ivyforms / backend / src / Services / Permissions / AdminFormListPermissionService.php

AdminFormListPermissionService.php in The Innovative Form Builder – IvyForms 1.5.1, at backend/src/Services/Permissions/AdminFormListPermissionService.php

126 lines 3.1 KB

Raw Download Zip

1	<?php
2
3	/**
4	* @copyright © Melograno Venture Studio. All rights reserved.
5	*/
6
7	namespace IvyForms\Services\Permissions;
8
9	// phpcs:disable PSR1.Files.SideEffects
10	if (!defined('ABSPATH')) {
11	exit;
12	}
13
14	use WP_User;
15
16	/**
17	* Which forms appear in admin lists for the current user (All Forms, search, GET form).
18	*/
19	final class AdminFormListPermissionService
20	{
21	private PermissionResolver $permissionResolver;
22
23	public function __construct(PermissionResolver $permissionResolver)
24	{
25	$this->permissionResolver = $permissionResolver;
26	}
27
28	/**
29	* Forms-list visibility is strictly forms permissions. Entries grants do NOT expose the
30	* All Forms list; entry-only delegates use the entries-scoped form source instead
31	* (see filterFormIdsVisibleInEntryLists()).
32	*/
33	public function canAccessFormInAdminLists(int $formId): bool
34	{
35	if (IvyFormsAccess::hasImplicitElevatedAccess()) {
36	return true;
37	}
38
39	$user = wp_get_current_user();
40	if (!$user instanceof WP_User \|\| (int) $user->ID <= 0) {
41	return false;
42	}
43
44	if (user_can($user, IvyFormsAccess::CAP_MANAGE_ALL)) {
45	return true;
46	}
47
48	$grants = $this->permissionResolver->effectiveGrants($user, $formId);
49
50	return self::grantsIncludeAny($grants, [
51	'view_forms_list',
52	'add_edit_forms',
53	'delete_forms',
54	]);
55	}
56
57	/**
58	* @param list<int> $allFormIds
59	* @return list<int>
60	*/
61	public function filterFormIdsVisibleInAdminLists(array $allFormIds): array
62	{
63	$out = [];
64	foreach ($allFormIds as $fid) {
65	$fid = (int) $fid;
66	if ($fid <= 0) {
67	continue;
68	}
69	if ($this->canAccessFormInAdminLists($fid)) {
70	$out[] = $fid;
71	}
72	}
73
74	return array_values(array_unique($out));
75	}
76
77	/**
78	* @param list<int> $allFormIds
79	* @return list<int>
80	*/
81	public function filterFormIdsVisibleInEntryLists(array $allFormIds): array
82	{
83	if (IvyFormsAccess::hasImplicitElevatedAccess()) {
84	return $allFormIds;
85	}
86
87	$user = wp_get_current_user();
88	if (!$user instanceof WP_User \|\| (int) $user->ID <= 0) {
89	return [];
90	}
91
92	if (user_can($user, IvyFormsAccess::CAP_MANAGE_ALL)) {
93	return $allFormIds;
94	}
95
96	$out = [];
97	foreach ($allFormIds as $fid) {
98	$fid = (int) $fid;
99	if ($fid <= 0) {
100	continue;
101	}
102	$grants = $this->permissionResolver->effectiveGrants($user, $fid);
103	if (self::grantsIncludeAny($grants, ['view_entries_admin', 'delete_entries_admin'])) {
104	$out[] = $fid;
105	}
106	}
107
108	return array_values(array_unique($out));
109	}
110
111	/**
112	* @param list<string> $grants
113	* @param list<string> $keys
114	*/
115	private static function grantsIncludeAny(array $grants, array $keys): bool
116	{
117	foreach ($keys as $key) {
118	if (in_array($key, $grants, true)) {
119	return true;
120	}
121	}
122
123	return false;
124	}
125	}
126