- role allocations now can be used to control permissions.

git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@4458 c91229c3-7414-0410-bfa2-8a42b809f60b

- role allocations now can be used to control permissions.
git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/trunk@4458 c91229c3-7414-0410-bfa2-8a42b809f60b
Brad Shuttleworth
1 parent 1f5c058d
Showing 7 changed files with 184 additions and 87 deletions
lib/permissions/permissionutil.inc.php
lib/roles/roleallocation.inc.php
plugins/ktcore/KTFolderActions.php
plugins/ktcore/KTPermissions.php
templates/ktcore/document/document_permissions.smarty
templates/ktcore/folder/permissions.smarty
templates/ktcore/folder/roles.smarty
@@ -228,12 +228,23 @@ class KTPermissionUtil {
                     }
                     // roles are _not_ always assigned (can be null at root)
                     if ($_roleCache[$iRoleId] != null) {
-                        $aAllowed['user'] = array_merge($aAllowed['user'], $_roleCache[$iRoleId]->getUsers());
-                        $aAllowed['group'] = array_merge($aAllowed['group'], $_roleCache[$iRoleId]->getGroups());
+                        $aMapPermAllowed[$iPermissionId]['user'] = array_merge($aAllowed['user'], $_roleCache[$iRoleId]->getUserIds());
+                        $aMapPermAllowed[$iPermissionId]['group'] = array_merge($aAllowed['group'], $_roleCache[$iRoleId]->getGroupIds());
                     }
                 }
+                
             }
+            unset($aMapPermAllowed[$iPermissionId]['role']);            
         }
+        
+        /*
+        print '<pre>';
+        print '=======' . $oFolderOrDocument->getName();
+        print '<br />';
+        var_dump($aMapPermAllowed);
+        print '</pre>';
+        */
+        
         $aMapPermDesc = array();
         foreach ($aMapPermAllowed as $iPermissionId => $aAllowed) {
@@ -151,6 +151,34 @@ class RoleAllocation extends KTEntity {
 		return $aFullGroups;
 	}
+	function getUserIds() {
+	    $oDescriptor = $this->getPermissionDescriptor();
+		$aUsers = array();
+		if (PEAR::isError($oDescriptor) || ($oDescriptor == false)) {
+		     return $aUsers;
+		}
+		$aAllowed = $oDescriptor->getAllowed();
+		if ($aAllowed['user'] !== null) {
+		    $aUsers = $aAllowed['user'];
+		} 
+		
+		return $aUsers;
+	}
+	
+	function getGroupIds() {
+	    $oDescriptor = $this->getPermissionDescriptor();
+		$aGroups = array();
+		if (PEAR::isError($oDescriptor) || ($oDescriptor == false)) {
+		     return $aGroups;
+		}
+		$aAllowed = $oDescriptor->getAllowed();
+		if ($aAllowed['group'] !== null) {
+		    $aGroups = $aAllowed['group'];
+		} 
+		
+		return $aGroups;
+	}	
+	
 	// utility function to establish user membership in this allocation.
 	// FIXME nbm:  is there are more coherent way to do this ITO your PD infrastructure?
