mirror of
https://github.com/chenasraf/nextcloud-forum.git
synced 2026-05-17 17:28:02 +00:00
325 lines
11 KiB
PHP
325 lines
11 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
// SPDX-FileCopyrightText: Chen Asraf <contact@casraf.dev>
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
namespace OCA\Forum\Controller;
|
|
|
|
use OCA\Forum\Attribute\RequirePermission;
|
|
use OCA\Forum\Db\CategoryPerm;
|
|
use OCA\Forum\Db\CategoryPermMapper;
|
|
use OCA\Forum\Db\Role;
|
|
use OCA\Forum\Db\RoleMapper;
|
|
use OCP\AppFramework\Db\DoesNotExistException;
|
|
use OCP\AppFramework\Http;
|
|
use OCP\AppFramework\Http\Attribute\ApiRoute;
|
|
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
|
|
use OCP\AppFramework\Http\DataResponse;
|
|
use OCP\AppFramework\OCSController;
|
|
use OCP\IRequest;
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
class RoleController extends OCSController {
|
|
public function __construct(
|
|
string $appName,
|
|
IRequest $request,
|
|
private RoleMapper $roleMapper,
|
|
private CategoryPermMapper $categoryPermMapper,
|
|
private LoggerInterface $logger,
|
|
) {
|
|
parent::__construct($appName, $request);
|
|
}
|
|
|
|
/**
|
|
* Get all roles
|
|
*
|
|
* @param int<1, 100> $limit Maximum number of roles to return
|
|
* @param int<0, max> $offset Offset for pagination
|
|
* @return DataResponse<Http::STATUS_OK, list<array<string, mixed>>, array{}>
|
|
*
|
|
* 200: Roles returned
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canManageUsers', orGroup: 'access')]
|
|
#[RequirePermission('canEditRoles', orGroup: 'access')]
|
|
#[ApiRoute(verb: 'GET', url: '/api/roles')]
|
|
public function index(int $limit = 100, int $offset = 0): DataResponse {
|
|
try {
|
|
$roles = array_slice($this->roleMapper->findAll(), $offset, $limit);
|
|
return new DataResponse(array_map(fn ($role) => $role->jsonSerialize(), $roles));
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error fetching roles: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to fetch roles'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get a single role
|
|
*
|
|
* @param int $id Role ID
|
|
* @return DataResponse<Http::STATUS_OK, array<string, mixed>, array{}>
|
|
*
|
|
* 200: Role returned
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canManageUsers', orGroup: 'access')]
|
|
#[RequirePermission('canEditRoles', orGroup: 'access')]
|
|
#[ApiRoute(verb: 'GET', url: '/api/roles/{id}')]
|
|
public function show(int $id): DataResponse {
|
|
try {
|
|
$role = $this->roleMapper->find($id);
|
|
return new DataResponse($role->jsonSerialize());
|
|
} catch (DoesNotExistException $e) {
|
|
return new DataResponse(['error' => 'Role not found'], Http::STATUS_NOT_FOUND);
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error fetching role: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to fetch role'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Create a new role
|
|
*
|
|
* @param string $name Role name
|
|
* @param string|null $description Role description
|
|
* @param string|null $colorLight Light mode color
|
|
* @param string|null $colorDark Dark mode color
|
|
* @param bool $canAccessAdminTools Can access admin tools
|
|
* @param bool $canManageUsers Can manage users
|
|
* @param bool $canEditRoles Can edit roles
|
|
* @param bool $canEditCategories Can edit categories
|
|
* @param bool $canEditBbcodes Can edit BBCodes
|
|
* @param bool $canAccessModeration Can access moderation tools
|
|
* @return DataResponse<Http::STATUS_CREATED, array<string, mixed>, array{}>
|
|
*
|
|
* 201: Role created
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canEditRoles')]
|
|
#[ApiRoute(verb: 'POST', url: '/api/roles')]
|
|
public function create(
|
|
string $name,
|
|
?string $description = null,
|
|
?string $colorLight = null,
|
|
?string $colorDark = null,
|
|
bool $canAccessAdminTools = false,
|
|
bool $canManageUsers = false,
|
|
bool $canEditRoles = false,
|
|
bool $canEditCategories = false,
|
|
bool $canEditBbcodes = false,
