forked from fa/breadcrumb-the-shire
fs
0c351f6aff
Move the entire audit subsystem (system audit, API audit, import audit, user lifecycle audit, frontend telemetry) from core into modules/audit/. Core decoupling via interface-based injection: - AuditRecorderInterface replaces SystemAuditService in 10+ core services - UserLifecycleAuditInterface / ImportAuditInterface for specialized flows - NullAuditRecorder fallback when audit module is disabled - ApiBootstrap/ApiResponse use null-safe callable resolvers Module structure (modules/audit/): - Manifest with routes, permissions, scheduler jobs, authorization policy - 9 services, 8 repositories, 6 domain enums, 4 job handlers - 33 page files, 4 JS files, 8 test files, migration scripts, i18n Core cleanup: - OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService surgically cleaned of audit-specific constants - Sidebar template cleared of hardcoded audit navigation - AuditModuleIsolationContractTest ensures no future core→module coupling All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5 clean, architecture contracts verified. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
151 lines
9.1 KiB
PHP
151 lines
9.1 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Service\Access;
|
|
|
|
final class OperationsAuthorizationPolicy implements AuthorizationPolicyInterface
|
|
{
|
|
public const ABILITY_ADMIN_DOCS_VIEW = 'ops.admin.docs.view';
|
|
public const ABILITY_ADMIN_IMPORTS_VIEW = 'ops.admin.imports.view';
|
|
public const ABILITY_ADMIN_JOBS_RUN_NOW = 'ops.admin.jobs.run_now';
|
|
public const ABILITY_ADMIN_JOBS_VIEW = 'ops.admin.jobs.view';
|
|
public const ABILITY_ADMIN_JOBS_MANAGE = 'ops.admin.jobs.manage';
|
|
public const ABILITY_ADMIN_MAIL_LOG_VIEW = 'ops.admin.mail_log.view';
|
|
public const ABILITY_ADMIN_STATS_VIEW = 'ops.admin.stats.view';
|
|
public const ABILITY_ADMIN_SYSTEM_INFO_VIEW = 'ops.admin.system_info.view';
|
|
public const ABILITY_ADMIN_API_DOCS_VIEW = 'ops.admin.api_docs.view';
|
|
public const ABILITY_ADMIN_IMPORTS_TYPE_USERS = 'ops.admin.imports.type.users';
|
|
public const ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS = 'ops.admin.imports.type.departments';
|
|
public const ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE = 'ops.admin.users.assignments.manage';
|
|
public const ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS = 'ops.admin.users.create.edit_custom_fields';
|
|
public const ABILITY_API_PERMISSIONS_VIEW = 'ops.api.permissions.view';
|
|
public const ABILITY_API_SETTINGS_VIEW = 'ops.api.settings.view';
|
|
public const ABILITY_API_SETTINGS_UPDATE = 'ops.api.settings.update';
|
|
public const ABILITY_API_ROLES_VIEW = 'ops.api.roles.view';
|
|
public const ABILITY_API_ROLES_CREATE = 'ops.api.roles.create';
|
|
public const ABILITY_API_ROLES_UPDATE = 'ops.api.roles.update';
|
|
public const ABILITY_API_ROLES_DELETE = 'ops.api.roles.delete';
|
|
public const ABILITY_API_DEPARTMENTS_VIEW = 'ops.api.departments.view';
|
|
public const ABILITY_API_DEPARTMENTS_CREATE = 'ops.api.departments.create';
|
|
public const ABILITY_API_DEPARTMENTS_UPDATE = 'ops.api.departments.update';
|
|
public const ABILITY_API_DEPARTMENTS_DELETE = 'ops.api.departments.delete';
