RightsSyncService.class.php

Go to the documentation of this file.

<?php
/* Copyright (C) 2026 ATM Consulting <support@atm-consulting.fr>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <https://www.gnu.org/licenses/>.
 */
 
require_once DOL_DOCUMENT_ROOT.'/modulebuilder/class/RightsSyncCommand.class.php';
require_once DOL_DOCUMENT_ROOT.'/modulebuilder/class/SyncReport.class.php';
require_once DOL_DOCUMENT_ROOT.'/modulebuilder/class/PermissionsBlock.class.php';
 
interface RightsSyncService
{
  public function sync(RightsSyncCommand $cmd): SyncReport;
}
 
final class DescriptorRightsSyncService implements RightsSyncService
{
  private const CRUD_LABELS = array(
    'read' => 'Read %s object of %s',
    'write' => 'Create/Update %s object of %s',
    'delete' => 'Delete %s object of %s',
  );
 
  private const INDEX_LABEL = 1;
 
  private const INDEX_OBJECT = 4;
 
  private const INDEX_CRUD = 5;
 
  public function sync(RightsSyncCommand $cmd): SyncReport
  {
    try {
      $block = PermissionsBlock::fromFile($cmd->descriptorFile);
    } catch (\RuntimeException $e) {
      dol_syslog('DescriptorRightsSyncService::sync '.$e->getMessage(), LOG_WARNING);
      return new SyncReport(0, 0, array($e->getMessage()));
    }
 
    $conflicts = array_merge(
      $block->detectTextConflicts(),
      $block->detectRightsShapeConflicts($cmd->permissions)
    );
    if (!empty($conflicts)) {
      dol_syslog(
        'DescriptorRightsSyncService::sync refused to rewrite '.$cmd->descriptorFile.': '
        .implode('; ', array_slice($conflicts, 0, 3)),
        LOG_WARNING
      );
      return new SyncReport(0, 0, $conflicts);
    }
 
    $warnings = $block->detectRightsShapeWarnings($cmd->permissions);
 
    try {
      $permissions = $this->applyCommand($cmd);
    } catch (\InvalidArgumentException $e) {
      dol_syslog('DescriptorRightsSyncService::sync '.$e->getMessage(), LOG_WARNING);
      return new SyncReport(0, 0, array($e->getMessage()), $warnings);
    }
    if ($permissions === null) {
      return new SyncReport(0, 1, array(), $warnings);
    }
 
    // The shape check above ran on the incoming rights; the command may itself produce an
    // unusable one, e.g. a right attached to no object, which hasRight() could never match.
    $producedConflicts = $block->detectRightsShapeConflicts($permissions);
    if (!empty($producedConflicts)) {
      dol_syslog(
        'DescriptorRightsSyncService::sync refused to write an unusable right into '.$cmd->descriptorFile.': '
        .implode('; ', array_slice($producedConflicts, 0, 3)),
        LOG_WARNING
      );
      return new SyncReport(0, 0, $producedConflicts, $warnings);
    }
 
    $newBlock = $block->render($permissions);
    if ($block->write($newBlock) < 0) {
      return new SyncReport(0, 0, array('Failed to write the permissions section of '.$cmd->descriptorFile), $warnings);
    }
 
    return new SyncReport(substr_count($newBlock, "\n"), 0, array(), $warnings);
  }
 
  private function applyCommand(RightsSyncCommand $cmd): ?array
  {
    $permissions = array_values($cmd->permissions);
 
    if ($cmd->scope === RightsSyncCommand::SCOPE_OBJECT) {
      if ($cmd->actionType === RightsSyncCommand::ACTION_ADD) {
        return $this->addObjectRights($permissions, $cmd->module, $cmd->objectName);
      }
      return $this->removeObjectRights($permissions, $cmd->objectName);
    }
 
    if ($cmd->actionType === RightsSyncCommand::ACTION_ADD) {
      return $this->addRight($permissions, $cmd->objectName, (string) $cmd->rightLabel, (string) $cmd->rightCrud);
    }
 
    $key = (int) $cmd->rightKey;
    if (!array_key_exists($key, $permissions)) {
      throw new \InvalidArgumentException('No permission found at index '.$key.' of the descriptor rights array');
    }
 
    if ($cmd->actionType === RightsSyncCommand::ACTION_UPDATE) {
      // Addressed by key, never by value: two rights may carry the very same label.
      $permissions[$key] = array(
        self::INDEX_LABEL => (string) $cmd->rightLabel,
        self::INDEX_OBJECT => strtolower($cmd->objectName),
        self::INDEX_CRUD => (string) $cmd->rightCrud,
      );
      return $permissions;
    }
 
    unset($permissions[$key]);
    return array_values($permissions);
  }
 
  private function addObjectRights(array $permissions, string $module, string $objectName): ?array
  {
    $target = strtolower($objectName);
    foreach ($permissions as $right) {
      if (isset($right[self::INDEX_OBJECT]) && strtolower((string) $right[self::INDEX_OBJECT]) === $target) {
        return null;
      }
    }
 
    foreach (self::CRUD_LABELS as $crud => $template) {
      $permissions[] = array(
        self::INDEX_LABEL => sprintf($template, $objectName, ucfirst($module)),
        self::INDEX_OBJECT => $target,
        self::INDEX_CRUD => $crud,
      );
    }
 
    return $permissions;
  }
 
  private function removeObjectRights(array $permissions, string $objectName): array
  {
    $target = strtolower($objectName);
 
    return array_values(array_filter(
      $permissions,
      static function ($right) use ($target) {
        return !isset($right[self::INDEX_OBJECT]) || strtolower((string) $right[self::INDEX_OBJECT]) !== $target;
      }
    ));
  }
 
  private function addRight(array $permissions, string $objectName, string $label, string $crud): array
  {
    $target = strtolower($objectName);
    foreach ($permissions as $right) {
      if (isset($right[self::INDEX_OBJECT], $right[self::INDEX_CRUD])
        && strtolower((string) $right[self::INDEX_OBJECT]) === $target
        && (string) $right[self::INDEX_CRUD] === $crud) {
        throw new \InvalidArgumentException('Permission "'.$crud.'" is already declared for object "'.$objectName.'"');
      }
    }
 
    $permissions[] = array(
      self::INDEX_LABEL => $label,
      self::INDEX_OBJECT => $target,
      self::INDEX_CRUD => $crud,
    );
 
    return $permissions;
  }
}