2018-09-25 13:30:50 +02:00
|
|
|
<?php namespace BookStack\Auth\Permissions;
|
2016-03-02 23:35:01 +01:00
|
|
|
|
2020-11-20 19:53:01 +01:00
|
|
|
use BookStack\Actions\ActivityType;
|
2018-09-25 13:30:50 +02:00
|
|
|
use BookStack\Auth\Role;
|
2018-09-25 17:58:03 +02:00
|
|
|
use BookStack\Exceptions\PermissionsException;
|
2020-11-20 19:53:01 +01:00
|
|
|
use BookStack\Facades\Activity;
|
2020-08-04 15:55:01 +02:00
|
|
|
use Exception;
|
|
|
|
use Illuminate\Database\Eloquent\Collection;
|
2016-03-02 23:35:01 +01:00
|
|
|
|
|
|
|
class PermissionsRepo
|
|
|
|
{
|
|
|
|
|
|
|
|
protected $permission;
|
|
|
|
protected $role;
|
2016-05-01 22:20:50 +02:00
|
|
|
protected $permissionService;
|
2016-03-02 23:35:01 +01:00
|
|
|
|
2016-05-01 20:36:53 +02:00
|
|
|
protected $systemRoles = ['admin', 'public'];
|
|
|
|
|
2016-03-02 23:35:01 +01:00
|
|
|
/**
|
|
|
|
* PermissionsRepo constructor.
|
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function __construct(RolePermission $permission, Role $role, PermissionService $permissionService)
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
|
|
|
$this->permission = $permission;
|
|
|
|
$this->role = $role;
|
2016-05-01 22:20:50 +02:00
|
|
|
$this->permissionService = $permissionService;
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get all the user roles from the system.
|
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function getAllRoles(): Collection
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
2016-09-29 13:43:46 +02:00
|
|
|
return $this->role->all();
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get all the roles except for the provided one.
|
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function getAllRolesExcept(Role $role): Collection
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
2016-09-29 13:43:46 +02:00
|
|
|
return $this->role->where('id', '!=', $role->id)->get();
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Get a role via its ID.
|
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function getRoleById($id): Role
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
2020-08-04 15:55:01 +02:00
|
|
|
return $this->role->newQuery()->findOrFail($id);
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Save a new role into the system.
|
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function saveNewRole(array $roleData): Role
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
|
|
|
$role = $this->role->newInstance($roleData);
|
|
|
|
$role->save();
|
|
|
|
|
|
|
|
$permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
|
|
|
|
$this->assignRolePermissions($role, $permissions);
|
2016-05-01 22:20:50 +02:00
|
|
|
$this->permissionService->buildJointPermissionForRole($role);
|
2020-11-20 19:53:01 +01:00
|
|
|
Activity::add(ActivityType::ROLE_CREATE, $role);
|
2016-03-02 23:35:01 +01:00
|
|
|
return $role;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Updates an existing role.
|
2018-09-20 20:48:08 +02:00
|
|
|
* Ensure Admin role always have core permissions.
|
2016-03-02 23:35:01 +01:00
|
|
|
*/
|
2020-08-04 15:55:01 +02:00
|
|
|
public function updateRole($roleId, array $roleData)
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
2020-08-04 15:55:01 +02:00
|
|
|
/** @var Role $role */
|
|
|
|
$role = $this->role->newQuery()->findOrFail($roleId);
|
2016-05-01 20:36:53 +02:00
|
|
|
|
2016-03-02 23:35:01 +01:00
|
|
|
$permissions = isset($roleData['permissions']) ? array_keys($roleData['permissions']) : [];
|
2017-01-22 13:16:02 +01:00
|
|
|
if ($role->system_name === 'admin') {
|
2018-09-20 20:48:08 +02:00
|
|
|
$permissions = array_merge($permissions, [
|
|
|
|
'users-manage',
|
|
|
|
'user-roles-manage',
|
|
|
|
'restrictions-manage-all',
|
|
|
|
'restrictions-manage-own',
|
|
|
|
'settings-manage',
|
|
|
|
]);
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
2018-09-20 20:48:08 +02:00
|
|
|
$this->assignRolePermissions($role, $permissions);
|
|
|
|
|
2016-03-02 23:35:01 +01:00
|
|
|
$role->fill($roleData);
|
|
|
|
$role->save();
|
2016-05-01 22:20:50 +02:00
|
|
|
$this->permissionService->buildJointPermissionForRole($role);
|
2020-11-20 19:53:01 +01:00
|
|
|
Activity::add(ActivityType::ROLE_UPDATE, $role);
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Assign an list of permission names to an role.
