Skip to content

Commit 6330e1d

Browse files
nolanpronolanpro
committed
Begin work on permissions system
1 parent f347409 commit 6330e1d

14 files changed

Lines changed: 282 additions & 55 deletions

‎ProcessMaker/Http/Kernel.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,9 @@ class Kernel extends HttpKernel
5555
protected $routeMiddleware = [
5656
'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
5757
'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
58+
'authorize' => \ProcessMaker\Http\Middleware\Authorize::class,
5859
'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
59-
'can' => \Illuminate\Auth\Middleware\Authorize::class,
60+
// 'can' => \Illuminate\Auth\Middleware\Authorize::class,
6061
'guest' => \ProcessMaker\Http\Middleware\RedirectIfAuthenticated::class,
6162
'permission' => \ProcessMaker\Http\Middleware\PermissionCheck::class,
6263
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,

‎ProcessMaker/Http/Middleware/Authorize.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
namespace ProcessMaker\Http\Middleware;
3+
4+
use Closure;
5+
use Illuminate\Http\Request;
6+
use \Illuminate\Auth\Access\AuthorizationException;
7+
8+
class Authorize
9+
{
10+
public function handle(Request $request, Closure $next)
11+
{
12+
// At this point we should have already checked if the
13+
// user is logged in so we can assume $request->user()
14+
$permission = $request->route()->action['as'];
15+
if ($request->user()->hasPermission($permission)) {
16+
return $next($request);
17+
} elseif ($permission == 'processes.index'){ // && $request->user()->hasPermission('processes.show')) {
18+
return $next($request);
19+
} else {
20+
throw new AuthorizationException("Not authorized: " . $permission);
21+
}
22+
}
23+
}

‎ProcessMaker/Models/Group.php‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,27 @@ public static function rules($existing = null)
4040
return $rules;
4141
}
4242

43-
public function members()
43+
public function permissionAssignments()
4444
{
45-
return $this->hasMany(GroupMember::class);
45+
return $this->morphMany(PermissionAssignment::class, 'assignable', null, 'assignable_uuid');
4646
}
47-
48-
public function memberships()
47+
48+
public function groupMembers()
4949
{
5050
return $this->morphMany(GroupMember::class, 'member', null, 'member_uuid');
5151
}
52+
53+
public function permissions()
54+
{
55+
$permissions = [];
56+
foreach ($this->groupMembers as $gm) {
57+
$group = $gm->group;
58+
$permissions =
59+
array_merge($permissions, $group->permissions());
60+
}
61+
foreach ($this->permissionAssignments as $pa) {
62+
$permissions[] = $pa->permission;
63+
}
64+
return $permissions;
65+
}
5266
}

‎ProcessMaker/Models/Permission.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?php
2+
3+
namespace ProcessMaker\Models;
4+
5+
use Illuminate\Database\Eloquent\Model;
6+
use Spatie\BinaryUuid\HasBinaryUuid;
7+
8+
class Permission extends Model
9+
{
10+
use HasBinaryUuid;
11+
}

‎ProcessMaker/Models/PermissionAssignment.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?php
2+
3+
namespace ProcessMaker\Models;
4+
5+
use Illuminate\Database\Eloquent\Model;
6+
use Spatie\BinaryUuid\HasBinaryUuid;
7+
8+
class PermissionAssignment extends Model
9+
{
10+
use HasBinaryUuid;
11+
12+
public function assignable()
13+
{
14+
return $this->morphTo(null, null, 'assignable_uuid');
15+
}
16+
17+
public function permission()
18+
{
19+
return $this->belongsTo(Permission::class);
20+
}
21+
}

‎ProcessMaker/Models/User.php‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,16 @@ public function getFullName()
106106
]);
107107
}
108108

109-
public function memberships()
109+
public function groupMembers()
110110
{
111111
return $this->morphMany(GroupMember::class, 'member', null, 'member_uuid');
112112
}
113113

