forked from fa/breadcrumb-the-shire
fs
0e86925464
Rename the top-level lib/ directory to core/ so the project root immediately communicates which code is core platform and which lives in modules/. PHP namespaces (MintyPHP\*) are unchanged — only the Composer PSR-4 path mapping moves from lib/ to core/. Module-internal lib/ directories (modules/*/lib/) are untouched. Updated across the full stack: - composer.json PSR-4 mapping - bootstrap entry points (web/index.php, bin/*, tests/bootstrap.php) - tooling configs (phpstan.neon, phpunit.xml, php-cs-fixer) - 26 architecture contract tests - enforcement-policy, guard-catalog, quality-gates - all documentation (CLAUDE.md, README, 25 docs/, .agents/skills/) - bin/qa-extended.sh search paths - .claude/settings.local.json permission paths Workflow: .agents/runs/CORE-LIB-RENAME-001/ (Analyst → Planner → Executor → Code Review (4 findings fixed) → Security Review → Acceptance Test → Finalizer) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
69 lines
2.6 KiB
PHP
69 lines
2.6 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Service\Access;
|
|
|
|
class SettingsAuthorizationPolicy implements AuthorizationPolicyInterface
|
|
{
|
|
use AuthorizationPolicyContextTrait;
|
|
|
|
public const ABILITY_ADMIN_SETTINGS_VIEW = 'admin.settings.view';
|
|
public const ABILITY_ADMIN_SETTINGS_UPDATE = 'admin.settings.update';
|
|
public const ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE = 'admin.settings.branding.update';
|
|
public const ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE = 'admin.settings.tokens.revoke';
|
|
public const ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN = 'admin.settings.user_lifecycle.run';
|
|
|
|
public function __construct(
|
|
private readonly PermissionService $permissionService
|
|
) {
|
|
}
|
|
|
|
public function supports(string $ability): bool
|
|
{
|
|
return in_array($ability, [
|
|
self::ABILITY_ADMIN_SETTINGS_VIEW,
|
|
self::ABILITY_ADMIN_SETTINGS_UPDATE,
|
|
self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
|
|
self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
|
|
self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN,
|
|
], true);
|
|
}
|
|
|
|
public function authorize(string $ability, array $context = []): AuthorizationDecision
|
|
{
|
|
return match ($ability) {
|
|
self::ABILITY_ADMIN_SETTINGS_VIEW => $this->authorizeAdminSettingsView($context),
|
|
self::ABILITY_ADMIN_SETTINGS_UPDATE,
|
|
self::ABILITY_ADMIN_SETTINGS_BRANDING_UPDATE,
|
|
self::ABILITY_ADMIN_SETTINGS_TOKENS_REVOKE,
|
|
self::ABILITY_ADMIN_SETTINGS_USER_LIFECYCLE_RUN => $this->authorizeSettingsUpdatePermission($context),
|
|
default => AuthorizationDecision::deny(500, 'authorization_ability_not_supported'),
|
|
};
|
|
}
|
|
|
|
private function authorizeAdminSettingsView(array $context): AuthorizationDecision
|
|
{
|
|
$actorUserId = $this->actorUserId($context);
|
|
if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_VIEW)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
return AuthorizationDecision::allow([
|
|
'capabilities' => [
|
|
'can_view_page' => true,
|
|
'can_update_settings' => $this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE),
|
|
],
|
|
]);
|
|
}
|
|
|
|
private function authorizeSettingsUpdatePermission(array $context): AuthorizationDecision
|
|
{
|
|
$actorUserId = $this->actorUserId($context);
|
|
if (!$this->hasPermission($actorUserId, PermissionService::SETTINGS_UPDATE)) {
|
|
return AuthorizationDecision::deny(403, 'forbidden');
|
|
}
|
|
|
|
return AuthorizationDecision::allow();
|
|
}
|
|
|
|
}
|