weitere updates für instanzierbarkeit und sauberes testing

2026-02-24 08:49:40 +01:00
parent 7b53faca37
commit 16759a2732
119 changed files with 6371 additions and 745 deletions
--- a/lib/Service/Access/SettingsAuthorizationPolicy.php
+++ b/lib/Service/Access/SettingsAuthorizationPolicy.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace MintyPHP\Service\Access;
+
+class SettingsAuthorizationPolicy implements AuthorizationPolicyInterface
+{
+    public const ABILITY_ADMIN_SETTINGS_VIEW = 'admin.settings.view';
+    public const ABILITY_ADMIN_SETTINGS_UPDATE = 'admin.settings.update';
+    public const ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE = 'admin.settings.branding.update';
+    public const ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE = 'admin.settings.tokens.revoke';
+    public const ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN = 'admin.settings.user_lifecycle.run';
+
+    public function __construct(
+        private readonly PermissionGateway $permissionGateway
+    ) {
+    }
+
+    public function supports(string $ability): bool
+    {
+        return in_array($ability, [
+            self::ABILITY_ADMIN_SETTINGS_VIEW,
+            self::ABILITY_ADMIN_SETTINGS_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
+            self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN,
+        ], true);
+    }
+
+    public function authorize(string $ability, array $context = []): AuthorizationDecision
+    {
+        return match ($ability) {
+            self::ABILITY_ADMIN_SETTINGS_VIEW => $this->authorizeAdminSettingsView($context),
+            self::ABILITY_ADMIN_SETTINGS_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
+            self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
+            self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN => $this->authorizeSettingsUpdatePermission($context),
+            default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
+        };
+    }
+
+    private function authorizeAdminSettingsView(array $context): AuthorizationDecision
+    {
+        $actorUserId = $this->actorUserId($context);
+        if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_VIEW)) {
+            return AuthorizationDecision::deny(403, 'forbidden');
+        }
+
+        return AuthorizationDecision::allow([
+            'capabilities' => [
+                'can_view_page' => true,
+                'can_update_settings' => $this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE),
+            ],
+        ]);
+    }
+
+    private function authorizeSettingsUpdatePermission(array $context): AuthorizationDecision
+    {
+        $actorUserId = $this->actorUserId($context);
+        if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE)) {
+            return AuthorizationDecision::deny(403, 'forbidden');
+        }
+
+        return AuthorizationDecision::allow();
+    }
+
+    private function actorUserId(array $context): int
+    {
+        return (int) ($context['actor_user_id'] ?? 0);
+    }
+
+    private function hasPermission(int $userId, string $permissionKey): bool
+    {
+        return $userId > 0 && $this->permissionGateway->userHas($userId, $permissionKey);
+    }
+}