fluent-boards / app / Services / PermissionManager.php

PermissionManager.php in FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration trunk, at app/Services/PermissionManager.php

439 lines 12.1 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBoards\App\Services;
4
5	use FluentBoards\App\Models\Board;
6	use FluentBoards\App\Models\Relation;
7	use FluentBoards\App\Models\Meta;
8	use FluentBoards\App\Services\Constant;
9
10	class PermissionManager
11	{
12	public static function getFormattedBoardPermissions()
13	{
14	return [
15	'board_admin' => 'Board Admin',
16	'create_tasks' => 'Create Tasks',
17	'edit_tasks' => 'Edit Tasks',
18	'delete_tasks' => 'Delete Tasks',
19	];
20	}
21
22	public static function getTopLevelPermissions()
23	{
24	return [
25	'all_board_admin' => 'All Board Admin',
26	'create_boards' => 'Create Boards',
27	'edit_boards' => 'Edit Boards',
28	'delete_boards' => 'Delete Boards',
29	'can_manage_permissions' => 'Can Manage Permissions',
30	];
31	}
32
33	public static function getBoardPermissions($boardId, $userId)
34	{
35	if (user_can($userId, 'manage_options')) {
36	return array_keys(self::getFormattedBoardPermissions());
37	}
38
39	$globalPermissions = self::getTopUserPermission($userId);
40
41	if (in_array('all_board_admin', $globalPermissions)) {
42	return array_keys(self::getFormattedBoardPermissions());
43	}
44
45	// The user does not have global permission now we are checking for board permission
46
47	$isUserOn = Relation::query()->where('board_id', $boardId)->where('user_id', $userId)->exists();
48
49	$permissions = [
50
51	];
52
53	if (in_array('board_admin', $permissions)) {
54	return array_keys(self::getFormattedBoardPermissions());
55	}
56
57	return $permissions;
58	}
59
60	private static function getTopUserPermission($userId)
61	{
62	$allAccesses = ['all_board_admin'];
63
64	$userPermission = ['create_boards', 'edit_boards', 'delete_boards', 'can_manage_permissions'];
65
66	return array_intersect($allAccesses, $userPermission);
67	}
68
69	public static function userHasBoardAccess($boardId, $userId = null, $permissions = [])
70	{
71	if (!$userId) {
72	$userId = get_current_user_id();
73	}
74
75	if (!$userId) {
76	return false;
77	}
78
79	$userPermissions = self::getBoardPermissions($boardId, $userId);
80
81	if (!$permissions) {
82	return false;
83	}
84
85	return (bool)array_intersect($permissions, $userPermissions);
86	}
87
88	public static function isBoardManager($boardId, $userId = null, $useCache = false)
89	{
90	if (!$userId) {
91	$userId = get_current_user_id();
92	if (!$userId) {
93	return false;
94	}
95	}
96
97	if (static::isAdmin($userId, $useCache)) {
98	return true;
99	}
100
101	$boardUser = Relation::where('object_id', $boardId)
102	->where('foreign_id', $userId)
103	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
104	->first();
105
106	if (!$boardUser) {
107	return false;
108	}
109
110	return (bool)($boardUser->settings[Constant::IS_BOARD_ADMIN] ?? false);
111
112	}
113
114	public static function userHasAnyBoardAccess($userId = null): bool
115	{
116	if (!$userId) {
117	$userId = get_current_user_id();
118	}
119
120	if (!$userId) {
121	return false;
122	}
123
124	if (static::isAdmin($userId)) {
125	return true;
126	}
127
128	return Relation::where('foreign_id', $userId)
129	->where('object_type', 'board_user')
130	->exists();
131	}
132
133	/// this is function currently being used , we will go permission way next time
134	public static function userHasPermission($boardId, $userId = null)
135	{
136	if (!$userId) {
137	$userId = get_current_user_id();
138	if (!$userId) {
139	return false;
140	}
141	}
142
143	// if boardId is not provided then we will return false
144	if (!$boardId) {
145	return false;
146	}
147
148	if (static::isAdmin($userId)) {
149	return true; // if task some admin we will allow him.
