src/Security/PermissionSet/Repository/PermissionSet.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2010-2021, the Friendica project
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Security\PermissionSet\Repository;
  23
  24 use Exception;
  25 use Friendica\BaseRepository;
  26 use Friendica\Database\Database;
  27 use Friendica\Model\Contact;
  28 use Friendica\Model\Group;
  29 use Friendica\Network\HTTPException\NotFoundException;
  30 use Friendica\Security\PermissionSet\Factory;
  31 use Friendica\Security\PermissionSet\Collection;
  32 use Friendica\Security\PermissionSet\Entity;
  33 use Friendica\Util\ACLFormatter;
  34 use Psr\Log\LoggerInterface;
  35
  36 class PermissionSet extends BaseRepository
  37 {
  38         /** @var int Virtual permission set id for public permission */
  39         const PUBLIC = 0;
  40
  41         /** @var Factory\PermissionSet */
  42         protected $factory;
  43
  44         protected static $table_name = 'permissionset';
  45
  46         /** @var ACLFormatter */
  47         private $aclFormatter;
  48
  49         public function __construct(Database $database, LoggerInterface $logger, Factory\PermissionSet $factory, ACLFormatter $aclFormatter)
  50         {
  51                 parent::__construct($database, $logger, $factory);
  52
  53                 $this->aclFormatter = $aclFormatter;
  54         }
  55
  56         /**
  57          * replaces the PUBLIC id for the public permissionSet
  58          * (no need to create the default permission set over and over again)
  59          *
  60          * @param $condition
  61          */
  62         private function checkPublicSelect(&$condition)
  63         {
  64                 if (empty($condition['allow_cid']) &&
  65                         empty($condition['allow_gid']) &&
  66                         empty($condition['deny_cid']) &&
  67                         empty($condition['deny_gid'])) {
  68                         $condition['uid'] = self::PUBLIC;
  69                 }
  70         }
  71
  72         /**
  73          * @param array $condition
  74          * @param array $params
  75          *
  76          * @return Entity\PermissionSet
  77          * @throws NotFoundException
  78          */
  79         private function selectOne(array $condition, array $params = []): Entity\PermissionSet
  80         {
  81                 return parent::_selectOne($condition, $params);
  82         }
  83
  84         private function select(array $condition, array $params = []): Collection\PermissionSets
  85         {
  86                 return new Collection\PermissionSets(parent::_select($condition, $params)->getArrayCopy());
  87         }
  88
  89         /**
  90          * Converts a given PermissionSet into a DB compatible row array
  91          *
  92          * @param Entity\PermissionSet $permissionSet
  93          *
  94          * @return array
  95          */
  96         protected function convertToTableRow(Entity\PermissionSet $permissionSet): array
  97         {
  98                 return [
  99                         'uid'       => $permissionSet->uid,
 100                         'allow_cid' => $this->aclFormatter->toString($permissionSet->allow_cid),
 101                         'allow_gid' => $this->aclFormatter->toString($permissionSet->allow_gid),
 102                         'deny_cid'  => $this->aclFormatter->toString($permissionSet->deny_cid),
 103                         'deny_gid'  => $this->aclFormatter->toString($permissionSet->deny_gid),
 104                 ];
 105         }
 106
 107         /**
 108          * @param int $id  A PermissionSet table row id or self::PUBLIC
 109          * @param int $uid The owner of the PermissionSet
 110          * @return Entity\PermissionSet
 111          * @throws NotFoundException
 112          */
 113         public function selectOneById(int $id, int $uid): Entity\PermissionSet
 114         {
 115                 if ($id === self::PUBLIC) {
 116                         return $this->factory->createFromString($uid);
 117                 }
 118
 119                 return $this->selectOne(['id' => $id, 'uid' => $uid]);
 120         }
 121
 122         /**
 123          * Returns a permission set collection for a given contact
 124          *
 125          * @param int $cid Contact id of the visitor
 126          * @param int $uid User id whom the items belong, used for ownership check.