 	function hasMember($oUser) {
@@ -70,6 +70,7 @@ class KTFolderPermissionsAction extends KTFolderAction {
         $oPO = KTPermissionObject::get($this->oFolder->getPermissionObjectId());
         $aPermissions = KTPermission::getList();
         $aMapPermissionGroup = array();
+        $aMapPermissionRole = array();
         foreach ($aPermissions as $oPermission) {
             $oPA = KTPermissionAssignment::getByPermissionAndObject($oPermission, $oPO);
             if (PEAR::isError($oPA)) {
@@ -82,15 +83,10 @@ class KTFolderPermissionsAction extends KTFolderAction {
             foreach ($aIds as $iId) {
                 $aMapPermissionGroup[$iPermissionId][$iId] = true;
             }
-        }
-        $aMapPermissionUser = array();
-        $aUsers = User::getList();
-        foreach ($aPermissions as $oPermission) {
-            $iPermissionId = $oPermission->getId();
-            foreach ($aUsers as $oUser) {
-                if (KTPermissionUtil::userHasPermissionOnItem($oUser, $oPermission, $this->oFolder)) {
-                    $aMapPermissionUser[$iPermissionId][$oUser->getId()] = true;
-                }
+            $aIds = $oDescriptor->getRoles();
+            $aMapPermissionRole[$iPermissionId] = array();
+            foreach ($aIds as $iId) {
+                $aMapPermissionRole[$iPermissionId][$iId] = true;
             }
         }
@@ -108,10 +104,10 @@ class KTFolderPermissionsAction extends KTFolderAction {
         $aTemplateData = array(
             "permissions" => $aPermissions,
             "groups" => Group::getList(),
+            "roles" => Role::getList(),
             "iFolderId" => $this->oFolder->getId(),
             "aMapPermissionGroup" => $aMapPermissionGroup,
-            "users" => $aUsers,
-            "aMapPermissionUser" => $aMapPermissionUser,
+            "aMapPermissionRole" => $aMapPermissionRole,
             "edit" => $bEdit,
             "inherited" => $sInherited,
             "conditions" => KTSavedSearch::getConditions(),
@@ -167,6 +163,7 @@ class KTFolderPermissionsAction extends KTFolderAction {
         $this->successRedirectToMain(_("Dynamic permission added"), "fFolderId=" . $this->oFolder->getId());
     }
 }
+
 $oPlugin->registerAction('folderaction', 'KTFolderPermissionsAction', 'ktcore.actions.folder.permissions');
 $oPlugin->registerAction('folderaction', 'KTBulkImportFolderAction', 'ktcore.actions.folder.bulkImport', 'folder/BulkImport.php');
 $oPlugin->registerAction('folderaction', 'KTBulkUploadFolderAction', 'ktcore.actions.folder.bulkUpload', 'folder/BulkUpload.php');
@@ -30,6 +30,7 @@ class KTDocumentPermissionsAction extends KTDocumentAction {
         $oPO = KTPermissionObject::get($this->oDocument->getPermissionObjectID());
         $aPermissions = KTPermission::getList();
         $aMapPermissionGroup = array();
+        $aMapPermissionRole = array();		
         foreach ($aPermissions as $oPermission) {
             $oPA = KTPermissionAssignment::getByPermissionAndObject($oPermission, $oPO);
             if (PEAR::isError($oPA)) {
@@ -42,16 +43,11 @@ class KTDocumentPermissionsAction extends KTDocumentAction {
             foreach ($aIDs as $iID) {
                 $aMapPermissionGroup[$iPermissionID][$iID] = true;
             }
-        }
-        $aMapPermissionUser = array();
-        $aUsers = User::getList();
-        foreach ($aPermissions as $oPermission) {
-            $iPermissionID = $oPermission->getID();
-            foreach ($aUsers as $oUser) {
-                if (KTPermissionUtil::userHasPermissionOnItem($oUser, $oPermission, $this->oDocument)) {
-                    $aMapPermissionUser[$iPermissionID][$oUser->getID()] = true;
-                }
-            }
+            $aIds = $oDescriptor->getRoles();
+            $aMapPermissionRole[$iPermissionID] = array();
+            foreach ($aIds as $iId) {
+                $aMapPermissionRole[$iPermissionID][$iId] = true;
+            }		
         }
         $oInherited = KTPermissionUtil::findRootObjectForPermissionObject($oPO);
@@ -70,10 +66,10 @@ class KTDocumentPermissionsAction extends KTDocumentAction {
             "context" => $this,
             "permissions" => $aPermissions,
             "groups" => Group::getList(),
+            "roles" => Role::getList(),			
             "iDocumentID" => $_REQUEST['fDocumentID'],
             "aMapPermissionGroup" => $aMapPermissionGroup,
-            "users" => $aUsers,
-            "aMapPermissionUser" => $aMapPermissionUser,
+            "aMapPermissionRole" => $aMapPermissionRole,			
             "edit" => $bEdit,
             "inherited" => $sInherited,
         );
@@ -158,6 +154,7 @@ class KTRoleAllocationPlugin extends KTFolderAction {
         // map to users, groups.