150	}
151
152
153	/* now, if user is board admin or board member then will allow him */
154	return Relation::where('object_id', $boardId)
155	->where('foreign_id', $userId)
156	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
157	->exists();
158	}
159
160	public static function isFluentBoardsAdmin($userId = null): bool
161	{
162	if (!$userId) {
163	$userId = get_current_user_id();
164	if (!$userId) {
165	return false;
166	}
167	}
168
169	$isExists = (bool)Meta::where('object_id', $userId)
170	->where('object_type', Constant::FLUENT_BOARD_ADMIN)
171	->exists();
172
173	if (!$isExists) {
174	return false;
175	}
176
177	return true;
178	}
179
180	public static function isFluentBoardsUser($userId = null): bool
181	{
182	if (!$userId) {
183	$userId = get_current_user_id();
184	if (!$userId) {
185	return false;
186	}
187	}
188
189	if (static::isAdmin($userId)) { // boardAdmin is super admin and this function returns if loggedUser is task superadmin or not.
190	return true; // if board super admin we will allow him.
191	}
192
193	$isExists = (bool)Relation::where('foreign_id', $userId)
194	->whereNotNull('object_id')
195	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
196	->exists();
197	if (!$isExists) {
198	return false;
199	}
200
201	return true;
202	}
203
204	public static function userCanAccessMemberProfile($targetUserId, $userId = null): bool
205	{
206	$targetUserId = intval($targetUserId);
207
208	if (!$userId) {
209	$userId = get_current_user_id();
210	}
211
212	$userId = intval($userId);
213
214	if (!$targetUserId \|\| !$userId) {
215	return false;
216	}
217
218	if ($userId === $targetUserId \|\| static::isAdmin($userId)) {
219	return true;
220	}
221
222	if (!static::isFluentBoardsUser($targetUserId)) {
223	return false;
224	}
225
226	$boardIds = Relation::where('foreign_id', $userId)
227	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
228	->pluck('object_id')
229	->toArray();
230
231	if (empty($boardIds)) {
232	return false;
233	}
234
235	return Relation::where('foreign_id', $targetUserId)
236	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
237	->whereIn('object_id', $boardIds)
238	->exists();
239	}
240
241	public static function isAdmin($userId = null, $useCache = true)
242	{
243
244	static $cache = [];
245
246	if (isset($cache[$userId]) && $useCache) {
247	return $cache[$userId];
248	}
249
250	/*
251	* Two types of admin we have
252	* 1. WordPress admin
253	* 2. FluentBoard admin
254	* if user is WordPress admin then we will allow him
255	* if user is FluentBoard admin then we will allow him
256	*/
257
258	if (!$userId) {
259	$userId = get_current_user_id();
260	if (!$userId) {
261	return false;
262	}
263	}
264
265	if (!$userId) {
266	return false;
267	}
268
269	if (user_can($userId, 'manage_options')) { // WordPress Administrator
270
271	$cache[$userId] = true;
272
273	return true;
274	}
275
276	if (static::isFluentBoardsAdmin($userId)) { // FluentBoard Plugin Administrator
277	$cache[$userId] = true;
278	return true;
279	}
280
281	$cache[$userId] = false;
282	return false;
283	}
284
285	/**
286	* Get array of board Ids for logged-in user
287	* @param int $userId
288	* @return array
289	*/
290	public static function getBoardIdsForUser($userId = null, $boardId = null)
291	{
292	if (!$userId) {
293	$userId = get_current_user_id();
294	if (!$userId) {
295	return [];
296	}
297	}
298
299	if (static::isAdmin($userId)) {
300	if ($boardId) {
301	return Board::where('archived_at', null)->where('id', $boardId)->pluck('id')->toArray();
302	}
303	return Board::where('archived_at', null)->pluck('id')->toArray();
304	}
305
