AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add new project role restriction to block task suppression

Browse Source
This commit is contained in:
Frederic Guillot
2017-04-05 19:16:04 -04:00
parent 947f4bbc07
commit 66c8351ad4
4 changed files with 135 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
app/Helper/ProjectRoleHelper.php
View File

@@ -19,12 +19,12 @@ class ProjectRoleHelper extends Base
* Get project role for the current user * Get project role for the current user
* *
* @access public * @access public
* @param integer $project_id * @param integer $projectId
* @return string * @return string
*/ */
public function getProjectUserRole($project_id) public function getProjectUserRole($projectId)
{ {
return $this->memoryCache->proxy($this->projectUserRoleModel, 'getUserRole', $project_id, $this->userSession->getId()); return $this->memoryCache->proxy($this->projectUserRoleModel, 'getUserRole', $projectId, $this->userSession->getId());
} }
/** /**
@@ -45,24 +45,24 @@ class ProjectRoleHelper extends Base
/** /**
* Return true is the column is sortable * Return true is the column is sortable
* *
* @param int $project_id * @param int $projectId
* @param int $column_id * @param int $columnId
* @return bool * @return bool
*/ */
public function isSortableColumn($project_id, $column_id) public function isSortableColumn($projectId, $columnId)
{ {
$role = $this->getProjectUserRole($project_id); $role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) { if ($this->role->isCustomProjectRole($role)) {
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($project_id, $role); $sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($projectId, $role);
foreach ($sortableColumns as $column) { foreach ($sortableColumns as $column) {
if ($column['src_column_id'] == $column_id || $column['dst_column_id'] == $column_id) { if ($column['src_column_id'] == $columnId || $column['dst_column_id'] == $columnId) {
return true; return true;
} }
} }
return empty($sortableColumns) && $this->isAllowedToMoveTask($project_id, $role); return empty($sortableColumns) && $this->isAllowedToMoveTask($projectId, $role);
} }
return true; return true;
@@ -71,33 +71,33 @@ class ProjectRoleHelper extends Base
/** /**
* Check if the user can move a task * Check if the user can move a task
* *
* @param int $project_id * @param int $projectId
* @param int $src_column_id * @param int $srcColumnId
* @param int $dst_column_id * @param int $dstColumnId
* @return bool|int * @return bool|int
*/ */
public function canMoveTask($project_id, $src_column_id, $dst_column_id) public function canMoveTask($projectId, $srcColumnId, $dstColumnId)
{ {
$role = $this->getProjectUserRole($project_id); $role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) { if ($this->role->isCustomProjectRole($role)) {
if ($src_column_id == $dst_column_id) { if ($srcColumnId == $dstColumnId) {
return true; return true;
} }
$sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($project_id, $role); $sortableColumns = $this->columnMoveRestrictionCacheDecorator->getSortableColumns($projectId, $role);
foreach ($sortableColumns as $column) { foreach ($sortableColumns as $column) {
if ($column['src_column_id'] == $src_column_id && $column['dst_column_id'] == $dst_column_id) { if ($column['src_column_id'] == $srcColumnId && $column['dst_column_id'] == $dstColumnId) {
return true; return true;
} }
if ($column['dst_column_id'] == $src_column_id && $column['src_column_id'] == $dst_column_id) { if ($column['dst_column_id'] == $srcColumnId && $column['src_column_id'] == $dstColumnId) {
return true; return true;
} }
} }
return empty($sortableColumns) && $this->isAllowedToMoveTask($project_id, $role); return empty($sortableColumns) && $this->isAllowedToMoveTask($projectId, $role);
} }
return true; return true;
@@ -106,41 +106,41 @@ class ProjectRoleHelper extends Base
/** /**
* Return true if the user can create a task for the given column * Return true if the user can create a task for the given column
* *
* @param int $project_id * @param int $projectId
* @param int $column_id * @param int $columnId
* @return bool * @return bool
*/ */
public function canCreateTaskInColumn($project_id, $column_id) public function canCreateTaskInColumn($projectId, $columnId)
{ {
$role = $this->getProjectUserRole($project_id); $role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) { if ($this->role->isCustomProjectRole($role)) {
if (! $this->isAllowedToCreateTask($project_id, $column_id, $role)) { if (! $this->isAllowedToCreateTask($projectId, $columnId, $role)) {
return false; return false;
} }
} }
return $this->helper->user->hasProjectAccess('TaskCreationController', 'show', $project_id); return $this->helper->user->hasProjectAccess('TaskCreationController', 'show', $projectId);
} }
/** /**
* Return true if the user can create a task for the given column * Return true if the user can create a task for the given column
* *
* @param int $project_id * @param int $projectId
* @param int $column_id * @param int $columnId
* @return bool * @return bool
*/ */
public function canChangeTaskStatusInColumn($project_id, $column_id) public function canChangeTaskStatusInColumn($projectId, $columnId)
{ {
$role = $this->getProjectUserRole($project_id); $role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) { if ($this->role->isCustomProjectRole($role)) {
if (! $this->isAllowedToChangeTaskStatus($project_id, $column_id, $role)) { if (! $this->isAllowedToChangeTaskStatus($projectId, $columnId, $role)) {
return false; return false;
} }
} }
return $this->helper->user->hasProjectAccess('TaskStatusController', 'close', $project_id); return $this->helper->user->hasProjectAccess('TaskStatusController', 'close', $projectId);
