fa/breadcrumb-the-shire
1
0
Fork 1
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

assign role roles

Browse Source
This commit is contained in:
Felix Schneider
2026-03-13 21:11:48 +01:00
parent b89fd792bf
commit aaea038619
20 changed files with 495 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/Service/Access/AccessRepositoryFactory.php
View File

@@ -4,6 +4,8 @@ namespace MintyPHP\Service\Access;
use MintyPHP\Repository\Access\PermissionRepository;
use MintyPHP\Repository\Access\PermissionRepositoryInterface;
use MintyPHP\Repository\Access\RoleAssignableRoleRepository;
use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
use MintyPHP\Repository\Access\RolePermissionRepository;
use MintyPHP\Repository\Access\RolePermissionRepositoryInterface;
use MintyPHP\Repository\Access\UserRoleRepository;
@@ -13,6 +15,7 @@ class AccessRepositoryFactory
{
private ?PermissionRepository $permissionRepository = null;
private ?RolePermissionRepository $rolePermissionRepository = null;
private ?RoleAssignableRoleRepository $roleAssignableRoleRepository = null;
private ?UserRoleRepository $userRoleRepository = null;
public function createPermissionRepository(): PermissionRepositoryInterface
@@ -25,6 +28,11 @@ class AccessRepositoryFactory
return $this->rolePermissionRepository ??= new RolePermissionRepository();
}
public function createRoleAssignableRoleRepository(): RoleAssignableRoleRepositoryInterface
{
return $this->roleAssignableRoleRepository ??= new RoleAssignableRoleRepository();
}
public function createUserRoleRepository(): UserRoleRepositoryInterface
{
return $this->userRoleRepository ??= new UserRoleRepository();

6
lib/Service/Access/AccessServicesFactory.php
View File

@@ -3,6 +3,7 @@
namespace MintyPHP\Service\Access;
use MintyPHP\Repository\Access\PermissionRepositoryInterface;
use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
use MintyPHP\Repository\Access\RolePermissionRepositoryInterface;
use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
@@ -34,6 +35,11 @@ class AccessServicesFactory
return $this->accessRepositoryFactory->createUserRoleRepository();
}
public function createRoleAssignableRoleRepository(): RoleAssignableRoleRepositoryInterface
{
return $this->accessRepositoryFactory->createRoleAssignableRoleRepository();
}
public function createPermissionService(): PermissionService
{
return $this->accessGatewayFactory->createPermissionService();

101
lib/Service/Access/AssignableRoleService.php Normal file
View File

@@ -0,0 +1,101 @@
<?php
namespace MintyPHP\Service\Access;
use MintyPHP\Repository\Access\RoleAssignableRoleRepositoryInterface;
use MintyPHP\Repository\Access\RoleRepositoryInterface;
use MintyPHP\Repository\Access\UserRoleRepositoryInterface;
use MintyPHP\Service\Audit\SystemAuditService;
class AssignableRoleService
{
public function __construct(
private readonly RoleAssignableRoleRepositoryInterface $assignableRoleRepository,
private readonly UserRoleRepositoryInterface $userRoleRepository,
private readonly PermissionService $permissionService,
private readonly RoleRepositoryInterface $roleRepository,
private readonly SystemAuditService $systemAuditService
) {
}
/**
* Returns role IDs the given actor is allowed to assign.
* Users with 'roles.assign_all' get all active role IDs.
* Otherwise: union of assignable_role_ids from all of the actor's roles.
*
* @return int[]
*/
public function listAssignableRoleIdsForActor(int $actorUserId): array
{
if ($actorUserId <= 0) {
return [];
}
if ($this->permissionService->userHas($actorUserId, PermissionService::ROLES_ASSIGN_ALL)) {
return $this->roleRepository->listActiveIds();
}
$actorRoleIds = $this->userRoleRepository->listRoleIdsByUserId($actorUserId);
if (!$actorRoleIds) {
return [];
}
return $this->assignableRoleRepository->listAssignableRoleIdsByRoleIds($actorRoleIds);
}
/**
* Computes the effective role set respecting the actor's assignable scope.
*
* Roles the actor cannot assign are "frozen" — they remain as-is.
* frozen = currentIds ∩ NOT-assignable
* touched = submittedIds ∩ assignable
* result = frozen ∪ touched
*
* @param int[] $submittedIds Role IDs the form submitted
* @param int[] $currentIds Role IDs the target user currently has
* @return int[]
*/
public function computeEffectiveRoleIds(int $actorUserId, array $submittedIds, array $currentIds): array
{
$assignable = $this->listAssignableRoleIdsForActor($actorUserId);
$assignableMap = array_fill_keys($assignable, true);
// Roles the actor cannot touch — keep them as they are.
$frozen = array_values(array_filter(
$currentIds,
static fn (int $id): bool => !isset($assignableMap[$id])
));
// From the submitted set, only keep roles the actor is allowed to assign.
$touched = array_values(array_filter(
$submittedIds,
static fn (int $id): bool => isset($assignableMap[$id])
));
return array_values(array_unique(array_merge($frozen, $touched)));
}
/**
* Saves which roles this role can assign (admin UI) and logs the change.
*
* @param int[] $assignableRoleIds
*/
public function replaceAssignableRoles(int $roleId, array $assignableRoleIds, int $actorUserId): bool
{
$beforeIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
$result = $this->assignableRoleRepository->replaceForRole($roleId, $assignableRoleIds);
$afterIds = $this->assignableRoleRepository->listAssignableRoleIdsByRoleId($roleId);
if ($beforeIds !== $afterIds) {
$this->systemAuditService->record('admin.roles.assignable_roles.update', 'success', [
'actor_user_id' => $actorUserId > 0 ? $actorUserId : null,
'target_type' => 'role',
'target_id' => $roleId,
'before' => ['assignable_role_ids' => $beforeIds],
'after' => ['assignable_role_ids' => $afterIds],
]);
}
return $result;
}
}

