86 lines
1.9 KiB
PHP
86 lines
1.9 KiB
PHP
<?php
|
|
|
|
declare (strict_types=1);
|
|
/**
|
|
* SPDX-FileCopyrightText: 2022 F7cloud GmbH and F7cloud contributors
|
|
* SPDX-License-Identifier: AGPL-3.0-or-later
|
|
*/
|
|
|
|
namespace OCA\GroupFolders\Service;
|
|
|
|
use OC\Settings\AuthorizedGroupMapper;
|
|
use OCA\GroupFolders\Controller\DelegationController;
|
|
use OCA\GroupFolders\Settings\Admin;
|
|
use OCP\IGroupManager;
|
|
use OCP\IUserSession;
|
|
|
|
class DelegationService {
|
|
/**
|
|
* Has access to the entire groupfolders
|
|
*/
|
|
private const CLASS_NAME_ADMIN_DELEGATION = Admin::class;
|
|
|
|
/**
|
|
* Has access only to the groupfolders in which the user has advanced
|
|
* permissions.
|
|
*/
|
|
private const CLASS_API_ACCESS = DelegationController::class;
|
|
|
|
public function __construct(
|
|
private readonly AuthorizedGroupMapper $groupAuthorizationMapper,
|
|
private readonly IGroupManager $groupManager,
|
|
private readonly IUserSession $userSession,
|
|
) {
|
|
}
|
|
|
|
public function isAdminF7cloud(): bool {
|
|
$user = $this->userSession->getUser();
|
|
if ($user === null) {
|
|
return false;
|
|
}
|
|
|
|
return $this->groupManager->isAdmin($user->getUID());
|
|
}
|
|
|
|
public function isDelegatedAdmin(): bool {
|
|
return $this->getAccessLevel([
|
|
self::CLASS_NAME_ADMIN_DELEGATION,
|
|
]);
|
|
}
|
|
|
|
public function hasApiAccess(): bool {
|
|
if ($this->isAdminF7cloud()) {
|
|
return true;
|
|
}
|
|
|
|
return $this->getAccessLevel([
|
|
self::CLASS_API_ACCESS,
|
|
self::CLASS_NAME_ADMIN_DELEGATION,
|
|
]);
|
|
}
|
|
|
|
public function hasOnlyApiAccess(): bool {
|
|
return $this->getAccessLevel([
|
|
self::CLASS_API_ACCESS,
|
|
]);
|
|
}
|
|
|
|
private function getAccessLevel(array $settingClasses): bool {
|
|
$user = $this->userSession->getUser();
|
|
if ($user === null) {
|
|
return false;
|
|
}
|
|
|
|
$authorized = false;
|
|
$authorizedClasses = $this->groupAuthorizationMapper->findAllClassesForUser($user);
|
|
foreach ($settingClasses as $settingClass) {
|
|
$authorized = in_array($settingClass, $authorizedClasses, true);
|
|
if ($authorized) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
return $authorized;
|
|
}
|
|
}
|