306	return Relation::where('foreign_id', $userId)
307	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
308	->pluck('object_id')->toArray();
309	}
310
311	public static function getTaskIdsWatchByUser($userId = null)
312	{
313	if (!$userId) {
314	$userId = get_current_user_id();
315	if (!$userId) {
316	return [];
317	}
318	}
319
320	return Relation::where('foreign_id', $userId)
321	->where('object_type', Constant::OBJECT_TYPE_USER_TASK_WATCH)
322	->pluck('object_id')->toArray();
323	}
324
325	public static function userCan($permission, $userId = null)
326	{
327	if (!$userId) {
328	$userId = get_current_user_id();
329	if (!$userId) {
330	return false;
331	}
332	}
333
334	if (static::isAdmin($userId)) {
335	return true;
336	}
337	// if user has edit_posts capability then we will allow him
338	if (user_can($userId, 'edit_posts')) {
339	return true;
340	}
341	}
342
343	public static function hasAppAccess($userId = null)
344	{
345	return !!is_user_logged_in();
346	}
347
348	public static function getAll_WP_Admins($searchquery = '', $number = null)
349	{
350	$args = array(
351	'role' => '',
352	'capability' => 'manage_options',
353	'search' => '' . $searchquery . '',
354	);
355
356	// Optionally bound the result set (e.g. for selector popovers) so an
357	// empty search can't serialize every admin-capable user on large sites.
358	if ($number !== null) {
359	$args['number'] = (int) $number;
360	}
361
362	return get_users($args);
363	}
364
365	public static function isWPAdmin($userId = null)
366	{
367	if (!$userId) {
368	$userId = get_current_user_id();
369	if (!$userId) {
370	return false;
371	}
372	}
373
374	return user_can($userId, 'manage_options');
375	}
376
377	public static function userHasBoardPermission($boardId, $requestMethod, $userId = null)
378	{
379	// Get the current user if no user ID is provided
380	if (!$userId) {
381	$userId = get_current_user_id();
382	if (!$userId) {
383	return false; // Return false if no user is logged in
384	}
385	}
386
387	// Ensure the board ID is valid
388	if (!$boardId) {
389	return false; // Return false if no board ID is provided
390	}
391
392	// Admins have full permissions, allow access immediately
393	if (static::isAdmin($userId)) {
394	return true;
395	}
396
397	// Fetch user permissions for the given board
398	$boardPermissions = Relation::where('object_id', $boardId)
399	->where('foreign_id', $userId)
400	->where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
401	->first();
402
403	// If no permissions are found, deny access
404	if (!$boardPermissions) {
405	return false;
406	}
407
408	// Allow read-only access for GET requests
409	if ($requestMethod === 'GET') {
410	return true;
411	}
412
413	// Deny access if the user is a viewer only and trying to modify data
414	return !($boardPermissions->settings['is_viewer_only'] ?? false);
415	}
416
417	public static function userHasBoardCreationPermission($userId = null)
418	{
419	if (!$userId) {
420	$userId = get_current_user_id();
421	if (!$userId) {
422	return false;
423	}
424	}
425
426	if (static::isAdmin($userId)) {
427	return apply_filters('fluent_boards/can_create_board', true, $userId);
428	}
429
430	// Check if "allow members to create boards" setting is enabled
431	$generalSettings = fluent_boards_get_option('general_settings', []);
432	if (!empty($generalSettings['allow_members_to_create_boards']) && $generalSettings['allow_members_to_create_boards'] !== 'false' && static::userHasAnyBoardAccess($userId)) {
433	return apply_filters('fluent_boards/can_create_board', true, $userId);
434	}
435
436	return apply_filters('fluent_boards/can_create_board', false, $userId);
437	}
438	}
439