         foreach ($aRoles as $key => $role) {
+		    /*
             $_users = array();
             foreach ($aRoles[$key]['users'] as $iUserId) {
                 $oUser = User::get($iUserId);
@@ -170,6 +167,7 @@ class KTRoleAllocationPlugin extends KTFolderAction {
 			} else {
                 $aRoles[$key]['users'] = join(', ',$_users);
 			}
+			*/
             $_groups = array();
             foreach ($aRoles[$key]['groups'] as $iGroupId) {
@@ -37,6 +37,7 @@ td.false { background-color: #ffaaaa; text-align: centre }
 { /if }
 <div class="view" id="view">
 <table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
+
 <thead>
 <tr>
 <th>Group</th>
@@ -63,6 +64,34 @@ td.false { background-color: #ffaaaa; text-align: centre }
 </tbody>
 </table>
+
+<table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
+<thead>
+<tr>
+<th>Role</th>
+{ foreach item=oPerm from=$permissions }
+<th title="{$oPerm->sName}">{$oPerm->sHumanName}</th>
+{ /foreach }
+</tr>
+</thead>
+<tbody>
+{ foreach item=oRole from=$roles }
+<td>{$oRole->getId()} / {$oRole->getName()}</td>
+  { assign var=iRoleId value=$oRole->getId() }
+  { foreach item=oPerm from=$permissions }
+    { assign var=iPermId value=$oPerm->getId() }
+    { assign var=bHasPerm value=$aMapPermissionRole[$iPermId][$iRoleId] }
+{ if $bHasPerm }
+<td class="true">True</td>
+{ else }
+<td class="false">False</td>
+{ /if }
+  { /foreach }
+</tr>
+{ /foreach }
+</tbody>
+</table>
+
 <div style="text-align: center; padding-top: 2px">
 <span style="border: 1px solid #cccccc; background-color: #ffeeee;
 padding: 2px; padding-right: 1em; padding-left: 1em">
@@ -114,38 +143,40 @@ value=&quot;{$iGroupID}&quot;&gt;&lt;/td&gt;
 </tbody>
 </table>
-<input type="submit" name="submit" value="{i18n}Update{/i18n}">
-</form>
-</div>
-{ /if }
-<h2>{i18n}User permissions{/i18n}</h2>
-
-<div>
 <table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
 <thead>
 <tr>
-<th>{i18n}User{/i18n}</th>
+<th>Role</th>
 { foreach item=oPerm from=$permissions }
 <th title="{$oPerm->sName}">{$oPerm->sHumanName}</th>
 { /foreach }
 </tr>
 </thead>
+
 <tbody>
-{ foreach item=oUser from=$users }
-<td>{$oUser->getID()} / {$oUser->getName()}</td>
-  { assign var=iUserID value=$oUser->getID() }
+{ foreach item=oRole from=$roles }
+<td>{$oRole->getId()} / {$oRole->getName()}</td>
+  { assign var=iRoleId value=$oRole->getId() }
   { foreach item=oPerm from=$permissions }
-    { assign var=iPermID value=$oPerm->getID() }
-    { assign var=bHasPerm value=$aMapPermissionUser[$iPermID][$iUserID] }
+    { assign var=iPermId value=$oPerm->getId() }
+    { assign var=bHasPerm value=$aMapPermissionRole[$iPermId][$iRoleId] }
+
 { if $bHasPerm }
-<td class="true">{i18n}True{/i18n}</td>
+<td class="true"><input type="checkbox" name="foo[{$iPermId}][role][]"
+value="{$iRoleId}" checked="true"></td>
 { else }
-<td class="false">{i18n}False{/i18n}</td>
+<td class="false"><input type="checkbox" name="foo[{$iPermId}][role][]"
+value="{$iRoleId}"></td>
 { /if }
   { /foreach }
 </tr>
 { /foreach }
 </tbody>
 </table>
+
+
+<input type="submit" name="submit" value="{i18n}Update{/i18n}">
+</form>
 </div>
+{ /if }