} }
/** /**
@@ -154,6 +154,12 @@ class ProjectRoleHelper extends Base
*/ */
public function canRemoveTask(array $task) public function canRemoveTask(array $task)
{ {
$role = $this->getProjectUserRole($task['project_id']);
if ($this->hasRestriction($task['project_id'], $role, ProjectRoleRestrictionModel::RULE_TASK_SUPPRESSION)) {
return false;
}
if (isset($task['creator_id']) && $task['creator_id'] == $this->userSession->getId()) { if (isset($task['creator_id']) && $task['creator_id'] == $this->userSession->getId()) {
return true; return true;
} }
@@ -170,10 +176,10 @@ class ProjectRoleHelper extends Base
* *
* @param string $controller * @param string $controller
* @param string $action * @param string $action
* @param integer $project_id * @param integer $projectId
* @return bool * @return bool
*/ */
public function checkProjectAccess($controller, $action, $project_id) public function checkProjectAccess($controller, $action, $projectId)
{ {
if (! $this->userSession->isLogged()) { if (! $this->userSession->isLogged()) {
return false; return false;
@@ -187,7 +193,7 @@ class ProjectRoleHelper extends Base
return false; return false;
} }
$role = $this->getProjectUserRole($project_id); $role = $this->getProjectUserRole($projectId);
if ($this->role->isCustomProjectRole($role)) { if ($this->role->isCustomProjectRole($role)) {
$result = $this->projectAuthorization->isAllowed($controller, $action, Role::PROJECT_MEMBER); $result = $this->projectAuthorization->isAllowed($controller, $action, Role::PROJECT_MEMBER);
@@ -201,17 +207,17 @@ class ProjectRoleHelper extends Base
/** /**
* Check authorization for a custom project role to change the task status * Check authorization for a custom project role to change the task status
* *
* @param int $project_id * @param int $projectId
* @param int $column_id * @param int $columnId
* @param string $role * @param string $role
* @return bool * @return bool
*/ */
protected function isAllowedToChangeTaskStatus($project_id, $column_id, $role) protected function isAllowedToChangeTaskStatus($projectId, $columnId, $role)
{ {
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($project_id, $role); $columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($columnRestrictions as $restriction) { foreach ($columnRestrictions as $restriction) {
if ($restriction['column_id'] == $column_id) { if ($restriction['column_id'] == $columnId) {
if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_OPEN_CLOSE) { if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_OPEN_CLOSE) {
return true; return true;
} else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_OPEN_CLOSE) { } else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_OPEN_CLOSE) {
@@ -220,31 +226,23 @@ class ProjectRoleHelper extends Base
} }
} }
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role); return ! $this->hasRestriction($projectId, $role, ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE) {
return false;
}
}
return true;
} }
/** /**
* Check authorization for a custom project role to create a task * Check authorization for a custom project role to create a task
* *
* @param int $project_id * @param int $projectId
* @param int $column_id * @param int $columnId
* @param string $role * @param string $role
* @return bool * @return bool
*/ */
protected function isAllowedToCreateTask($project_id, $column_id, $role) protected function isAllowedToCreateTask($projectId, $columnId, $role)
{ {
$columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($project_id, $role); $columnRestrictions = $this->columnRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($columnRestrictions as $restriction) { foreach ($columnRestrictions as $restriction) {
if ($restriction['column_id'] == $column_id) { if ($restriction['column_id'] == $columnId) {
if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_CREATION) { if ($restriction['rule'] == ColumnRestrictionModel::RULE_ALLOW_TASK_CREATION) {
return true; return true;
} else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_CREATION) { } else if ($restriction['rule'] == ColumnRestrictionModel::RULE_BLOCK_TASK_CREATION) {
@@ -253,27 +251,19 @@ class ProjectRoleHelper extends Base
} }
} }
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role); return ! $this->hasRestriction($projectId, $role, ProjectRoleRestrictionModel::RULE_TASK_CREATION);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_CREATION) {
return false;
}
}
return true;
} }
/** /**
* Check if the role can move task in the given project * Check if the role can move task in the given project
* *
* @param int $project_id * @param int $projectId
* @param string $role * @param string $role
* @return bool * @return bool
*/ */
protected function isAllowedToMoveTask($project_id, $role) protected function isAllowedToMoveTask($projectId, $role)
{ {
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($project_id, $role); $projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($projectRestrictions as $restriction) { foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_MOVE) { if ($restriction['rule'] == ProjectRoleRestrictionModel::RULE_TASK_MOVE) {
@@ -283,4 +273,25 @@ class ProjectRoleHelper extends Base
return true; return true;
} }
/**
* Check if given role has a restriction
*
* @param integer $projectId
* @param string $role
* @param string $rule
* @return bool
*/
protected function hasRestriction($projectId, $role, $rule)
{
$projectRestrictions = $this->projectRoleRestrictionCacheDecorator->getAllByRole($projectId, $role);
foreach ($projectRestrictions as $restriction) {
if ($restriction['rule'] == $rule) {
return true;
}
}
return false;
}
} }