|
|
bool $canAccessModeration = false,
|
|
): DataResponse {
|
|
try {
|
|
$role = new \OCA\Forum\Db\Role();
|
|
$role->setName($name);
|
|
$role->setDescription($description);
|
|
$role->setColorLight($colorLight);
|
|
$role->setColorDark($colorDark);
|
|
$role->setCanAccessAdminTools($canAccessAdminTools);
|
|
$role->setCanManageUsers($canManageUsers);
|
|
$role->setCanEditRoles($canEditRoles);
|
|
$role->setCanEditCategories($canEditCategories);
|
|
$role->setCanEditBbcodes($canEditBbcodes);
|
|
$role->setCanAccessModeration($canAccessModeration);
|
|
$role->setCreatedAt(time());
|
|
|
|
/** @var \OCA\Forum\Db\Role */
|
|
$createdRole = $this->roleMapper->insert($role);
|
|
return new DataResponse($createdRole->jsonSerialize(), Http::STATUS_CREATED);
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error creating role: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to create role'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update a role
|
|
*
|
|
* @param int $id Role ID
|
|
* @param string|null $name Role name
|
|
* @param string|null $description Role description
|
|
* @param string|null $colorLight Light mode color
|
|
* @param string|null $colorDark Dark mode color
|
|
* @param bool|null $canAccessAdminTools Can access admin tools
|
|
* @param bool|null $canManageUsers Can manage users
|
|
* @param bool|null $canEditRoles Can edit roles
|
|
* @param bool|null $canEditCategories Can edit categories
|
|
* @param bool|null $canEditBbcodes Can edit BBCodes
|
|
* @param bool|null $canAccessModeration Can access moderation tools
|
|
* @return DataResponse<Http::STATUS_OK, array<string, mixed>, array{}>
|
|
*
|
|
* 200: Role updated
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canEditRoles')]
|
|
#[ApiRoute(verb: 'PUT', url: '/api/roles/{id}')]
|
|
public function update(
|
|
int $id,
|
|
?string $name = null,
|
|
?string $description = null,
|
|
?string $colorLight = null,
|
|
?string $colorDark = null,
|
|
?bool $canAccessAdminTools = null,
|
|
?bool $canManageUsers = null,
|
|
?bool $canEditRoles = null,
|
|
?bool $canEditCategories = null,
|
|
?bool $canEditBbcodes = null,
|
|
?bool $canAccessModeration = null,
|
|
): DataResponse {
|
|
try {
|
|
$role = $this->roleMapper->find($id);
|
|
|
|
if ($name !== null) {
|
|
$role->setName($name);
|
|
}
|
|
if ($description !== null) {
|
|
$role->setDescription($description);
|
|
}
|
|
if ($colorLight !== null) {
|
|
$role->setColorLight($colorLight);
|
|
}
|
|
if ($colorDark !== null) {
|
|
$role->setColorDark($colorDark);
|
|
}
|
|
|
|
// Coerced permission values per role type (overrides any input)
|
|
$coercedPermissions = match ($role->getRoleType()) {
|
|
Role::ROLE_TYPE_ADMIN => true, // Admin: all permissions forced to true
|
|
Role::ROLE_TYPE_GUEST,
|
|
Role::ROLE_TYPE_DEFAULT => false, // Guest/Default: all permissions forced to false
|
|
default => null, // Others: use provided values
|
|
};
|
|
|
|
$permissionFields = [
|
|
'canAccessAdminTools' => $canAccessAdminTools,
|
|
'canManageUsers' => $canManageUsers,
|
|
'canEditRoles' => $canEditRoles,
|
|
'canEditCategories' => $canEditCategories,
|
|
'canEditBbcodes' => $canEditBbcodes,
|
|
'canAccessModeration' => $canAccessModeration,
|
|
];
|
|
|
|
foreach ($permissionFields as $field => $value) {
|
|
$setter = 'set' . ucfirst($field);
|
|
if ($coercedPermissions !== null) {
|
|
$role->$setter($coercedPermissions);
|
|
} elseif ($value !== null) {
|
|
$role->$setter($value);
|
|
}
|
|
}
|
|
|
|
/** @var \OCA\Forum\Db\Role */
|
|
$updatedRole = $this->roleMapper->update($role);
|
|
return new DataResponse($updatedRole->jsonSerialize());
|
|
} catch (DoesNotExistException $e) {
|
|
return new DataResponse(['error' => 'Role not found'], Http::STATUS_NOT_FOUND);
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error updating role: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to update role'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Delete a role
|
|
*
|
|
* @param int $id Role ID
|
|