@@ -65,22 +65,36 @@ MochiKit.DOM.hideElement(&#39;view&#39;);&quot;&gt;{i18n}Edit{/i18n}&lt;/a&gt;
 </tbody>
 </table>
-<div style="text-align: center; padding-top: 2px">
-<span style="border: 1px solid #cccccc; background-color: #ffeeee;
-padding: 2px; padding-right: 1em; padding-left: 1em">
-{ if $inherited }
-{i18n}Inherited from:{/i18n} {$inherited}
-[<a
-href="{$smarty.server.PHP_SELF}?action=copyPermissions&fFolderId={$iFolderId}">{i18n}Copy{/i18n}</a>]
+<table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
+<thead>
+<tr>
+<th>Role</th>
+{ foreach item=oPerm from=$permissions }
+<th title="{$oPerm->sName}">{$oPerm->sHumanName}</th>
+{ /foreach }
+</tr>
+</thead>
+<tbody>
+{ foreach item=oRole from=$roles }
+<td>{$oRole->getId()} / {$oRole->getName()}</td>
+  { assign var=iRoleId value=$oRole->getId() }
+  { foreach item=oPerm from=$permissions }
+    { assign var=iPermId value=$oPerm->getId() }
+    { assign var=bHasPerm value=$aMapPermissionRole[$iPermId][$iRoleId] }
+{ if $bHasPerm }
+<td class="true">True</td>
 { else }
-[<a
-href="{$smarty.server.PHP_SELF}?action=inheritPermissions&fFolderId={$iFolderId}">{i18n}Use
-parent's permissions{/i18n}</a>]
+<td class="false">False</td>
 { /if }
-</span>
-</div>
+  { /foreach }
+</tr>
+{ /foreach }
+</tbody>
+</table>
+
 </div>
+
 { if $edit }
 <div class="edit" id="edit">
 <form action="{$smarty.server.PHP_SELF}" method="POST">
@@ -115,11 +129,60 @@ value=&quot;{$iGroupId}&quot;&gt;&lt;/td&gt;
 </tbody>
 </table>
+<table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
+<thead>
+<tr>
+<th>Role</th>
+{ foreach item=oPerm from=$permissions }
+<th title="{$oPerm->sName}">{$oPerm->sHumanName}</th>
+{ /foreach }
+</tr>
+</thead>
+
+<tbody>
+{ foreach item=oRole from=$roles }
+<td>{$oRole->getId()} / {$oRole->getName()}</td>
+  { assign var=iRoleId value=$oRole->getId() }
+  { foreach item=oPerm from=$permissions }
+    { assign var=iPermId value=$oPerm->getId() }
+    { assign var=bHasPerm value=$aMapPermissionRole[$iPermId][$iRoleId] }
+
+{ if $bHasPerm }
+<td class="true"><input type="checkbox" name="foo[{$iPermId}][role][]"
+value="{$iRoleId}" checked="true"></td>
+{ else }
+<td class="false"><input type="checkbox" name="foo[{$iPermId}][role][]"
+value="{$iRoleId}"></td>
+{ /if }
+  { /foreach }
+</tr>
+{ /foreach }
+</tbody>
+</table>
+
 <input type="submit" name="submit" value="{i18n}Update{/i18n}">
 </form>
+
 </div>
 { /if }
+
+
+<div style="text-align: center; padding-top: 2px">
+<span style="border: 1px solid #cccccc; background-color: #ffeeee;
+padding: 2px; padding-right: 1em; padding-left: 1em">
+{ if $inherited }
+{i18n}Inherited from:{/i18n} {$inherited}
+[<a
+href="{$smarty.server.PHP_SELF}?action=copyPermissions&fFolderId={$iFolderId}">{i18n}Copy{/i18n}</a>]
+{ else }
+[<a
+href="{$smarty.server.PHP_SELF}?action=inheritPermissions&fFolderId={$iFolderId}">{i18n}Use
+parent's permissions{/i18n}</a>]
+{ /if }
+</span>
+</div>
+
 <h2>Dynamic permissions</h2>
 { if $dynamic_conditions }
@@ -186,34 +249,3 @@ $this-&gt;assign(&quot;aPermissions&quot;, $this-&gt;_tpl_vars[&#39;oDynamicCondition&#39;]-&gt;getAssignme
 <input type="submit" name="submit" value="{i18n}Add{/i18n}" />
 </form>
