fluent-support / app / Modules / MCP / Support / AbilityGuard.php

AbilityGuard.php in Fluent Support – Helpdesk & Customer Support Ticket System 2.4.0, at app/Modules/MCP/Support/AbilityGuard.php

97 lines 4.2 KB

Raw Download Zip

1	<?php
2
3	namespace FluentSupport\App\Modules\MCP\Support;
4
5	use FluentSupport\App\Modules\PermissionManager;
6
7	class AbilityGuard
8	{
9	const MANAGE_TICKET_CAPS = [
10	'fst_manage_own_tickets',
11	'fst_manage_unassigned_tickets',
12	'fst_manage_other_tickets',
13	];
14
15	/**
16	* Per-ability permission requirements.
17	*
18	* any_of — passes if the user holds at least one of the listed caps.
19	* all_of — every listed cap must be held individually.
20	*
21	* Both keys may be present; both must pass.
22	*/
23	private static function capabilities()
24	{
25	return [
26	'fluent-support/list-tickets' => ['any_of' => ['fst_view_tickets']],
27	'fluent-support/get-ticket' => ['any_of' => ['fst_view_tickets']],
28	'fluent-support/create-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
29	'fluent-support/reply-to-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
30	'fluent-support/close-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
31	'fluent-support/reopen-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
32	'fluent-support/update-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
33	'fluent-support/delete-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS, 'all_of' => ['fst_delete_tickets']],
34	'fluent-support/get-ticket-activity' => ['any_of' => ['fst_view_tickets']],
35	'fluent-support/merge-tickets' => ['any_of' => ['fst_merge_tickets']],
36	'fluent-support/add-internal-note' => ['any_of' => self::MANAGE_TICKET_CAPS],
37	'fluent-support/assign-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS, 'all_of' => ['fst_assign_agents']],
38	'fluent-support/tag-ticket' => ['any_of' => self::MANAGE_TICKET_CAPS],
39	'fluent-support/create-tag' => ['any_of' => self::MANAGE_TICKET_CAPS],
40	'fluent-support/get-customer-tickets' => ['any_of' => ['fst_sensitive_data']],
41	'fluent-support/get-support-context' => ['any_of' => ['fst_view_tickets']],
42	'fluent-support/list-saved-replies' => ['any_of' => ['fst_manage_saved_replies']],
43	'fluent-support/create-saved-reply' => ['any_of' => ['fst_manage_saved_replies']],
44	'fluent-support/update-saved-reply' => ['any_of' => ['fst_manage_saved_replies']],
45	'fluent-support/delete-saved-reply' => ['any_of' => ['fst_manage_saved_replies']],
46	'fluent-support/get-support-insights' => ['any_of' => ['fst_view_all_reports']],
47	'fluent-support/search-customers' => ['any_of' => ['fst_sensitive_data']],
48	'fluent-support/get-mentions' => ['any_of' => ['fst_view_tickets']],
49	'fluent-support/list-workflows' => ['any_of' => ['fst_manage_workflows']],
50	'fluent-support/bulk-action' => ['any_of' => self::MANAGE_TICKET_CAPS],
51	];
52	}
53
54	/**
55	* Returns a permission_callback closure for the given ability name.
56	*
57	* Only checks that the user is authenticated. Capability enforcement
58	* is deferred to wrapExecuteCallback() in AbilitiesRegistrar so that
59	* all denials — both auth and cap — return structured JSON via
60	* MCPHelper::error() rather than the adapter's plain "Permission denied".
61	*
62	* Fails closed for unknown abilities.
63	*/
64	public static function callbackFor($abilityName)
65	{
66	return function () use ($abilityName) {
67	if (!array_key_exists($abilityName, self::capabilities())) {
68	return false;
69	}
70	return is_user_logged_in();
71	};
72	}
73
74	public static function check($abilityName)
75	{
76	$caps = self::capabilities()[$abilityName] ?? null;
77
78	if ($caps === null) {
79	return false;
80	}
81
82	if (!empty($caps['any_of']) && !PermissionManager::userCan($caps['any_of'])) {
83	return false;
84	}
85
86	if (!empty($caps['all_of'])) {
87	foreach ($caps['all_of'] as $cap) {
88	if (!PermissionManager::currentUserCan($cap)) {
89	return false;
90	}
91	}
92	}
93
94	return true;
95	}
96	}
97