1
lib/Service/Access/PermissionService.php
View File

@@ -45,6 +45,7 @@ class PermissionService
public const ROLES_CREATE = 'roles.create';
public const ROLES_UPDATE = 'roles.update';
public const ROLES_DELETE = 'roles.delete';
public const ROLES_ASSIGN_ALL = 'roles.assign_all';
public const PERMISSIONS_VIEW = 'permissions.view';
public const PERMISSIONS_CREATE = 'permissions.create';
public const PERMISSIONS_UPDATE = 'permissions.update';

18
lib/Service/User/UserAssignmentService.php
View File

@@ -7,6 +7,7 @@ use MintyPHP\Repository\Org\UserDepartmentRepositoryInterface;
use MintyPHP\Repository\Support\DatabaseSessionRepository;
use MintyPHP\Repository\Tenant\UserTenantRepositoryInterface;
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
use MintyPHP\Service\Access\AssignableRoleService;
use MintyPHP\Service\Access\PermissionService;
class UserAssignmentService
@@ -18,7 +19,8 @@ class UserAssignmentService
private readonly UserDepartmentRepositoryInterface $userDepartmentRepository,
private readonly UserDirectoryGateway $directoryGateway,
private readonly PermissionService $permissionService,
private readonly DatabaseSessionRepository $databaseSessionRepository
private readonly DatabaseSessionRepository $databaseSessionRepository,
private readonly AssignableRoleService $assignableRoleService
) {
}
@@ -172,7 +174,7 @@ class UserAssignmentService
return $result;
}
public function syncRoles(int $userId, array $roleIds, bool $bumpAuthz = true): bool
public function syncRoles(int $userId, array $roleIds, bool $bumpAuthz = true, int $actorUserId = 0): bool
{
$ids = array_values(array_unique(array_map('intval', $roleIds)));
$ids = array_values(array_filter($ids, static fn ($id) => $id > 0));
@@ -181,6 +183,14 @@ class UserAssignmentService
$validMap = array_fill_keys($validIds, true);
$ids = array_values(array_filter($ids, static fn ($id) => isset($validMap[$id])));
}
// Enforce assignable-roles: the actor can only touch roles within their assignable set.
// Roles outside the set are "frozen" and remain as-is on the target user.
if ($actorUserId > 0) {
$currentRoleIds = $this->userRoleRepository->listRoleIdsByUserId($userId);
$ids = $this->assignableRoleService->computeEffectiveRoleIds($actorUserId, $ids, $currentRoleIds);
}
$result = $this->userRoleRepository->replaceForUser($userId, $ids);
$this->permissionService->clearUserCache($userId);
if ($result && $bumpAuthz) {
@@ -228,7 +238,7 @@ class UserAssignmentService
$this->userWriteRepository->bumpAuthzVersion($userId);
}
public function syncAllAssignments(int $userId, array $tenantIds, array $roleIds, array $departmentIds): bool
public function syncAllAssignments(int $userId, array $tenantIds, array $roleIds, array $departmentIds, int $actorUserId = 0): bool
{
if ($userId <= 0) {
return false;
@@ -241,7 +251,7 @@ class UserAssignmentService
// bumpAuthz=false on each sync — bump once at the end to avoid redundant DB writes.
$ok = $this->syncTenants($userId, $tenantIds, false)
&& $this->syncRoles($userId, $roleIds, false)
&& $this->syncRoles($userId, $roleIds, false, $actorUserId)
&& $this->syncDepartments($userId, $departmentIds, false);
if (!$ok) {
$this->rollbackQuietly();

10
lib/Service/User/UserServicesFactory.php
View File

@@ -10,6 +10,7 @@ use MintyPHP\Repository\User\UserListQueryRepositoryInterface;
use MintyPHP\Repository\User\UserReadRepositoryInterface;
use MintyPHP\Repository\User\UserSavedFilterRepositoryInterface;
use MintyPHP\Repository\User\UserWriteRepositoryInterface;
use MintyPHP\Service\Access\AssignableRoleService;
use MintyPHP\Service\Audit\AuditServicesFactory;
use MintyPHP\Service\Audit\UserLifecycleAuditService;
@@ -26,11 +27,15 @@ class UserServicesFactory
private ?UserLifecycleRestoreService $userLifecycleRestoreService = null;
private ?UserLifecycleAuditService $userLifecycleAuditService = null;
/**
* @param \Closure(): AssignableRoleService $assignableRoleServiceFactory Lazy resolver to break circular dependency
*/
public function __construct(
private readonly AuditServicesFactory $auditServicesFactory,
private readonly UserRepositoryFactory $userRepositoryFactory,
private readonly UserGatewayFactory $userGatewayFactory,
private readonly DatabaseSessionRepository $databaseSessionRepository
private readonly DatabaseSessionRepository $databaseSessionRepository,
private readonly \Closure $assignableRoleServiceFactory
) {
}
@@ -59,7 +64,8 @@ class UserServicesFactory
$this->createUserDepartmentRepository(),
$this->createUserDirectoryGateway(),
$this->userGatewayFactory->createPermissionService(),
$this->databaseSessionRepository
$this->databaseSessionRepository,
($this->assignableRoleServiceFactory)()
);
}