AS1024
/
Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add new project role restriction to block task suppression

This commit is contained in:
Frederic Guillot 2017-04-05 19:16:04 -04:00
parent 947f4bbc07
commit 66c8351ad4
4 changed files with 135 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

143
app/Helper/ProjectRoleHelper.php
View File

@ -19,12 +19,12 @@ class ProjectRoleHelper extends Base
* Get project role for the current user
*
* @access public
* @param integer $project_id
* @param integer $projectId
* @return string
*/
public function getProjectUserRole($project_id)
public function getProjectUserRole($projectId)
{
return $this->memoryCache->proxy($this->projectUserRoleModel, 'getUserRole', $project_id, $this->userSession->getId());
return $this->memoryCache->proxy($this->projectUserRoleModel, 'getUserRole', $projectId, $this->userSession->getId());
}
/**
@ -45,24 +45,24 @@ class ProjectRoleHelper extends Base
/**
* Return true is the column is sortable
*
* @param int $project_id
* @param int $column_id
* @param int $projectId
* @param int $columnId
* @return bool
*/
public function isSortableColumn($project_id, $column_id)
public function isSortableColumn($projectId, $columnId)
{
$role = $this->getProjectUserRole($project_id);
$role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) {
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($project_id, $role);
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($projectId, $role);
foreach ($sortableColumns as $column) {
if ($column['src_column_id'] == $column_id || $column['dst_column_id'] == $column_id) {
if ($column['src_column_id'] == $columnId || $column['dst_column_id'] == $columnId) {
return true;
}
}
return empty($sortableColumns) && $this->isAllowedToMoveTask($project_id, $role);
return empty($sortableColumns) && $this->isAllowedToMoveTask($projectId, $role);
}
return true;
@ -71,33 +71,33 @@ class ProjectRoleHelper extends Base
/**
* Check if the user can move a task
*
* @param int $project_id
* @param int $src_column_id
* @param int $dst_column_id
* @param int $projectId
* @param int $srcColumnId
* @param int $dstColumnId
* @return bool|int
*/
public function canMoveTask($project_id, $src_column_id, $dst_column_id)
public function canMoveTask($projectId, $srcColumnId, $dstColumnId)
{
$role = $this->getProjectUserRole($project_id);
$role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) {
if ($src_column_id == $dst_column_id) {
if ($srcColumnId == $dstColumnId) {
return true;
}
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($project_id, $role);
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($projectId, $role);
foreach ($sortableColumns as $column) {
if ($column['src_column_id'] == $src_column_id && $column['dst_column_id'] == $dst_column_id) {
if ($column['src_column_id'] == $srcColumnId && $column['dst_column_id'] == $dstColumnId) {
return true;
}
if ($column['dst_column_id'] == $src_column_id && $column['src_column_id'] == $dst_column_id) {
if ($column['dst_column_id'] == $srcColumnId && $column['src_column_id'] == $dstColumnId) {
return true;
}
}
return empty($sortableColumns) && $this->isAllowedToMoveTask($project_id, $role);
return empty($sortableColumns) && $this->isAllowedToMoveTask($projectId, $role);
}
return true;
@ -106,41 +106,41 @@ class ProjectRoleHelper extends Base
/**
* Return true if the user can create a task for the given column
*
* @param int $project_id
* @param int $column_id
* @param int $projectId
* @param int $columnId
* @return bool
*/
public function canCreateTaskInColumn($project_id, $column_id)
public function canCreateTaskInColumn($projectId, $columnId)
{
$role = $this->getProjectUserRole($project_id);
$role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) {
if (! $this->isAllowedToCreateTask($project_id, $column_id, $role)) {
if (! $this->isAllowedToCreateTask($projectId, $columnId, $role)) {
return false;
}
}
return $this->helper->user->hasProjectAccess('TaskCreationController', 'show', $project_id);
return $this->helper->user->hasProjectAccess('TaskCreationController', 'show', $projectId);
}
/**
* Return true if the user can create a task for the given column
*
* @param int $project_id
* @param int $column_id
* @param int $projectId
* @param int $columnId
* @return bool
*/
public function canChangeTaskStatusInColumn($project_id, $column_id)
public function canChangeTaskStatusInColumn($projectId, $columnId)
