fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

instances added god may help

Browse Source
This commit is contained in:
Felix Schneider
2026-02-23 12:58:19 +01:00
parent 25370a1a55
commit 99db252f60
290 changed files with 9858 additions and 4914 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
lib/Service/Tenant/TenantScopeService.php
View File

@@ -3,70 +3,92 @@
namespace MintyPHP\Service\Tenant;
use MintyPHP\Repository\Org\DepartmentRepository;
use MintyPHP\Repository\Tenant\UserTenantRepository;
use MintyPHP\Repository\Tenant\TenantRepository;
use MintyPHP\Repository\Tenant\UserTenantRepository;
use MintyPHP\Service\Access\PermissionGateway;
use MintyPHP\Service\Access\PermissionService;
class TenantScopeService
{
public static function isStrict(): bool
public function __construct(
private readonly TenantRepository $tenantRepository,
private readonly DepartmentRepository $departmentRepository,
private readonly UserTenantRepository $userTenantRepository,
private readonly PermissionGateway $permissionGateway
) {
}
public function isStrict(): bool
{
return defined('TENANT_SCOPE_STRICT') ? (bool) TENANT_SCOPE_STRICT : true;
}
public static function getUserTenantIds(int $userId, bool $onlyActive = true): array
public function getUserTenantIds(int $userId, bool $onlyActive = true): array
{
if ($userId <= 0) {
return [];
}
if (self::canBypass($userId)) {
$ids = TenantRepository::listIds();
if ($this->canBypass($userId)) {
$ids = $this->tenantRepository->listIds();
} else {
$ids = array_values(array_unique(array_map('intval', UserTenantRepository::listTenantIdsByUserId($userId))));
$ids = array_values(array_unique(array_map(
'intval',
$this->userTenantRepository->listTenantIdsByUserId($userId)
)));
}
if ($onlyActive) {
return self::filterActiveTenantIds($ids);
return $this->filterActiveTenantIds($ids);
}
return $ids;
}
public static function canAccess(string $resource, int $resourceId, int $userId): bool
public function canAccess(string $resource, int $resourceId, int $userId): bool
{
if ($resourceId <= 0 || $userId <= 0) {
return false;
}
if (self::canBypass($userId)) {
if ($this->canBypass($userId)) {
return true;
}
$resourceTenantIdsRaw = self::getResourceTenantIds($resource, $resourceId);
$userTenantIdsRaw = self::getUserTenantIds($userId, false);
$resourceTenantIds = self::filterActiveTenantIds($resourceTenantIdsRaw);
$userTenantIds = self::filterActiveTenantIds($userTenantIdsRaw);
$resourceTenantIdsRaw = $this->getResourceTenantIds($resource, $resourceId);
$userTenantIdsRaw = $this->getUserTenantIds($userId, false);
$resourceTenantIds = $this->filterActiveTenantIds($resourceTenantIdsRaw);
$userTenantIds = $this->filterActiveTenantIds($userTenantIdsRaw);
if ($resourceTenantIdsRaw && !$resourceTenantIds) {
return false;
}
if (!$resourceTenantIds) {
return self::isStrict() ? false : true;
return $this->isStrict() ? false : true;
}
if (!$userTenantIds) {
return false;
}
return (bool) array_intersect($resourceTenantIds, $userTenantIds);
}
public static function filterTenantIdsForUser(array $tenantIds, int $userId): array
public function filterTenantIdsForUser(array $tenantIds, int $userId): array
{
$tenantIds = array_values(array_unique(array_map('intval', $tenantIds)));
$userTenantIds = self::getUserTenantIds($userId);
$userTenantIds = $this->getUserTenantIds($userId);
if (!$userTenantIds) {
return [];
}
return array_values(array_intersect($tenantIds, $userTenantIds));
}
public static function mergeTenantIdsPreservingOutOfScope(array $requestedTenantIds, array $existingTenantIds, array $allowedTenantIds): array
{
public function mergeTenantIdsPreservingOutOfScope(
array $requestedTenantIds,
array $existingTenantIds,
array $allowedTenantIds
): array {
$requestedTenantIds = array_values(array_unique(array_map('intval', $requestedTenantIds)));
$existingTenantIds = array_values(array_unique(array_map('intval', $existingTenantIds)));
$allowedTenantIds = array_values(array_unique(array_map('intval', $allowedTenantIds)));
@@ -74,27 +96,28 @@ class TenantScopeService
if (!$allowedTenantIds) {
return $existingTenantIds;
}
$outOfScope = array_values(array_diff($existingTenantIds, $allowedTenantIds));
return array_values(array_unique(array_merge($requestedTenantIds, $outOfScope)));
}
public static function hasGlobalAccess(int $userId): bool
public function hasGlobalAccess(int $userId): bool
{
return self::canBypass($userId);
return $this->canBypass($userId);
}
public static function resourceBelongsToTenant(string $resource, int $resourceId, int $tenantId): bool
public function resourceBelongsToTenant(string $resource, int $resourceId, int $tenantId): bool
{
if ($resourceId <= 0 || $tenantId <= 0) {
return false;
}
$resourceTenantIds = self::getResourceTenantIds($resource, $resourceId);
$resourceTenantIds = $this->getResourceTenantIds($resource, $resourceId);
if (!$resourceTenantIds) {
return false;
}
$activeResourceTenantIds = self::filterActiveTenantIds($resourceTenantIds);
$activeResourceTenantIds = $this->filterActiveTenantIds($resourceTenantIds);
if (!$activeResourceTenantIds) {
return false;
}
@@ -102,38 +125,46 @@ class TenantScopeService
return in_array($tenantId, $activeResourceTenantIds, true);
}
private static function getResourceTenantIds(string $resource, int $resourceId): array
private function getResourceTenantIds(string $resource, int $resourceId): array
{
$resource = strtolower(trim($resource));
if ($resource === 'tenants') {
return $resourceId > 0 ? [$resourceId] : [];
}
if ($resource === 'users') {
return array_values(array_unique(array_map('intval', UserTenantRepository::listTenantIdsByUserId($resourceId))));
return array_values(array_unique(array_map(
'intval',
$this->userTenantRepository->listTenantIdsByUserId($resourceId)
)));
}
if ($resource === 'departments') {
$department = DepartmentRepository::find($resourceId);
$department = $this->departmentRepository->find($resourceId);
$tenantId = (int) ($department['tenant_id'] ?? 0);
return $tenantId > 0 ? [$tenantId] : [];
}
return [];
}
private static function filterActiveTenantIds(array $tenantIds): array
private function filterActiveTenantIds(array $tenantIds): array
{
$tenantIds = array_values(array_unique(array_map('intval', $tenantIds)));
if (!$tenantIds) {
return [];
}
return TenantRepository::listActiveIdsByIds($tenantIds);
return $this->tenantRepository->listActiveIdsByIds($tenantIds);
}
private static function canBypass(int $userId): bool
private function canBypass(int $userId): bool
{
if ($userId <= 0) {
return false;
}
return PermissionService::userHas($userId, PermissionService::TENANTS_UPDATE)
|| PermissionService::userHas($userId, PermissionService::SETTINGS_UPDATE);
return $this->permissionGateway->userHas($userId, PermissionService::TENANTS_UPDATE)
|| $this->permissionGateway->userHas($userId, PermissionService::SETTINGS_UPDATE);
}
}