web-base/Core/API/PermissionAPI.class.php

212 lines
6.7 KiB
PHP
Raw Normal View History

2020-06-27 01:18:10 +02:00
<?php
2022-11-18 18:06:46 +01:00
namespace Core\API {
2020-06-27 01:18:10 +02:00
2022-11-18 18:06:46 +01:00
use Core\Objects\Context;
2022-11-20 17:13:53 +01:00
use Core\Objects\DatabaseEntity\Group;
2022-06-20 19:52:31 +02:00
2020-07-01 21:10:25 +02:00
abstract class PermissionAPI extends Request {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false, array $params = array()) {
parent::__construct($context, $externalCall, $params);
}
2021-11-11 14:25:26 +01:00
protected function checkStaticPermission(): bool {
2022-06-20 19:52:31 +02:00
$user = $this->context->getUser();
2022-11-20 17:13:53 +01:00
if (!$user || !$user->hasGroup(Group::ADMIN)) {
2020-06-27 01:18:10 +02:00
return $this->createError("Permission denied.");
}
return true;
}
}
}
2022-11-18 18:06:46 +01:00
namespace Core\API\Permission {
use Core\API\Parameter\Parameter;
use Core\API\Parameter\StringType;
use Core\API\PermissionAPI;
use Core\Driver\SQL\Column\Column;
use Core\Driver\SQL\Condition\CondIn;
use Core\Driver\SQL\Condition\CondLike;
use Core\Driver\SQL\Condition\CondNot;
2023-01-16 21:47:23 +01:00
use Core\Driver\SQL\Query\Insert;
2022-11-18 18:06:46 +01:00
use Core\Driver\SQL\Strategy\UpdateStrategy;
use Core\Objects\Context;
use Core\Objects\DatabaseEntity\Group;
2020-06-27 01:18:10 +02:00
class Check extends PermissionAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-27 01:18:10 +02:00
'method' => new StringType('method', 323)
));
$this->isPublic = false;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-27 01:18:10 +02:00
$method = $this->getParam("method");
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2020-06-27 01:18:10 +02:00
$res = $sql->select("groups")
->from("ApiPermission")
2021-11-11 14:25:26 +01:00
->where(new CondLike($method, new Column("method")))
2020-06-27 01:18:10 +02:00
->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
if ($this->success) {
2021-11-11 14:25:26 +01:00
if (empty($res) || !is_array($res)) {
2020-06-27 01:18:10 +02:00
return true;
}
$groups = json_decode($res[0]["groups"]);
if (empty($groups)) {
return true;
}
2022-06-20 19:52:31 +02:00
$currentUser = $this->context->getUser();
$userGroups = $currentUser ? $currentUser->getGroups() : [];
if (empty($userGroups) || empty(array_intersect($groups, array_keys($userGroups)))) {
2021-12-08 16:53:43 +01:00
http_response_code(401);
2020-06-27 01:18:10 +02:00
return $this->createError("Permission denied.");
}
2023-01-16 21:47:23 +01:00
// user would have required groups, check for 2fa-state
if ($currentUser && !$this->check2FA()) {
http_response_code(401);
return false;
2023-01-16 21:47:23 +01:00
}
2020-06-27 01:18:10 +02:00
}
return $this->success;
}
}
class Fetch extends PermissionAPI {
2022-06-20 19:52:31 +02:00
private ?array $groups;
2020-06-27 01:18:10 +02:00
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array());
2020-06-27 01:18:10 +02:00
}
2022-06-20 19:52:31 +02:00
private function fetchGroups(): bool {
$sql = $this->context->getSQL();
$this->groups = Group::findAll($sql);
$this->success = ($this->groups !== FALSE);
2020-06-27 01:18:10 +02:00
$this->lastError = $sql->getLastError();
return $this->success;
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-27 01:18:10 +02:00
if (!$this->fetchGroups()) {
return false;
}
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2020-06-27 22:47:12 +02:00
$res = $sql->select("method", "groups", "description")
2020-06-27 01:18:10 +02:00
->from("ApiPermission")