{
$role = $this->getProjectUserRole($project_id);
$role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) {
if (! $this->isAllowedToChangeTaskStatus($project_id, $column_id, $role)) {
if (! $this->isAllowedToChangeTaskStatus($projectId, $columnId, $role)) {
return false;
}
}
return $this->helper->user->hasProjectAccess('TaskStatusController', 'close', $project_id);
return $this->helper->user->hasProjectAccess('TaskStatusController', 'close', $projectId);
}
/**
@ -154,6 +154,12 @@ class ProjectRoleHelper extends Base
*/
public function canRemoveTask(array $task)
{
$role = $this->getProjectUserRole($task['project_id']);
if ($this->hasRestriction($task['project_id'], $role, ProjectRoleRestrictionModel::RULE_TASK_SUPPRESSION)) {
return false;
}
if (isset($task['creator_id']) && $task['creator_id'] == $this->userSession->getId()) {
return true;
}
@ -170,10 +176,10 @@ class ProjectRoleHelper extends Base
*
* @param string $controller
* @param string $action
* @param integer $project_id
* @param integer $projectId
* @return bool
*/
public function checkProjectAccess($controller, $action, $project_id)
public function checkProjectAccess($controller, $action, $projectId)
{
if (! $this->userSession->isLogged()) {
return false;
@ -187,7 +193,7 @@ class ProjectRoleHelper extends Base
return false;
}
$role = $this->getProjectUserRole($project_id);
$role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) {
$result = $this->projectAuthorization->isAllowed($controller, $action, Role::PROJECT_MEMBER);
@ -201,17 +207,17 @@ class ProjectRoleHelper extends Base
/**
* Check authorization for a custom project role to change the task status
*
* @param int $project_id
* @param int $column_id
* @param int $projectId
* @param int $columnId
* @param string $role
* @return bool
*/
protected function isAllowedToChangeTaskStatus($project_id, $column_id, $role)
protected function isAllowedToChangeTaskStatus($projectId, $columnId, $role)
{
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($project_id, $role);
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($columnRestrictions as $restriction) {
if ($restriction['column_id'] == $column_id) {
if ($restriction['column_id'] == $columnId) {
if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_OPEN_CLOSE) {
return true;
} else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_OPEN_CLOSE) {
@ -220,31 +226,23 @@ class ProjectRoleHelper extends Base
}
}
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE) {
return false;
}
}
return true;
return ! $this->hasRestriction($projectId, $role, ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE);
}
/**
* Check authorization for a custom project role to create a task
*
* @param int $project_id
* @param int $column_id
* @param int $projectId
* @param int $columnId
* @param string $role
* @return bool
*/
protected function isAllowedToCreateTask($project_id, $column_id, $role)
protected function isAllowedToCreateTask($projectId, $columnId, $role)
{
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($project_id, $role);
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($columnRestrictions as $restriction) {
if ($restriction['column_id'] == $column_id) {
if ($restriction['column_id'] == $columnId) {
if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_CREATION) {
return true;
} else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_CREATION) {
@ -253,27 +251,19 @@ class ProjectRoleHelper extends Base
}
}
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_CREATION) {
return false;
}
}
return true;
return ! $this->hasRestriction($projectId, $role, ProjectRoleRestrictionModel::RULE_TASK_CREATION);
}
/**
* Check if the role can move task in the given project
*
* @param int $project_id
* @param int $projectId
* @param string $role
* @return bool
*/
protected function isAllowedToMoveTask($project_id, $role)
protected function isAllowedToMoveTask($projectId, $role)
{
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role);
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_MOVE) {
@ -283,4 +273,25 @@ class ProjectRoleHelper extends Base
return true;
}
/**
* Check if given role has a restriction
*
* @param integer $projectId
* @param string $role
* @param string $rule
* @return bool
*/
protected function hasRestriction($projectId, $role, $rule)
{
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == $rule) {
return true;
}
}
return false;
}
}