114+
public function permissionAssignments()
115+
{
116+
return $this->morphMany(PermissionAssignment::class, 'assignable', null, 'assignable_uuid');
117+
}
118+
114119
/**
115120
* Get the full name as an attribute.
116121
*
@@ -143,4 +148,25 @@ public function getAvatar()
143148
}
144149
return $url;
145150
}
151+
152+
public function hasPermission($permissionString)
153+
{
154+
// TODO: cache
155+
$permissions = [];
156+
foreach ($this->groupMembers as $gm) {
157+
$group = $gm->group;
158+
$permissions =
159+
array_merge($permissions, $group->permissions());
160+
}
161+
foreach ($this->permissionAssignments as $pa) {
162+
$permissions[] = $pa->permission;
163+
}
164+
165+
$permissionStrings = array_map(
166+
function($p) { return $p->guard_name; },
167+
$permissions
168+
);
169+
eval(\Psy\sh());
170+
return in_array($permissionString, $permissionStrings);
171+
}
146172
}

‎ProcessMaker/Providers/AuthServiceProvider.php‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,6 @@ class AuthServiceProvider extends ServiceProvider
4747
* @var array
4848
*/
4949
protected $policies = [
50-
Application::class => ApplicationPolicy::class,
51-
Process::class => ProcessPolicy::class,
52-
ProcessCategory::class => ProcessCategoryPolicy::class,
53-
PmTable::class => PmTablePolicy::class,
54-
ProcessVariable::class => ProcessVariablePolicy::class,
55-
ReportTable::class => ReportTablePolicy::class,
56-
Form::class => FormPolicy::class,
57-
Script::class => ScriptPolicy::class,
58-
Script::class => ScriptPolicy::class,
59-
TaskUser::class => AssigneeTaskPolicy::class,
60-
Delegation::class => AssigneeTaskPolicy::class,
61-
InputDocument::class => InputDocumentPolicy::class,
62-
OutputDocument::class => OutputDocumentPolicy::class,
63-
Task::class => TaskPolicy::class,
6450
];
6551

6652
/**
@@ -70,39 +56,8 @@ class AuthServiceProvider extends ServiceProvider
7056
*/
7157
public function boot()
7258
{
73-
7459
$this->registerPolicies();
75-
7660
Passport::routes();
77-
78-
Gate::define('has-permission', function ($user, $permissions) {
79-
// Convert permissions to array and trimmed
80-
$permissions = explode(',', $permissions);
81-
array_walk($permissions, function (&$val) {
82-
$val = trim($val);
83-
});
84-
85-
// First get user's role
86-
$role = $user->role;
87-
88-
// Check for existence of role or if role is inactive
89-
if (!$role || $role->status != Role::STATUS_ACTIVE) {
90-
return false;
91-
}
92-
93-
// Get all permissions for this role that is requested
94-
$validPermissionCount = $role->permissions()
95-
->whereIn('code', $permissions)
96-
->count();
97-
98-
if ($validPermissionCount != count($permissions)) {
99-
// Then the number of permissions for the role that matched do not match the count of permissions
100-
// requested
101-
return false;
102-
}
103-
104-
return true;
105-
});
10661
}
10762

10863
}

‎database/factories/PermissionAssignmentFactory.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?php
2+
3+
use Faker\Generator as Faker;
4+
5+
$factory->define(ProcessMaker\Models\PermissionAssignment::class, function (Faker $faker) {
6+
return [
7+
];
8+
});

‎database/factories/PermissionFactory.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?php
2+
3+
use Faker\Generator as Faker;
4+
5+
$factory->define(ProcessMaker\Models\Permission::class, function (Faker $faker) {
6+
return [
7+
'name' => $faker->sentence(2),
8+
'guard_name' => $faker->sentence(2),
9+
'description' => $faker->sentence(5),
10+
];
11+
});

‎database/migrations/2018_09_07_180903_create_group_members_table.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ public function up()
1818
$table->primary('uuid');
1919
$table->uuid('group_uuid');
2020
$table->uuid('member_uuid');
21-
$table->string('member_type');
21+
$table->string('member_type'); // user or group
2222
$table->timestamps();
2323

2424
$table->index('group_uuid');

0 commit comments

Comments
 (0)