forked from fa/breadcrumb-the-shire
fs
ef72b34c40
Six targeted improvements to the modular monolith platform: 1. Fix AddressBook session key prefix to follow module.<id>.* convention 2. Move ADDRESS_BOOK_VIEW permission constant from core PermissionService into module 3. Add declarative JSON schema for module manifests (.agents/contracts/) 4. Add `requires` field with missing-dependency and circular-dependency detection 5. Add lightweight fire-and-forget event dispatcher (user.created/deleted/login/logout) 6. Add module deactivation hook interface and CLI script (bin/module-deactivate.php) Includes 15 new architecture/unit tests covering all new functionality. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
44 lines
1.3 KiB
PHP
44 lines
1.3 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Module\AddressBook;
|
|
|
|
use MintyPHP\Service\Access\AuthorizationDecision;
|
|
use MintyPHP\Service\Access\AuthorizationPolicyInterface;
|
|
use MintyPHP\Service\Access\PermissionService;
|
|
|
|
/**
|
|
* Authorization policy for address book abilities.
|
|
*
|
|
* Owns the 'addressbook.view' ability and delegates to the
|
|
* 'address_book.view' permission in the Core PermissionService.
|
|
*/
|
|
final class AddressBookAuthorizationPolicy implements AuthorizationPolicyInterface
|
|
{
|
|
public const ABILITY_VIEW = 'addressbook.view';
|
|
public const PERMISSION_KEY = 'address_book.view';
|
|
|
|
public function __construct(
|
|
private readonly PermissionService $permissionService
|
|
) {
|
|
}
|
|
|
|
public function supports(string $ability): bool
|
|
{
|
|
return $ability === self::ABILITY_VIEW;
|
|
}
|
|
|
|
public function authorize(string $ability, array $context = []): AuthorizationDecision
|
|
{
|
|
$actorUserId = (int) ($context['actor_user_id'] ?? 0);
|
|
if ($actorUserId <= 0) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
if (!$this->permissionService->userHas($actorUserId, self::PERMISSION_KEY)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
}
|