2
app/Model/ProjectRoleRestrictionModel.php
View File

@@ -15,6 +15,7 @@ class ProjectRoleRestrictionModel extends Base
const TABLE = 'project_role_has_restrictions'; const TABLE = 'project_role_has_restrictions';
const RULE_TASK_CREATION = 'task_creation'; const RULE_TASK_CREATION = 'task_creation';
const RULE_TASK_SUPPRESSION = 'task_remove';
const RULE_TASK_OPEN_CLOSE = 'task_open_close'; const RULE_TASK_OPEN_CLOSE = 'task_open_close';
const RULE_TASK_MOVE = 'task_move'; const RULE_TASK_MOVE = 'task_move';
@@ -27,6 +28,7 @@ class ProjectRoleRestrictionModel extends Base
{ {
return array( return array(
self::RULE_TASK_CREATION => t('Task creation is not permitted'), self::RULE_TASK_CREATION => t('Task creation is not permitted'),
self::RULE_TASK_SUPPRESSION => t('Task suppression is not permitted'),
self::RULE_TASK_OPEN_CLOSE => t('Closing or opening a task is not permitted'), self::RULE_TASK_OPEN_CLOSE => t('Closing or opening a task is not permitted'),
self::RULE_TASK_MOVE => t('Moving a task is not permitted'), self::RULE_TASK_MOVE => t('Moving a task is not permitted'),
); );

