fa/breadcrumb-the-shire
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

weitere updates für instanzierbarkeit und sauberes testing

Browse Source
This commit is contained in:
Felix Schneider
2026-02-24 08:49:40 +01:00
parent 7b53faca37
commit 16759a2732
119 changed files with 6371 additions and 745 deletions
Download Patch File Download Diff File Expand all files Collapse all files

160
lib/Service/Access/DepartmentAuthorizationPolicy.php Normal file
View File

@@ -0,0 +1,160 @@
<?php
namespace MintyPHP\Service\Access;
use MintyPHP\Service\Directory\DirectoryScopeGateway;
class DepartmentAuthorizationPolicy implements AuthorizationPolicyInterface
{
public const ABILITY_ADMIN_DEPARTMENTS_VIEW = 'admin.departments.view';
public const ABILITY_ADMIN_DEPARTMENTS_CREATE = 'admin.departments.create';
public const ABILITY_ADMIN_DEPARTMENTS_EDIT_CONTEXT = 'admin.departments.edit.context';
public const ABILITY_ADMIN_DEPARTMENTS_EDIT_SUBMIT = 'admin.departments.edit.submit';
public const ABILITY_ADMIN_DEPARTMENTS_DELETE = 'admin.departments.delete';
public function __construct(
private readonly PermissionGateway $permissionGateway,
private readonly DirectoryScopeGateway $scopeGateway
) {
}
public function supports(string $ability): bool
{
return in_array($ability, [
self::ABILITY_ADMIN_DEPARTMENTS_VIEW,
self::ABILITY_ADMIN_DEPARTMENTS_CREATE,
self::ABILITY_ADMIN_DEPARTMENTS_EDIT_CONTEXT,
self::ABILITY_ADMIN_DEPARTMENTS_EDIT_SUBMIT,
self::ABILITY_ADMIN_DEPARTMENTS_DELETE,
], true);
}
public function authorize(string $ability, array $context = []): AuthorizationDecision
{
return match ($ability) {
self::ABILITY_ADMIN_DEPARTMENTS_VIEW => $this->authorizeAdminDepartmentsView($context),
self::ABILITY_ADMIN_DEPARTMENTS_CREATE => $this->authorizeAdminDepartmentsCreate($context),
self::ABILITY_ADMIN_DEPARTMENTS_EDIT_CONTEXT => $this->authorizeAdminDepartmentsEditContext($context),
self::ABILITY_ADMIN_DEPARTMENTS_EDIT_SUBMIT => $this->authorizeAdminDepartmentsEditSubmit($context),
self::ABILITY_ADMIN_DEPARTMENTS_DELETE => $this->authorizeAdminDepartmentsDelete($context),
default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
};
}
private function authorizeAdminDepartmentsView(array $context): AuthorizationDecision
{
$actorUserId = $this->actorUserId($context);
if (!$this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_VIEW)) {
return AuthorizationDecision::deny(403, 'forbidden');
}
$allowedTenantIds = $this->scopeGateway->getUserTenantIds($actorUserId);
$isStrictScope = $this->scopeGateway->isStrict();
return AuthorizationDecision::allow([
'capabilities' => [
'can_view_page' => true,
'can_create_department' => $this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_CREATE),
'allowed_tenant_ids' => $allowedTenantIds,
'is_strict_scope' => $isStrictScope,
],
]);
}
private function authorizeAdminDepartmentsCreate(array $context): AuthorizationDecision
{
$actorUserId = $this->actorUserId($context);
if (!$this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_CREATE)) {
return AuthorizationDecision::deny(403, 'forbidden');
}
$allowedTenantIds = $this->scopeGateway->getUserTenantIds($actorUserId);
$isStrictScope = $this->scopeGateway->isStrict();
if ($isStrictScope && !$allowedTenantIds) {
return AuthorizationDecision::deny(403, 'permission_denied');
}
return AuthorizationDecision::allow([
'capabilities' => [
'allowed_tenant_ids' => $allowedTenantIds,
'is_strict_scope' => $isStrictScope,
],
]);
}
private function authorizeAdminDepartmentsEditContext(array $context): AuthorizationDecision
{
$actorUserId = $this->actorUserId($context);
$targetDepartmentId = $this->targetDepartmentId($context);
if ($actorUserId <= 0 || $targetDepartmentId <= 0) {
return AuthorizationDecision::deny(403, 'forbidden');
}
if (!$this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_VIEW)) {
return AuthorizationDecision::deny(403, 'forbidden');
}
if (!$this->scopeGateway->canAccess('departments', $targetDepartmentId, $actorUserId)) {
return AuthorizationDecision::deny(403, 'permission_denied');
}
return AuthorizationDecision::allow([
'capabilities' => [
'can_view_page' => true,
'can_update_department' => $this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_UPDATE),
'allowed_tenant_ids' => $this->scopeGateway->getUserTenantIds($actorUserId),
],
]);
}
private function authorizeAdminDepartmentsEditSubmit(array $context): AuthorizationDecision
{
$contextDecision = $this->authorizeAdminDepartmentsEditContext($context);
if (!$contextDecision->isAllowed()) {
return $contextDecision;
}
$capabilities = $this->capabilitiesFromDecision($contextDecision);
if (!($capabilities['can_update_department'] ?? false)) {
return AuthorizationDecision::deny(403, 'forbidden');
}
return AuthorizationDecision::allow(['capabilities' => $capabilities]);
}
private function authorizeAdminDepartmentsDelete(array $context): AuthorizationDecision
{
$actorUserId = $this->actorUserId($context);
$targetDepartmentId = $this->targetDepartmentId($context);
if ($actorUserId <= 0 || $targetDepartmentId <= 0) {
return AuthorizationDecision::deny(403, 'forbidden');
}
if (!$this->hasPermission($actorUserId, PermissionService::DEPARTMENTS_DELETE)) {
return AuthorizationDecision::deny(403, 'forbidden');
}
if (!$this->scopeGateway->canAccess('departments', $targetDepartmentId, $actorUserId)) {
return AuthorizationDecision::deny(403, 'permission_denied');
}
return AuthorizationDecision::allow();
}
private function actorUserId(array $context): int
{
return (int) ($context['actor_user_id'] ?? 0);
}
private function targetDepartmentId(array $context): int
{
return (int) ($context['target_department_id'] ?? 0);
}
private function hasPermission(int $userId, string $permissionKey): bool
{
return $userId > 0 && $this->permissionGateway->userHas($userId, $permissionKey);
}
private function capabilitiesFromDecision(AuthorizationDecision $decision): array
{
$capabilities = $decision->attribute('capabilities', []);
return is_array($capabilities) ? $capabilities : [];
}
}