 { /if }
-
-<h2>User permissions</h2>
-
-<div>
-<table class="pretty" cellspacing="0" cellpadding="0" border="0" width="100%">
-<thead>
-<tr>
-<th>{i18n}User{/i18n}</th>
-{ foreach item=oPerm from=$permissions }
-<th title="{$oPerm->sName}">{$oPerm->sHumanName}</th>
-{ /foreach }
-</tr>
-</thead>
-<tbody>
-{ foreach item=oUser from=$users }
-<td>{$oUser->getId()} / {$oUser->getName()}</td>
-  { assign var=iUserId value=$oUser->getId() }
-  { foreach item=oPerm from=$permissions }
-    { assign var=iPermId value=$oPerm->getId() }
-    { assign var=bHasPerm value=$aMapPermissionUser[$iPermId][$iUserId] }
-{ if $bHasPerm }
-<td class="true">{i18n}True{/i18n}</td>
-{ else }
-<td class="false">{i18n}False{/i18n}</td>
-{ /if }
-  { /foreach }
-</tr>
-{ /foreach }
-</tbody>
-</table>
-</div>
@@ -14,7 +14,7 @@ role allocations can take very long time, depending on the number of folders bel
     <tr>
         <th>{i18n}Role{/i18n}</th>
         <th>{i18n}Allocated users{/i18n}</th>
-        <th>{i18n}Edit Users{/i18n}</th>
+<!--        <th>{i18n}Edit Users{/i18n}</th> -->
         <th>{i18n}Edit Groups{/i18n}</th>
         <th>{i18n}Use Parent{/i18n}</th>
     </tr>
@@ -28,16 +28,16 @@ role allocations can take very long time, depending on the number of folders bel
               <strong>{i18n}inherited from parent folder.{/i18n}</strong><br />
               <span class="descriptiveText">
            {/if}
-           {if ($aRole.users != null)}<strong>{i18n}Users:{/i18n}</strong> {$aRole.users}<br />{/if}
+<!--           {if ($aRole.users != null)}<strong>{i18n}Users:{/i18n}</strong> {$aRole.users}<br />{/if} -->
            {if ($aRole.groups != null)}<strong>{i18n}Groups:{/i18n}</strong> {$aRole.groups}{/if}
            {if ($aRole.allocation_id === null)}
               </span class="descriptiveText">
            {/if}
         </td>
         {if ($aRole.allocation_id === null)}
-        <td colspan="3"><a href="{$smarty.server.PHP_SELF}?action=overrideParent&role_id={$role_id}&fFolderId={$context->oFolder->getId()}">{i18n}Override Parent Allocation{/i18n}</a></td>
+        <td colspan="2"><a href="{$smarty.server.PHP_SELF}?action=overrideParent&role_id={$role_id}&fFolderId={$context->oFolder->getId()}">{i18n}Override Parent Allocation{/i18n}</a></td>
         {else}
-        <td><a href="{$smarty.server.PHP_SELF}?action=editRoleUsers&alloc_id={$aRole.allocation_id}&fFolderId={$context->oFolder->getId()}" class="ktAction ktEdit" title="{i18n}Edit{/i18n}">Edit</a></td>
+<!--        <td><a href="{$smarty.server.PHP_SELF}?action=editRoleUsers&alloc_id={$aRole.allocation_id}&fFolderId={$context->oFolder->getId()}" class="ktAction ktEdit" title="{i18n}Edit{/i18n}">Edit</a></td> -->
         <td><a href="{$smarty.server.PHP_SELF}?action=editRoleGroups&alloc_id={$aRole.allocation_id}&fFolderId={$context->oFolder->getId()}" class="ktAction ktEdit" title="{i18n}Edit{/i18n}">Edit</a></td>
         <td><a href="{$smarty.server.PHP_SELF}?action=useParent&role_id={$role_id}&fFolderId={$context->oFolder->getId()}" class="ktAction ktDelete" title="{i18n}Use parent's allocation{/i18n}">{i18n}Use parent's allocation{/i18n}</a></td>
         {/if}