->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
if ($this->success) {
$permissions = array();
foreach ($res as $row) {
$method = $row["method"];
2020-06-27 22:47:12 +02:00
$description = $row["description"];
2020-06-27 01:18:10 +02:00
$groups = json_decode($row["groups"]);
2020-06-27 22:47:12 +02:00
$permissions[] = array(
"method" => $method,
"groups" => $groups,
"description" => $description
);
2020-06-27 01:18:10 +02:00
}
$this->result["permissions"] = $permissions;
$this->result["groups"] = $this->groups;
}
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN], "Allows users to fetch API permissions");
}
2020-06-27 01:18:10 +02:00
}
class Save extends PermissionAPI {
2022-06-20 19:52:31 +02:00
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
2020-06-27 01:18:10 +02:00
'permissions' => new Parameter('permissions', Parameter::TYPE_ARRAY)
));
}
2022-02-21 13:01:03 +01:00
public function _execute(): bool {
2020-06-27 01:18:10 +02:00
if (!$this->checkStaticPermission()) {
return false;
}
2020-06-27 22:47:12 +02:00
$permissions = $this->getParam("permissions");
2022-06-20 19:52:31 +02:00
$sql = $this->context->getSQL();
2020-06-27 22:47:12 +02:00
$methodParam = new StringType('method', 32);
$groupsParam = new Parameter('groups', Parameter::TYPE_ARRAY);
$updateQuery = $sql->insert("ApiPermission", array("method", "groups"))
2022-06-20 19:52:31 +02:00
->onDuplicateKeyStrategy(new UpdateStrategy(array("method"), array("groups" => new Column("groups"))));
2020-06-27 22:47:12 +02:00
$insertedMethods = array();
2022-06-20 19:52:31 +02:00
foreach ($permissions as $permission) {
2020-06-27 22:47:12 +02:00
if (!is_array($permission)) {
return $this->createError("Invalid data type found in parameter: permissions, expected: object");
2022-06-20 19:52:31 +02:00
} else if (!isset($permission["method"]) || !array_key_exists("groups", $permission)) {
2020-06-27 22:47:12 +02:00
return $this->createError("Invalid object found in parameter: permissions, expected keys 'method' and 'groups'");
} else if (!$methodParam->parseParam($permission["method"])) {
$expectedType = $methodParam->getTypeName();
return $this->createError("Invalid data type found for attribute 'method', expected: $expectedType");
2022-06-20 19:52:31 +02:00
} else if (!$groupsParam->parseParam($permission["groups"])) {
2020-06-27 22:47:12 +02:00
$expectedType = $groupsParam->getTypeName();
return $this->createError("Invalid data type found for attribute 'groups', expected: $expectedType");
2022-06-20 19:52:31 +02:00
} else if (empty(trim($methodParam->value))) {
2020-06-27 22:47:12 +02:00
return $this->createError("Method cannot be empty.");
} else {
$method = $methodParam->value;
$groups = $groupsParam->value;
$updateQuery->addRow($method, $groups);
$insertedMethods[] = $method;
}
}
if (!empty($permissions)) {
$res = $updateQuery->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
}
if ($this->success) {
$res = $sql->delete("ApiPermission")
->whereEq("description", "") // only delete non default permissions
2021-12-08 16:53:43 +01:00
->where(new CondNot(new CondIn(new Column("method"), $insertedMethods)))
2020-06-27 22:47:12 +02:00
->execute();
2020-06-27 01:18:10 +02:00
2020-06-27 22:47:12 +02:00
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
}
2020-06-27 01:18:10 +02:00
return $this->success;
}
2023-01-16 21:47:23 +01:00
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(self::getEndpoint(), [Group::ADMIN],
"Allows users to modify API permissions. This is restricted to the administrator and cannot be changed");
}
2020-06-27 01:18:10 +02:00
}
}