2
app/Model/ProjectRoleRestrictionModel.php
View File

@ -15,6 +15,7 @@ class ProjectRoleRestrictionModel extends Base
const TABLE = 'project_role_has_restrictions';
const RULE_TASK_CREATION = 'task_creation';
const RULE_TASK_SUPPRESSION = 'task_remove';
const RULE_TASK_OPEN_CLOSE = 'task_open_close';
const RULE_TASK_MOVE = 'task_move';
@ -27,6 +28,7 @@ class ProjectRoleRestrictionModel extends Base
{
return array(
self::RULE_TASK_CREATION => t('Task creation is not permitted'),
self::RULE_TASK_SUPPRESSION => t('Task suppression is not permitted'),
self::RULE_TASK_OPEN_CLOSE => t('Closing or opening a task is not permitted'),
self::RULE_TASK_MOVE => t('Moving a task is not permitted'),
);

55
tests/units/Helper/ProjectRoleHelperTest.php
View File

@ -106,6 +106,61 @@ class ProjectRoleHelperTest extends Base
$this->assertFalse($projectRoleHelper->canCreateTaskInColumn(1, 2));
}
public function testCanRemoveTaskWithCustomProjectRole()
{
$projectRoleHelper = new ProjectRoleHelper($this->container);
$projectModel = new ProjectModel($this->container);
$projectUserRole = new ProjectUserRoleModel($this->container);
$userModel = new UserModel($this->container);
$projectRoleModel = new ProjectRoleModel($this->container);
$taskCreationModel = new TaskCreationModel($this->container);
$taskFinderModel = new TaskFinderModel($this->container);
$projectRoleRestrictionModel = new ProjectRoleRestrictionModel($this->container);
$this->container['sessionStorage']->user = array(
'id' => 2,
'role' => Role::APP_USER,
);
$this->assertEquals(2, $userModel->create(array('username' => 'user')));
$this->assertEquals(1, $projectModel->create(array('name' => 'Test')));
$this->assertEquals(1, $taskCreationModel->create(array('project_id' => 1 , 'title' => 'test')));
$this->assertEquals(1, $projectRoleModel->create(1, 'Custom Role'));
$this->assertTrue($projectUserRole->addUser(1, 2, 'Custom Role'));
$this->assertEquals(1, $projectRoleRestrictionModel->create(1, 1, ProjectRoleRestrictionModel::RULE_TASK_SUPPRESSION));
$task = $taskFinderModel->getById(1);
$this->assertFalse($projectRoleHelper->canRemoveTask($task));
}
public function testCanRemoveTaskWithCustomProjectRoleWithRestriction()
{
$projectRoleHelper = new ProjectRoleHelper($this->container);
$projectModel = new ProjectModel($this->container);
$projectUserRole = new ProjectUserRoleModel($this->container);
$userModel = new UserModel($this->container);
$projectRoleModel = new ProjectRoleModel($this->container);
$taskCreationModel = new TaskCreationModel($this->container);
$taskFinderModel = new TaskFinderModel($this->container);
$this->container['sessionStorage']->user = array(
'id' => 2,
'role' => Role::APP_USER,
);
$this->assertEquals(2, $userModel->create(array('username' => 'user')));
$this->assertEquals(1, $projectModel->create(array('name' => 'Test')));
$this->assertEquals(1, $taskCreationModel->create(array('project_id' => 1 , 'title' => 'test')));
$this->assertEquals(1, $projectRoleModel->create(1, 'Custom Role'));
$this->assertTrue($projectUserRole->addUser(1, 2, 'Custom Role'));
$task = $taskFinderModel->getById(1);
$this->assertTrue($projectRoleHelper->canRemoveTask($task));
}
public function testCanChangeTaskStatusInColumnWithProjectViewer()
{
$projectRoleHelper = new ProjectRoleHelper($this->container);

2
tests/units/Model/ProjectRoleRestrictionModelTest.php
View File

@ -90,7 +90,7 @@ class ProjectRoleRestrictionModelTest extends Base
$projectRoleRestrictionModel = new ProjectRoleRestrictionModel($this->container);
$rules = $projectRoleRestrictionModel->getRules();
$this->assertCount(3, $rules);
$this->assertCount(4, $rules);
$this->assertArrayHasKey(ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE, $rules);
}
}