| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentForm\App\Services\Manager; |
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
class FormManagerService |
| 8 |
{ |
| 9 |
private static function normalizeFormIds($formIds) |
| 10 |
{ |
| 11 |
$formIds = is_array($formIds) ? $formIds : [$formIds]; |
| 12 |
$resolvedFormIds = []; |
| 13 |
|
| 14 |
foreach ($formIds as $formId) { |
| 15 |
if (is_string($formId)) { |
| 16 |
$formId = trim($formId); |
| 17 |
} |
| 18 |
|
| 19 |
if (!is_int($formId) && (!is_string($formId) || !ctype_digit($formId))) { |
| 20 |
return []; |
| 21 |
} |
| 22 |
|
| 23 |
$formId = (int) $formId; |
| 24 |
|
| 25 |
if ($formId <= 0) { |
| 26 |
return []; |
| 27 |
} |
| 28 |
|
| 29 |
$resolvedFormIds[] = $formId; |
| 30 |
} |
| 31 |
|
| 32 |
return array_values(array_unique($resolvedFormIds)); |
| 33 |
} |
| 34 |
|
| 35 |
public static function maybeAddUserAllowedFormIds($formId) |
| 36 |
{ |
| 37 |
if (false !== ($allowFormIds = self::getUserAllowedFormsScope())) { |
| 38 |
$allowFormIds[] = $formId; |
| 39 |
self::addUserAllowedForms($allowFormIds); |
| 40 |
} |
| 41 |
} |
| 42 |
|
| 43 |
public static function addUserAllowedForms($formIds, $userId = false) |
| 44 |
{ |
| 45 |
if (!$userId) { |
| 46 |
$userId = get_current_user_id(); |
| 47 |
} |
| 48 |
if ($userId) { |
| 49 |
$formIds = array_filter(array_map('intval', $formIds)); |
| 50 |
update_user_meta($userId, '_fluent_forms_allowed_forms', $formIds); |
| 51 |
} |
| 52 |
} |
| 53 |
|
| 54 |
public static function deleteUserAllowedForms($userId = false) |
| 55 |
{ |
| 56 |
if (!$userId) { |
| 57 |
$userId = get_current_user_id(); |
| 58 |
} |
| 59 |
|
| 60 |
if ($userId) { |
| 61 |
delete_user_meta($userId, '_fluent_forms_allowed_forms'); |
| 62 |
} |
| 63 |
} |
| 64 |
|
| 65 |
public static function updateHasSpecificFormsPermission($userId, $status) |
| 66 |
{ |
| 67 |
if (in_array($status, ['no', 'yes'])) { |
| 68 |
update_user_meta($userId, '_fluent_forms_has_specific_forms_permission', $status); |
| 69 |
} |
| 70 |
} |
| 71 |
|
| 72 |
public static function hasSpecificFormsPermission($userId) |
| 73 |
{ |
| 74 |
$hasFormsPermission = get_user_meta($userId, '_fluent_forms_has_specific_forms_permission', true); |
| 75 |
return 'yes' === $hasFormsPermission; |
| 76 |
} |
| 77 |
|
| 78 |
/** |
| 79 |
* Return the raw stored allowed-form ids for a user. |
| 80 |
* |
| 81 |
* This legacy helper returns `false` for unrestricted users and the stored |
| 82 |
* ids for specific-form managers. Because an empty array is falsey in PHP, |
| 83 |
* callers that need to distinguish "unrestricted" from "restricted to no |
| 84 |
* forms" should use getUserAllowedFormsScope() instead. |
| 85 |
* |
| 86 |
* @param string|int|false $userId Optional. Current user is used when omitted. |
| 87 |
* @return array<int>|false |
| 88 |
*/ |
| 89 |
public static function getUserAllowedForms($userId = false) |
| 90 |
{ |
| 91 |
if (!$userId) { |
| 92 |
$userId = get_current_user_id(); |
| 93 |
} |
| 94 |
if ($userId && self::hasSpecificFormsPermission($userId)) { |
| 95 |
$formIds = get_user_meta($userId, '_fluent_forms_allowed_forms', true); |
| 96 |
if (is_array($formIds)) { |
| 97 |
return array_filter(array_map('intval', $formIds)); |
| 98 |
} |
| 99 |
} |
| 100 |
return false; |
| 101 |
} |
| 102 |
|
| 103 |
/** |
| 104 |
* Return the effective form scope for the current user's permissions. |
| 105 |
* |
| 106 |
* - `false`: the user is unrestricted |
| 107 |
* - `[]`: the user is restricted to specific forms but none are assigned |
| 108 |
* - `[ids...]`: the user is restricted to the listed forms |
| 109 |
* |
| 110 |
* Use this helper for ACL-sensitive queries so zero assigned forms produce |
| 111 |
* an empty result set instead of falling back to unrestricted access. |
| 112 |
* |
| 113 |
* @param string|int|false $userId Optional. Current user is used when omitted. |
| 114 |
* @return array<int>|false |
| 115 |
*/ |
| 116 |
public static function getUserAllowedFormsScope($userId = false) |
| 117 |
{ |
| 118 |
if (!$userId) { |
| 119 |
$userId = get_current_user_id(); |
| 120 |
} |
| 121 |
|
| 122 |
if (!$userId || !self::hasSpecificFormsPermission($userId)) { |
| 123 |
return false; |
| 124 |
} |
| 125 |
|
| 126 |
$formIds = self::getUserAllowedForms($userId); |
| 127 |
|
| 128 |
return is_array($formIds) ? array_values($formIds) : []; |
| 129 |
} |
| 130 |
|
| 131 |
public static function hasFormPermission($formId) |
| 132 |
{ |
| 133 |
// Use the scoped helper here so "specific forms" managers with zero |
| 134 |
// assignments do not accidentally pass this permission check. |
| 135 |
if ($formId && false !== ($allowedForm = self::getUserAllowedFormsScope())) { |
| 136 |
$formIds = self::normalizeFormIds($formId); |
| 137 |
|
| 138 |
if (!$formIds) { |
| 139 |
return false; |
| 140 |
} |
| 141 |
|
| 142 |
return !array_diff($formIds, $allowedForm); |
| 143 |
} |
| 144 |
|
| 145 |
return true; |
| 146 |
} |
| 147 |
} |
| 148 |
|
