fluent-support / app / Http / Policies / PortalPolicy.php

PortalPolicy.php in Fluent Support – Helpdesk & Customer Support Ticket System 2.4.5, at app/Http/Policies/PortalPolicy.php

149 lines 4.7 KB

Raw Download Zip

1	<?php
2
3	namespace FluentSupport\App\Http\Policies;
4
5	use FluentSupport\App\Models\Ticket;
6	use FluentSupport\App\Modules\PermissionManager;
7	use FluentSupport\App\Services\Helper;
8	use FluentSupport\Framework\Http\Request\Request;
9	use FluentSupport\Framework\Foundation\Policy;
10
11	class PortalPolicy extends Policy
12	{
13	/**
14	* Whether the current user may act on_behalf of a customer. See verifyRequest().
15	*
16	* @return bool
17	*/
18	public static function canActOnBehalf()
19	{
20	return current_user_can('manage_options') \|\| (
21	PermissionManager::userCan('fst_sensitive_data')
22	&& PermissionManager::userCan('fst_manage_other_tickets')
23	&& PermissionManager::userCan('fst_manage_settings')
24	&& Helper::getAgentByUserId()
25	);
26	}
27
28	/**
29	* @param \FluentSupport\Framework\Http\Request\Request $request
30	* @return Boolean
31	*/
32	public function verifyRequest(Request $request)
33	{
34	// on_behalf lets a remote API client act as a customer: a site admin (who need not
35	// be an agent), or a senior agent who manages customers, all tickets and settings. An agent is
36	// still held to their own ticket access in CustomerPortalService::getCustomer().
37	// The agent record is required because mailbox restrictions live on it; leftover
38	// permission meta without one would otherwise carry no restrictions at all.
39	if ($request->get('on_behalf')) {
40	return self::canActOnBehalf();
41	}
42
43	$hasAccess = !!get_current_user_id();
44
45	if (!$hasAccess) {
46	return false;
47	}
48
49	/*
50	* Filter portal access settings
51	*
52	* @since v1.0.0
53	* @param array $canAccess
54	*/
55	$canAccess = apply_filters('fluent_support/user_portal_access_config', [
56	'status' => true,
57	'message' => __('You do not have permission', 'fluent-support')
58	]);
59
60	return $canAccess['status'];
61	}
62
63	/**
64	* @param \FluentSupport\Framework\Http\Request\Request $request
65	* @return Boolean
66	*/
67	public function getTicket(Request $request)
68	{
69	return $this->maybePublicSignedRequest($request);
70	}
71
72	public function createResponse(Request $request)
73	{
74	return $this->maybePublicSignedRequest($request);
75	}
76
77	public function closeTicket(Request $request)
78	{
79	return $this->maybePublicSignedRequest($request);
80	}
81
82	public function reOpenTicket(Request $request)
83	{
84	return $this->maybePublicSignedRequest($request);
85	}
86
87	/**
88	* Agents need a write capability here: the ticket ones mirror createResponse(),
89	* the settings pair covers the editor's paste-to-upload.
90	*
91	* @param \FluentSupport\Framework\Http\Request\Request $request
92	* @return Boolean
93	*/
94	public function uploadTicketFiles(Request $request)
95	{
96	// An on_behalf upload can create or update a customer, so it needs the same
97	// rights as every other on_behalf portal call, not just upload rights.
98	if ($request->get('on_behalf')) {
99	return self::canActOnBehalf();
100	}
101
102	if (Helper::getCurrentAgent()) {
103	return PermissionManager::canManageTickets()
104	\|\| PermissionManager::userCan([
105	'fst_draft_reply',
106	'fst_manage_settings',
107	'fst_manage_saved_replies'
108	]);
109	}
110
111	return $this->maybePublicSignedRequest($request);
112	}
113
114	public function getCountries(Request $request)
115	{
116	if ($person = Helper::getCurrentAgent()) {
117	return true;
118	}
119
120	return $this->maybePublicSignedRequest($request);
121	}
122
123	/**
124	* @param \FluentSupport\Framework\Http\Request\Request $request
125	* @return Boolean
126	*/
127	protected function maybePublicSignedRequest($request)
128	{
129	$ticketHash = $request->getSafe('intended_ticket_hash', 'sanitize_text_field');
130
131	if ($ticketHash && Helper::isPublicSignedTicketEnabled()) {
132	$urlParams = (array) $request->get_url_params();
133	$ticketId = isset($urlParams['ticket_id']) ? (int) $urlParams['ticket_id'] : $request->getSafe('ticket_id', 'intval');
134	return !!Ticket::where('hash', $ticketHash)
135	->wherePublicIdentifier($ticketId)
136	->first();
137	}
138
139	// With signed links off, a hash only comes from a remote portal relaying an
140	// anonymous visitor. Falling through would make them the API user's customer.
141	if ($ticketHash && !$request->get('on_behalf') && self::canActOnBehalf()) {
142	return false;
143	}
144
145	return $this->verifyRequest($request);
146	}
147
148	}
149