* @return DataResponse<Http::STATUS_OK, array{success: bool}, array{}>|DataResponse<Http::STATUS_FORBIDDEN, array{error: string}, array{}>
|
|
*
|
|
* 200: Role deleted
|
|
* 403: Cannot delete system roles
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canEditRoles')]
|
|
#[ApiRoute(verb: 'DELETE', url: '/api/roles/{id}')]
|
|
public function destroy(int $id): DataResponse {
|
|
try {
|
|
$role = $this->roleMapper->find($id);
|
|
|
|
// Prevent deleting system roles (Admin, Moderator, User)
|
|
if ($role->getIsSystemRole()) {
|
|
return new DataResponse(['error' => 'System roles cannot be deleted'], Http::STATUS_FORBIDDEN);
|
|
}
|
|
|
|
// Delete associated permissions
|
|
$this->categoryPermMapper->deleteByRoleId($id);
|
|
|
|
$this->roleMapper->delete($role);
|
|
return new DataResponse(['success' => true]);
|
|
} catch (DoesNotExistException $e) {
|
|
return new DataResponse(['error' => 'Role not found'], Http::STATUS_NOT_FOUND);
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error deleting role: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to delete role'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get permissions for a role
|
|
*
|
|
* @param int $id Role ID
|
|
* @param int<1, 100> $limit Maximum number of permissions to return
|
|
* @param int<0, max> $offset Offset for pagination
|
|
* @return DataResponse<Http::STATUS_OK, list<array<string, mixed>>, array{}>
|
|
*
|
|
* 200: Permissions returned
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canEditRoles')]
|
|
#[ApiRoute(verb: 'GET', url: '/api/roles/{id}/permissions')]
|
|
public function getPermissions(int $id, int $limit = 100, int $offset = 0): DataResponse {
|
|
try {
|
|
$permissions = array_slice($this->categoryPermMapper->findByRoleId($id), $offset, $limit);
|
|
return new DataResponse(array_map(fn ($perm) => $perm->jsonSerialize(), $permissions));
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error fetching role permissions: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to fetch permissions'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update permissions for a role
|
|
*
|
|
* @param int $id Role ID
|
|
* @param list<array{categoryId: int, canView: bool, canPost: bool, canReply: bool, canModerate: bool}> $permissions Permissions array
|
|
* @return DataResponse<Http::STATUS_OK, array{success: bool}, array{}>
|
|
*
|
|
* 200: Permissions updated
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[RequirePermission('canEditRoles')]
|
|
#[ApiRoute(verb: 'POST', url: '/api/roles/{id}/permissions')]
|
|
public function updatePermissions(int $id, array $permissions): DataResponse {
|
|
try {
|
|
// Verify role exists and get role type
|
|
$role = $this->roleMapper->find($id);
|
|
|
|
// Delete existing permissions for this role
|
|
$this->categoryPermMapper->deleteByRoleId($id);
|
|
|
|
// Insert new permissions
|
|
foreach ($permissions as $perm) {
|
|
$categoryPerm = new CategoryPerm();
|
|
$categoryPerm->setCategoryId($perm['categoryId']);
|
|
$categoryPerm->setTargetType(CategoryPerm::TARGET_TYPE_ROLE);
|
|
$categoryPerm->setTargetId((string)$id);
|
|
$categoryPerm->setCanView($perm['canView'] ?? false);
|
|
$categoryPerm->setCanPost($perm['canPost'] ?? $perm['canView'] ?? false);
|
|
$categoryPerm->setCanReply($perm['canReply'] ?? $perm['canPost'] ?? $perm['canView'] ?? false);
|
|
// Guest and Default roles never have moderate permission
|
|
$categoryPerm->setCanModerate($role->isModeratorRestricted() ? false : ($perm['canModerate'] ?? false));
|
|
|
|
$this->categoryPermMapper->insert($categoryPerm);
|
|
}
|
|
|
|
return new DataResponse(['success' => true]);
|
|
} catch (DoesNotExistException $e) {
|
|
return new DataResponse(['error' => 'Role not found'], Http::STATUS_NOT_FOUND);
|
|
} catch (\Exception $e) {
|
|
$this->logger->error('Error updating role permissions: ' . $e->getMessage());
|
|
return new DataResponse(['error' => 'Failed to update permissions'], Http::STATUS_INTERNAL_SERVER_ERROR);
|
|
}
|
|
}
|
|
}
|