55
tests/units/Helper/ProjectRoleHelperTest.php
View File

@@ -106,6 +106,61 @@ class ProjectRoleHelperTest extends Base
$this->assertFalse($projectRoleHelper->canCreateTaskInColumn(1, 2)); $this->assertFalse($projectRoleHelper->canCreateTaskInColumn(1, 2));
} }
public function testCanRemoveTaskWithCustomProjectRole()
{
$projectRoleHelper = new ProjectRoleHelper($this->container);
$projectModel = new ProjectModel($this->container);
$projectUserRole = new ProjectUserRoleModel($this->container);
$userModel = new UserModel($this->container);
$projectRoleModel = new ProjectRoleModel($this->container);
$taskCreationModel = new TaskCreationModel($this->container);
$taskFinderModel = new TaskFinderModel($this->container);
$projectRoleRestrictionModel = new ProjectRoleRestrictionModel($this->container);
$this->container['sessionStorage']->user = array(
'id' => 2,
'role' => Role::APP_USER,
);
$this->assertEquals(2, $userModel->create(array('username' => 'user')));
$this->assertEquals(1, $projectModel->create(array('name' => 'Test')));
$this->assertEquals(1, $taskCreationModel->create(array('project_id' => 1 , 'title' => 'test')));
$this->assertEquals(1, $projectRoleModel->create(1, 'Custom Role'));
$this->assertTrue($projectUserRole->addUser(1, 2, 'Custom Role'));
$this->assertEquals(1, $projectRoleRestrictionModel->create(1, 1, ProjectRoleRestrictionModel::RULE_TASK_SUPPRESSION));
$task = $taskFinderModel->getById(1);
$this->assertFalse($projectRoleHelper->canRemoveTask($task));
}
public function testCanRemoveTaskWithCustomProjectRoleWithRestriction()
{
$projectRoleHelper = new ProjectRoleHelper($this->container);
$projectModel = new ProjectModel($this->container);
$projectUserRole = new ProjectUserRoleModel($this->container);
$userModel = new UserModel($this->container);
$projectRoleModel = new ProjectRoleModel($this->container);
$taskCreationModel = new TaskCreationModel($this->container);
$taskFinderModel = new TaskFinderModel($this->container);
$this->container['sessionStorage']->user = array(
'id' => 2,
'role' => Role::APP_USER,
);
$this->assertEquals(2, $userModel->create(array('username' => 'user')));
$this->assertEquals(1, $projectModel->create(array('name' => 'Test')));
$this->assertEquals(1, $taskCreationModel->create(array('project_id' => 1 , 'title' => 'test')));
$this->assertEquals(1, $projectRoleModel->create(1, 'Custom Role'));
$this->assertTrue($projectUserRole->addUser(1, 2, 'Custom Role'));
$task = $taskFinderModel->getById(1);
$this->assertTrue($projectRoleHelper->canRemoveTask($task));
}
public function testCanChangeTaskStatusInColumnWithProjectViewer() public function testCanChangeTaskStatusInColumnWithProjectViewer()
{ {
$projectRoleHelper = new ProjectRoleHelper($this->container); $projectRoleHelper = new ProjectRoleHelper($this->container);

2
tests/units/Model/ProjectRoleRestrictionModelTest.php
View File

@@ -90,7 +90,7 @@ class ProjectRoleRestrictionModelTest extends Base
$projectRoleRestrictionModel = new ProjectRoleRestrictionModel($this->container); $projectRoleRestrictionModel = new ProjectRoleRestrictionModel($this->container);
$rules = $projectRoleRestrictionModel->getRules(); $rules = $projectRoleRestrictionModel->getRules();
$this->assertCount(3, $rules); $this->assertCount(4, $rules);
$this->assertArrayHasKey(ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE, $rules); $this->assertArrayHasKey(ProjectRoleRestrictionModel::RULE_TASK_OPEN_CLOSE, $rules);
} }
} }