundException
  48          */
  49         public function selectFirst(array $condition)
  50         {
  51                 if (isset($condition['id']) && !$condition['id']) {
  52                         return $this->create([
  53                                 'id' => self::PUBLIC,
  54                                 'uid' => $condition['uid'] ?? 0,
  55                                 'allow_cid' => '',
  56                                 'allow_gid' => '',
  57                                 'deny_cid' => '',
  58                                 'deny_gid' => '',
  59                         ]);
  60                 }
  61
  62                 return parent::selectFirst($condition);
  63         }
  64
  65         /**
  66          * @param array $condition
  67          * @param array $params
  68          * @return Collection\PermissionSets
  69          * @throws \Exception
  70          */
  71         public function select(array $condition = [], array $params = [])
  72         {
  73                 return parent::select($condition, $params);
  74         }
  75
  76         /**
  77          * @param array $condition
  78          * @param array $params
  79          * @param int|null $max_id
  80          * @param int|null $since_id
  81          * @param int $limit
  82          * @return Collection\PermissionSets
  83          * @throws \Exception
  84          */
  85         public function selectByBoundaries(array $condition = [], array $params = [], int $max_id = null, int $since_id = null, int $limit = self::LIMIT)
  86         {
  87                 return parent::selectByBoundaries($condition, $params, $max_id, $since_id, $limit);
  88         }
  89
  90         /**
  91          * Fetch the id of a given permission set. Generate a new one when needed
  92          *
  93          * @param int         $uid
  94          * @param string|null $allow_cid Allowed contact IDs    - empty = everyone
  95          * @param string|null $allow_gid Allowed group IDs      - empty = everyone
  96          * @param string|null $deny_cid  Disallowed contact IDs - empty = no one
  97          * @param string|null $deny_gid  Disallowed group IDs   - empty = no one
  98          * @return int id
  99          * @throws \Exception
 100          */
 101         public function getIdFromACL(
 102                 int $uid,
 103                 string $allow_cid = null,
 104                 string $allow_gid = null,
 105                 string $deny_cid = null,
 106                 string $deny_gid = null
 107         ) {
 108                 $allow_cid = $this->aclFormatter->sanitize($allow_cid);
 109                 $allow_gid = $this->aclFormatter->sanitize($allow_gid);
 110                 $deny_cid = $this->aclFormatter->sanitize($deny_cid);
 111                 $deny_gid = $this->aclFormatter->sanitize($deny_gid);
 112
 113                 // Public permission
 114                 if (!$allow_cid && !$allow_gid && !$deny_cid && !$deny_gid) {
 115                         return self::PUBLIC;
 116                 }
 117
 118                 $condition = [
 119                         'uid' => $uid,
 120                         'allow_cid' => $allow_cid,
 121                         'allow_gid' => $allow_gid,
 122                         'deny_cid'  => $deny_cid,
 123                         'deny_gid'  => $deny_gid
 124                 ];
 125
 126                 try {
 127                         $permissionset = $this->selectFirst($condition);
 128                 } catch(HTTPException\NotFoundException $exception) {
 129                         $permissionset = $this->insert($condition);
 130                 }
 131
 132                 return $permissionset->id;
 133         }
 134
 135         /**
 136          * Returns a permission set collection for a given contact
 137          *
 138          * @param integer $contact_id Contact id of the visitor
 139          * @param integer $uid        User id whom the items belong, used for ownership check.
 140          *
 141          * @return Collection\PermissionSets
 142          * @throws \Exception
 143          */
 144         public function selectByContactId($contact_id, $uid)
 145         {
 146                 $groups = [];
 147                 if ($this->dba->exists('contact', ['id' => $contact_id, 'uid' => $uid, 'blocked' => false])) {
 148                         $groups = Group::getIdsByContactId($contact_id);
 149                 }
 150
 151                 $group_str = '<<>>'; // should be impossible to match
 152                 foreach ($groups as $group_id) {
 153                         $group_str .= '|<' . preg_quote($group_id) . '>';
 154                 }
 155
 156                 $contact_str = '<' . $contact_id . '>';
 157
 158                 $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR deny_gid REGEXP ?)
 159                         AND (allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
 160                         $uid, $contact_str, $group_str, $contact_str, $group_str];
 161
 162                 return $this->select($condition);
 163         }
 164 }