|
|
public const ABILITY_API_TENANTS_VIEW = 'ops.api.tenants.view';
|
|
public const ABILITY_API_TENANTS_CREATE = 'ops.api.tenants.create';
|
|
public const ABILITY_API_TENANTS_UPDATE = 'ops.api.tenants.update';
|
|
public const ABILITY_API_TENANTS_DELETE = 'ops.api.tenants.delete';
|
|
public const ABILITY_API_ME_SELF_UPDATE = 'ops.api.me.self_update';
|
|
public const ABILITY_API_TOKENS_SELF_MANAGE = 'ops.api.tokens.self_manage';
|
|
|
|
public function __construct(
|
|
private readonly PermissionService $permissionService
|
|
) {
|
|
}
|
|
|
|
public function supports(string $ability): bool
|
|
{
|
|
return in_array($ability, [
|
|
self::ABILITY_ADMIN_DOCS_VIEW,
|
|
self::ABILITY_ADMIN_IMPORTS_VIEW,
|
|
self::ABILITY_ADMIN_JOBS_RUN_NOW,
|
|
self::ABILITY_ADMIN_JOBS_VIEW,
|
|
self::ABILITY_ADMIN_JOBS_MANAGE,
|
|
self::ABILITY_ADMIN_MAIL_LOG_VIEW,
|
|
self::ABILITY_ADMIN_STATS_VIEW,
|
|
self::ABILITY_ADMIN_SYSTEM_INFO_VIEW,
|
|
self::ABILITY_ADMIN_API_DOCS_VIEW,
|
|
self::ABILITY_ADMIN_IMPORTS_TYPE_USERS,
|
|
self::ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS,
|
|
self::ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE,
|
|
self::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS,
|
|
self::ABILITY_API_PERMISSIONS_VIEW,
|
|
self::ABILITY_API_SETTINGS_VIEW,
|
|
self::ABILITY_API_SETTINGS_UPDATE,
|
|
self::ABILITY_API_ROLES_VIEW,
|
|
self::ABILITY_API_ROLES_CREATE,
|
|
self::ABILITY_API_ROLES_UPDATE,
|
|
self::ABILITY_API_ROLES_DELETE,
|
|
self::ABILITY_API_DEPARTMENTS_VIEW,
|
|
self::ABILITY_API_DEPARTMENTS_CREATE,
|
|
self::ABILITY_API_DEPARTMENTS_UPDATE,
|
|
self::ABILITY_API_DEPARTMENTS_DELETE,
|
|
self::ABILITY_API_TENANTS_VIEW,
|
|
self::ABILITY_API_TENANTS_CREATE,
|
|
self::ABILITY_API_TENANTS_UPDATE,
|
|
self::ABILITY_API_TENANTS_DELETE,
|
|
self::ABILITY_API_ME_SELF_UPDATE,
|
|
self::ABILITY_API_TOKENS_SELF_MANAGE,
|
|
], true);
|
|
}
|
|
|
|
public function authorize(string $ability, array $context = []): AuthorizationDecision
|
|
{
|
|
$actorUserId = (int) ($context['actor_user_id'] ?? 0);
|
|
if ($actorUserId <= 0) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
return match ($ability) {
|
|
self::ABILITY_ADMIN_USERS_CREATE_EDIT_CUSTOM_FIELDS => $this->authorizeUsersCreateCustomFields($actorUserId),
|
|
self::ABILITY_API_TOKENS_SELF_MANAGE => $this->authorizeApiTokensSelfManage($actorUserId),
|
|
self::ABILITY_ADMIN_DOCS_VIEW => $this->allowIfHas($actorUserId, PermissionService::DOCS_VIEW),
|
|
self::ABILITY_ADMIN_IMPORTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::IMPORTS_VIEW),
|
|
self::ABILITY_ADMIN_JOBS_RUN_NOW => $this->allowIfHas($actorUserId, PermissionService::JOBS_RUN_NOW),
|
|
self::ABILITY_ADMIN_JOBS_VIEW => $this->allowIfHas($actorUserId, PermissionService::JOBS_VIEW),
|
|
self::ABILITY_ADMIN_JOBS_MANAGE => $this->allowIfHas($actorUserId, PermissionService::JOBS_MANAGE),
|
|
self::ABILITY_ADMIN_MAIL_LOG_VIEW => $this->allowIfHas($actorUserId, PermissionService::MAIL_LOG_VIEW),
|
|
self::ABILITY_ADMIN_STATS_VIEW => $this->allowIfHas($actorUserId, PermissionService::STATS_VIEW),
|
|
self::ABILITY_ADMIN_SYSTEM_INFO_VIEW => $this->allowIfHas($actorUserId, PermissionService::SYSTEM_INFO_VIEW),
|
|