 127          *
 128          * @return Collection\PermissionSets
 129          */
 130         public function selectByContactId(int $cid, int $uid): Collection\PermissionSets
 131         {
 132                 $cdata = Contact::getPublicAndUserContactID($cid, $uid);
 133                 if (!empty($cdata)) {
 134                         $public_contact_str = $this->aclFormatter->toString($cdata['public']);
 135                         $user_contact_str   = $this->aclFormatter->toString($cdata['user']);
 136                         $cid                = $cdata['user'];
 137                 } else {
 138                         $public_contact_str = $this->aclFormatter->toString($cid);
 139                         $user_contact_str   = '';
 140                 }
 141
 142                 $groups = [];
 143                 if (!empty($user_contact_str) && $this->db->exists('contact', [
 144                         'id' => $cid,
 145                         'uid' => $uid,
 146                         'blocked' => false
 147                 ])) {
 148                         $groups = Group::getIdsByContactId($cid);
 149                 }
 150
 151                 $group_str = '<<>>'; // should be impossible to match
 152                 foreach ($groups as $group_id) {
 153                         $group_str .= '|<' . preg_quote($group_id) . '>';
 154                 }
 155
 156                 if (!empty($user_contact_str)) {
 157                         $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR `deny_cid` REGEXP ? OR deny_gid REGEXP ?)
 158                                 AND (allow_cid REGEXP ? OR allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
 159                                 $uid, $user_contact_str, $public_contact_str, $group_str,
 160                                 $user_contact_str, $public_contact_str, $group_str];
 161                 } else {
 162                         $condition = ["`uid` = ? AND (NOT (`deny_cid` REGEXP ? OR deny_gid REGEXP ?)
 163                                 AND (allow_cid REGEXP ? OR allow_gid REGEXP ? OR (allow_cid = '' AND allow_gid = '')))",
 164                                 $uid, $public_contact_str, $group_str, $public_contact_str, $group_str];
 165                 }
 166
 167                 return $this->select($condition);
 168         }
 169
 170         /**
 171          * Fetch the default PermissionSet for a given user, create it if it doesn't exist
 172          *
 173          * @param int $uid
 174          *
 175          * @return Entity\PermissionSet
 176          * @throws Exception
 177          */
 178         public function selectDefaultForUser(int $uid): Entity\PermissionSet
 179         {
 180                 $self_contact = Contact::selectFirst(['id'], ['uid' => $uid, 'self' => true]);
 181
 182                 return $this->selectOrCreate($this->factory->createFromString(
 183                         $uid,
 184                         $this->aclFormatter->toString($self_contact['id'])
 185                 ));
 186         }
 187
 188         /**
 189          * Fetch the public PermissionSet
 190          *
 191          * @param int $uid
 192          *
 193          * @return Entity\PermissionSet
 194          */
 195         public function selectPublicForUser(int $uid): Entity\PermissionSet
 196         {
 197                 return $this->factory->createFromString($uid, '', '', '', '', self::PUBLIC);
 198         }
 199
 200         /**
 201          * Selects or creates a PermissionSet based on it's fields
 202          *
 203          * @param Entity\PermissionSet $permissionSet
 204          *
 205          * @return Entity\PermissionSet
 206          */
 207         public function selectOrCreate(Entity\PermissionSet $permissionSet): Entity\PermissionSet
 208         {
 209                 if ($permissionSet->id) {
 210                         return $permissionSet;
 211                 }
 212
 213                 // Don't select/update Public permission sets
 214                 if ($permissionSet->isPublic()) {
 215                         return $this->selectPublicForUser($permissionSet->uid);
 216                 }
 217
 218                 try {
 219                         return $this->selectOne($this->convertToTableRow($permissionSet));
 220                 } catch (NotFoundException $exception) {
 221                         return $this->save($permissionSet);
 222                 }
 223         }
 224
 225         /**
 226          * @param Entity\PermissionSet $permissionSet
 227          *
 228          * @return Entity\PermissionSet
 229          * @throws NotFoundException
 230          */
 231         public function save(Entity\PermissionSet $permissionSet): Entity\PermissionSet
 232         {
 233                 // Don't save/update the common public PermissionSet
 234                 if ($permissionSet->isPublic()) {
 235                         return $this->selectPublicForUser($permissionSet->uid);
 236                 }
 237
 238                 $fields = $this->convertToTableRow($permissionSet);
 239
 240                 if ($permissionSet->id) {
 241                         $this->db->update(self::$table_name, $fields, ['id' => $permissionSet->id]);
 242                 } else {
 243                         $this->db->insert(self::$table_name, $fields);
 244
 245                         $permissionSet = $this->selectOneById($this->db->lastInsertId(), $permissionSet->uid);
 246                 }
 247
 248                 return $permissionSet;
 249         }
 250 }