Projekte/web-base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bugfix, permission api rewrite

Browse Source
This commit is contained in:
Roman
2024-03-27 15:15:46 +01:00
parent ee638914a8
commit aa51380055
11 changed files with 365 additions and 182 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
Core/API/PermissionAPI.class.php
View File

@@ -12,6 +12,7 @@ namespace Core\API {
}
protected function checkStaticPermission(): bool {
// hardcoded permission checking
$user = $this->context->getUser();
if (!$user || !$user->hasGroup(Group::ADMIN)) {
return $this->createError("Permission denied.");
@@ -19,18 +20,21 @@ namespace Core\API {
return true;
}
protected function isRestricted(string $method): bool {
return in_array(strtolower($method), ["permission/update", "permission/delete"]);
}
}
}
namespace Core\API\Permission {
use Core\API\Parameter\ArrayType;
use Core\API\Parameter\Parameter;
use Core\API\Parameter\StringType;
use Core\API\PermissionAPI;
use Core\Driver\SQL\Column\Column;
use Core\Driver\SQL\Condition\CondIn;
use Core\Driver\SQL\Condition\CondLike;
use Core\Driver\SQL\Condition\CondNot;
use Core\Driver\SQL\Query\Insert;
use Core\Driver\SQL\Strategy\UpdateStrategy;
use Core\Objects\Context;
@@ -142,75 +146,51 @@ namespace Core\API\Permission {
}
}
class Save extends PermissionAPI {
class Update extends PermissionAPI {
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, array(
'permissions' => new Parameter('permissions', Parameter::TYPE_ARRAY)
));
parent::__construct($context, $externalCall, [
"method" => new StringType("method", 32, false),
"groups" => new ArrayType("groups", Parameter::TYPE_INT, true, false),
"description" => new StringType("description", 128, true, null),
]);
}
public function _execute(): bool {
protected function _execute(): bool {
if (!$this->checkStaticPermission()) {
return false;
}
$permissions = $this->getParam("permissions");
$sql = $this->context->getSQL();
$methodParam = new StringType('method', 32);
$groupsParam = new Parameter('groups', Parameter::TYPE_ARRAY);
$descriptionParam = new StringType('method', 128);
$method = $this->getParam("method");
$description = $this->getParam("description");
if ($this->isRestricted($method)) {
return $this->createError("This method cannot be updated.");
}
$updateQuery = $sql->insert("ApiPermission", ["method", "groups", "description"])
->onDuplicateKeyStrategy(new UpdateStrategy(["method"], [
"groups" => new Column("groups"),
"description" => new Column("description")
]));
$insertedMethods = array();
foreach ($permissions as $permission) {
if (!is_array($permission)) {
return $this->createError("Invalid data type found in parameter: permissions, expected: object");
} else if (!isset($permission["method"]) || !isset($permission["description"]) || !array_key_exists("groups", $permission)) {
return $this->createError("Invalid object found in parameter: permissions, expected keys: 'method', 'groups', 'description'");
} else if (!$methodParam->parseParam($permission["method"])) {
$expectedType = $methodParam->getTypeName();
return $this->createError("Invalid data type found for attribute 'method', expected: $expectedType");
} else if (!$groupsParam->parseParam($permission["groups"])) {
$expectedType = $groupsParam->getTypeName();
return $this->createError("Invalid data type found for attribute 'groups', expected: $expectedType");
} else if (!$descriptionParam->parseParam($permission["description"])) {
$expectedType = $descriptionParam->getTypeName();
return $this->createError("Invalid data type found for attribute 'description', expected: $expectedType");
} else if (empty(trim($methodParam->value))) {
return $this->createError("Method cannot be empty.");
} else {
$method = $methodParam->value;
$groups = $groupsParam->value;
$description = $descriptionParam->value;
$updateQuery->addRow($method, $groups, $description);
$insertedMethods[] = $method;
$groups = $this->getParam("groups");
if (!empty($groups)) {
sort($groups);
$availableGroups = Group::findAll($sql);
foreach ($groups as $groupId) {
if (!isset($availableGroups[$groupId])) {
return $this->createError("Unknown group id: $groupId");
}
}
}
if (!empty($permissions)) {
$res = $updateQuery->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
}
if ($this->success) {
$res = $sql->delete("ApiPermission")
->whereEq("description", "") // only delete non default permissions
->where(new CondNot(new CondIn(new Column("method"), $insertedMethods)))
->execute();
$this->success = ($res !== FALSE);
$this->lastError = $sql->getLastError();
if ($description === null) {
$updateQuery = $sql->insert("ApiPermission", ["method", "groups", "isCore"])
->onDuplicateKeyStrategy(new UpdateStrategy(["method"], ["groups" => $groups]))
->addRow($method, $groups, false);
} else {
$updateQuery = $sql->insert("ApiPermission", ["method", "groups", "isCore", "description"])
->onDuplicateKeyStrategy(new UpdateStrategy(["method"], ["groups" => $groups, "description" => $description]))
->addRow($method, $groups, false, $description);
}
$this->success = $updateQuery->execute() !== false;
$this->lastError = $sql->getLastError();
return $this->success;
}
@@ -222,4 +202,55 @@ namespace Core\API\Permission {
);
}
}
class Delete extends PermissionAPI {
public function __construct(Context $context, bool $externalCall = false) {
parent::__construct($context, $externalCall, [
"method" => new StringType("method", 32, false),
]);
}
protected function _execute(): bool {
if (!$this->checkStaticPermission()) {
return false;
}
$sql = $this->context->getSQL();
$method = $this->getParam("method");
if ($this->isRestricted($method)) {
return $this->createError("This method cannot be deleted.");
}
$res = $sql->select("method")
->from("ApiPermission")
->whereEq("method", $method)
->execute();
$this->success = $res !== false;
$this->lastError = $sql->getLastError();
if ($this->success) {
if (!$res) {
return $this->createError("This method was not configured yet");
} else {
$res = $sql->delete("ApiPermission")
->whereEq("method", $method)
->execute();
$this->success = $res !== false;
$this->lastError = $sql->getLastError();
}
}
return $this->success;
}
public static function getDefaultACL(Insert $insert): void {
$insert->addRow(
self::getEndpoint(), [Group::ADMIN],
"Allows users to delete API permissions. This is restricted to the administrator and cannot be changed",
true
);
}
}
}

12
Core/API/Request.class.php
View File

@@ -244,13 +244,11 @@ abstract class Request {
}
// Check for permission
if (!($this instanceof \Core\API\Permission\Save)) {
$req = new \Core\API\Permission\Check($this->context);
$this->success = $req->execute(array("method" => self::getEndpoint()));
$this->lastError = $req->getLastError();
if (!$this->success) {
return false;
}
$req = new \Core\API\Permission\Check($this->context);
$this->success = $req->execute(array("method" => self::getEndpoint()));
$this->lastError = $req->getLastError();
if (!$this->success) {
return false;
}
}

5
Core/API/Swagger.class.php
View File

@@ -41,11 +41,6 @@ class Swagger extends Request {
return false;
}
// special case: hardcoded permission
if ($request instanceof \Core\API\Permission\Save && (!$isLoggedIn || !$currentUser->hasGroup(Group::ADMIN))) {
return false;
}
if (!empty($requiredGroups)) {
$userGroups = array_keys($currentUser?->getGroups() ?? []);
return !empty(array_intersect($requiredGroups, $userGroups));