self::ABILITY_ADMIN_API_DOCS_VIEW => $this->allowIfHas($actorUserId, PermissionService::API_DOCS_VIEW),
|
|
self::ABILITY_ADMIN_IMPORTS_TYPE_USERS => $this->allowIfHas($actorUserId, PermissionService::USERS_IMPORT),
|
|
self::ABILITY_ADMIN_IMPORTS_TYPE_DEPARTMENTS => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_IMPORT),
|
|
self::ABILITY_ADMIN_USERS_ASSIGNMENTS_MANAGE => $this->allowIfHas($actorUserId, PermissionService::USERS_UPDATE_ASSIGNMENTS),
|
|
self::ABILITY_API_PERMISSIONS_VIEW => $this->allowIfHas($actorUserId, PermissionService::PERMISSIONS_VIEW),
|
|
self::ABILITY_API_SETTINGS_VIEW => $this->allowIfHas($actorUserId, PermissionService::SETTINGS_VIEW),
|
|
self::ABILITY_API_SETTINGS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::SETTINGS_UPDATE),
|
|
self::ABILITY_API_ROLES_VIEW => $this->allowIfHas($actorUserId, PermissionService::ROLES_VIEW),
|
|
self::ABILITY_API_ROLES_CREATE => $this->allowIfHas($actorUserId, PermissionService::ROLES_CREATE),
|
|
self::ABILITY_API_ROLES_UPDATE => $this->allowIfHas($actorUserId, PermissionService::ROLES_UPDATE),
|
|
self::ABILITY_API_ROLES_DELETE => $this->allowIfHas($actorUserId, PermissionService::ROLES_DELETE),
|
|
self::ABILITY_API_DEPARTMENTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_VIEW),
|
|
self::ABILITY_API_DEPARTMENTS_CREATE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_CREATE),
|
|
self::ABILITY_API_DEPARTMENTS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_UPDATE),
|
|
self::ABILITY_API_DEPARTMENTS_DELETE => $this->allowIfHas($actorUserId, PermissionService::DEPARTMENTS_DELETE),
|
|
self::ABILITY_API_TENANTS_VIEW => $this->allowIfHas($actorUserId, PermissionService::TENANTS_VIEW),
|
|
self::ABILITY_API_TENANTS_CREATE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_CREATE),
|
|
self::ABILITY_API_TENANTS_UPDATE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_UPDATE),
|
|
self::ABILITY_API_TENANTS_DELETE => $this->allowIfHas($actorUserId, PermissionService::TENANTS_DELETE),
|
|
self::ABILITY_API_ME_SELF_UPDATE => $this->allowIfHas($actorUserId, PermissionService::USERS_SELF_UPDATE),
|
|
default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
|
|
};
|
|
}
|
|
|
|
private function authorizeUsersCreateCustomFields(int $actorUserId): AuthorizationDecision
|
|
{
|
|
if (!$this->permissionService->userHas($actorUserId, PermissionService::CUSTOM_FIELDS_EDIT_VALUES)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
if (!$this->permissionService->userHas($actorUserId, PermissionService::USERS_UPDATE_ASSIGNMENTS)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
|
|
private function authorizeApiTokensSelfManage(int $actorUserId): AuthorizationDecision
|
|
{
|
|
if ($this->permissionService->userHas($actorUserId, PermissionService::USERS_SELF_UPDATE)) {
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
if ($this->permissionService->userHas($actorUserId, PermissionService::API_TOKENS_MANAGE)) {
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
private function allowIfHas(int $actorUserId, string $permissionKey): AuthorizationDecision
|
|
{
|
|
if (!$this->permissionService->userHas($actorUserId, $permissionKey)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
}
|