From ffa2c1541f802e74b5b42b04bb8041a52bb7d62a Mon Sep 17 00:00:00 2001 From: Tom Udding Date: Wed, 4 Sep 2024 17:38:30 +0200 Subject: [PATCH 1/3] chore: simplify admin access to modules by introducing admin resources This only handles top-level access, all sub-permissions/acls have to be manually defined in their respective resources. --- .../src/Controller/AdminController.php | 2 +- module/Activity/src/Service/AclService.php | 20 +++-- module/Application/view/partial/admin.phtml | 75 +++++++------------ .../Application/view/partial/main-nav.phtml | 14 +++- module/Company/src/Service/AclService.php | 19 +++-- module/Decision/src/Service/AclService.php | 23 +++--- module/Education/src/Service/AclService.php | 10 ++- module/Frontpage/src/Service/AclService.php | 13 ++-- module/Photo/src/Service/AclService.php | 11 ++- module/User/src/Service/AclService.php | 5 +- 10 files changed, 105 insertions(+), 87 deletions(-) diff --git a/module/Activity/src/Controller/AdminController.php b/module/Activity/src/Controller/AdminController.php index 9535ac7a55..ad38b2201b 100644 --- a/module/Activity/src/Controller/AdminController.php +++ b/module/Activity/src/Controller/AdminController.php @@ -441,7 +441,7 @@ public function externalSignoffAction(): Response|ViewModel */ public function viewAction(): ViewModel { - if (!$this->aclService->isAllowed('viewAdmin', 'activity')) { + if (!$this->aclService->isAllowed('view', 'activity_admin')) { throw new NotAllowedException($this->translator->translate('You are not allowed to administer activities')); } diff --git a/module/Activity/src/Service/AclService.php b/module/Activity/src/Service/AclService.php index 76f731f755..3d97075afa 100644 --- a/module/Activity/src/Service/AclService.php +++ b/module/Activity/src/Service/AclService.php @@ -4,6 +4,7 @@ namespace Activity\Service; +use Laminas\Permissions\Acl\Resource\GenericResource as Resource; use User\Permissions\Assertion\IsCreatorOrOrganMember; class AclService extends \User\Service\AclService @@ -12,13 +13,15 @@ protected function createAcl(): void { parent::createAcl(); - $this->acl->addResource('activity'); - $this->acl->addResource('activityApi'); - $this->acl->addResource('myActivities'); - $this->acl->addResource('model'); - $this->acl->addResource('activity_calendar_period'); - $this->acl->addResource('activity_calendar_proposal'); - $this->acl->addResource('signupList'); + $this->acl->addResource(new Resource('activity')); + $this->acl->addResource(new Resource('activityApi')); + $this->acl->addResource(new Resource('myActivities')); + $this->acl->addResource(new Resource('model')); + $this->acl->addResource(new Resource('activity_calendar_period')); + $this->acl->addResource(new Resource('activity_calendar_proposal')); + $this->acl->addResource(new Resource('signupList')); + // Define administration part of this module, however, sub-permissions must be manually configured. + $this->acl->addResource(new Resource('activity_admin')); $this->acl->allow('guest', 'activity', ['view', 'viewCategory']); $this->acl->allow('guest', 'signupList', ['view', 'externalSignup']); @@ -35,7 +38,7 @@ protected function createAcl(): void ['view', 'viewDetails', 'signup', 'signoff', 'checkUserSignedUp'], ); - $this->acl->allow('active_member', 'activity', ['create', 'viewAdmin', 'listCategories']); + $this->acl->allow('active_member', 'activity', ['create', 'listCategories']); $this->acl->allow( 'active_member', 'activity', @@ -48,6 +51,7 @@ protected function createAcl(): void ['adminSignup', 'viewParticipants', 'exportParticipants'], new IsCreatorOrOrganMember(), ); + $this->acl->allow('active_member', 'activity_admin', 'view'); $this->acl->allow('admin', 'activity', 'viewParticipantDetails'); $this->acl->allow('admin', 'activity', 'approve'); diff --git a/module/Application/view/partial/admin.phtml b/module/Application/view/partial/admin.phtml index 9f5b916ed4..18ca02115f 100644 --- a/module/Application/view/partial/admin.phtml +++ b/module/Application/view/partial/admin.phtml @@ -21,8 +21,7 @@ use Laminas\View\Renderer\PhpRenderer;