|
|
|
|
*/
|
2020-11-20 19:53:01 +01:00
|
|
|
protected function assignRolePermissions(Role $role, array $permissionNameArray = [])
|
2016-03-02 23:35:01 +01:00
|
|
|
{
|
|
|
|
$permissions = [];
|
2016-03-05 13:09:09 +01:00
|
|
|
$permissionNameArray = array_values($permissionNameArray);
|
2020-08-04 15:55:01 +02:00
|
|
|
|
|
|
|
if ($permissionNameArray) {
|
|
|
|
$permissions = $this->permission->newQuery()
|
|
|
|
->whereIn('name', $permissionNameArray)
|
|
|
|
->pluck('id')
|
|
|
|
->toArray();
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
2020-08-04 15:55:01 +02:00
|
|
|
|
2016-03-02 23:35:01 +01:00
|
|
|
$role->permissions()->sync($permissions);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Delete a role from the system.
|
|
|
|
* Check it's not an admin role or set as default before deleting.
|
|
|
|
* If an migration Role ID is specified the users assign to the current role
|
|
|
|
* will be added to the role of the specified id.
|
|
|
|
* @throws PermissionsException
|
2020-08-04 15:55:01 +02:00
|
|
|
* @throws Exception
|
2016-03-02 23:35:01 +01:00
|
|
|
*/
|
|
|
|
public function deleteRole($roleId, $migrateRoleId)
|
|
|
|
{
|
2020-08-04 15:55:01 +02:00
|
|
|
/** @var Role $role */
|
|
|
|
$role = $this->role->newQuery()->findOrFail($roleId);
|
2016-03-02 23:35:01 +01:00
|
|
|
|
|
|
|
// Prevent deleting admin role or default registration role.
|
2016-05-01 20:36:53 +02:00
|
|
|
if ($role->system_name && in_array($role->system_name, $this->systemRoles)) {
|
2016-12-04 17:51:39 +01:00
|
|
|
throw new PermissionsException(trans('errors.role_system_cannot_be_deleted'));
|
2019-09-16 00:28:23 +02:00
|
|
|
} else if ($role->id === intval(setting('registration-role'))) {
|
2016-12-04 17:51:39 +01:00
|
|
|
throw new PermissionsException(trans('errors.role_registration_default_cannot_delete'));
|
2016-03-02 23:35:01 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if ($migrateRoleId) {
|
2020-08-04 15:55:01 +02:00
|
|
|
$newRole = $this->role->newQuery()->find($migrateRoleId);
|
2016-03-02 23:35:01 +01:00
|
|
|
if ($newRole) {
|
2020-08-04 15:55:01 +02:00
|
|
|
$users = $role->users()->pluck('id')->toArray();
|
2016-03-02 23:35:01 +01:00
|
|
|
$newRole->users()->sync($users);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-05-01 22:20:50 +02:00
|
|
|
$this->permissionService->deleteJointPermissionsForRole($role);
|
2020-11-20 19:53:01 +01:00
|
|
|
Activity::add(ActivityType::ROLE_DELETE, $role);
|
2016-03-02 23:35:01 +01:00
|
|
|
$role->delete();
|
|
|
|
}
|
2018-01-28 17:58:52 +01:00
|
|
|
}
|