Add new role Project Administrator

This commit is contained in:
Frederic Guillot
2015-08-14 15:43:08 -04:00
parent 80fb3bc9aa
commit b2cce5a3a1
49 changed files with 337 additions and 78 deletions

View File

@@ -27,7 +27,7 @@ class User extends \Core\Base
return $this->user->remove($user_id);
}
public function createUser($username, $password, $name = '', $email = '', $is_admin = 0)
public function createUser($username, $password, $name = '', $email = '', $is_admin = 0, $is_project_admin = 0)
{
$values = array(
'username' => $username,
@@ -36,14 +36,14 @@ class User extends \Core\Base
'name' => $name,
'email' => $email,
'is_admin' => $is_admin,
'is_project_admin' => $is_project_admin,
);
list($valid,) = $this->user->validateCreation($values);
return $valid ? $this->user->create($values) : false;
}
public function createLdapUser($username = '', $email = '', $is_admin = 0)
public function createLdapUser($username = '', $email = '', $is_admin = 0, $is_project_admin = 0)
{
$ldap = new Ldap($this->container);
$user = $ldap->lookup($username, $email);
@@ -58,12 +58,13 @@ class User extends \Core\Base
'email' => $user['email'],
'is_ldap_user' => 1,
'is_admin' => $is_admin,
'is_project_admin' => $is_project_admin,
);
return $this->user->create($values);
}
public function updateUser($id, $username = null, $name = null, $email = null, $is_admin = null)
public function updateUser($id, $username = null, $name = null, $email = null, $is_admin = null, $is_project_admin = null)
{
$values = array(
'id' => $id,
@@ -71,6 +72,7 @@ class User extends \Core\Base
'name' => $name,
'email' => $email,
'is_admin' => $is_admin,
'is_project_admin' => $is_project_admin,
);
foreach ($values as $key => $value) {

View File

@@ -141,8 +141,15 @@ class Project extends Base
$project = $this->getProject();
$values = $this->request->getValues();
if ($project['is_private'] == 1 && $this->userSession->isAdmin() && ! isset($values['is_private'])) {
$values += array('is_private' => 0);
if (isset($values['is_private'])) {
if (! $this->helper->user->isProjectAdministrationAllowed($project['id'])) {
unset($values['is_private']);
}
}
else if ($project['is_private'] == 1 && ! isset($values['is_private'])) {
if ($this->helper->user->isProjectAdministrationAllowed($project['id'])) {
$values += array('is_private' => 0);
}
}
list($valid, $errors) = $this->project->validateModification($values);
@@ -402,7 +409,7 @@ class Project extends Base
*/
public function create(array $values = array(), array $errors = array())
{
$is_private = $this->request->getIntegerParam('private', $this->userSession->isAdmin() ? 0 : 1);
$is_private = $this->request->getIntegerParam('private', $this->userSession->isAdmin() || $this->userSession->isProjectAdmin() ? 0 : 1);
$this->response->html($this->template->layout('project/new', array(
'board_selector' => $this->projectPermission->getAllowedProjects($this->userSession->getId()),

View File

@@ -303,12 +303,16 @@ class User extends Base
$values = $this->request->getValues();
if ($this->userSession->isAdmin()) {
$values += array('is_admin' => 0);
$values += array('is_admin' => 0, 'is_project_admin' => 0);
}
else {
// Regular users can't be admin
if (isset($values['is_admin'])) {
unset($values['is_admin']); // Regular users can't be admin
unset($values['is_admin']);
}
if (isset($values['is_project_admin'])) {
unset($values['is_project_admin']);
}
}

View File

@@ -77,19 +77,44 @@ class User extends \Core\Base
}
/**
* Proxy cache helper for acl::isManagerActionAllowed()
* Return if the logged user is project admin
*
* @access public
* @param integer $project_id
* @return boolean
*/
public function isManager($project_id)
public function isProjectAdmin()
{
return $this->userSession->isProjectAdmin();
}
/**
* Check for project administration actions access (Project Admin group)
*
* @access public
* @return boolean
*/
public function isProjectAdministrationAllowed($project_id)
{
if ($this->userSession->isAdmin()) {
return true;
}
return $this->memoryCache->proxy('acl', 'isManagerActionAllowed', $project_id);
return $this->memoryCache->proxy('acl', 'handleProjectAdminPermissions', $project_id);
}
/**
* Check for project management actions access (Regular users who are Project Managers)
*
* @access public
* @return boolean
*/
public function isProjectManagementAllowed($project_id)
{
if ($this->userSession->isAdmin()) {
return true;
}
return $this->memoryCache->proxy('acl', 'handleProjectManagerPermissions', $project_id);
}
/**

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1017,4 +1017,6 @@ return array(
'contributors' => 'contributeurs',
'License:' => 'Licence :',
'License' => 'Licence',
'Project Administrator' => 'Administrateur de projet',
'Enter the text below' => 'Entrez le texte ci-dessous',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
'contributors' => 'contribuidores',
'License:' => 'Licença:',
'License' => 'Licença',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -1015,4 +1015,6 @@ return array(
// 'contributors' => '',
// 'License:' => '',
// 'License' => '',
// 'Project Administrator' => '',
// 'Enter the text below' => '',
);

View File

@@ -32,7 +32,7 @@ class Acl extends Base
* @access private
* @var array
*/
private $member_acl = array(
private $project_member_acl = array(
'board' => '*',
'comment' => '*',
'file' => '*',
@@ -56,17 +56,27 @@ class Acl extends Base
* @access private
* @var array
*/
private $manager_acl = array(
private $project_manager_acl = array(
'action' => '*',
'analytic' => '*',
'category' => '*',
'column' => '*',
'export' => array('tasks', 'subtasks', 'summary'),
'export' => '*',
'project' => array('edit', 'update', 'share', 'integration', 'users', 'alloweverybody', 'allow', 'setowner', 'revoke', 'duplicate', 'disable', 'enable'),
'swimlane' => '*',
'budget' => '*',
);
/**
* Controllers and actions for project admins
*
* @access private
* @var array
*/
private $project_admin_acl = array(
'project' => array('remove'),
);
/**
* Controllers and actions for admins
*
@@ -77,8 +87,6 @@ class Acl extends Base
'user' => array('index', 'create', 'save', 'remove', 'authentication'),
'config' => '*',
'link' => '*',
'project' => array('remove'),
'hourlyrate' => '*',
'currency' => '*',
'twofactor' => array('disable'),
);
@@ -149,9 +157,22 @@ class Acl extends Base
* @param string $action Action name
* @return bool
*/
public function isManagerAction($controller, $action)
public function isProjectManagerAction($controller, $action)
{
return $this->matchAcl($this->manager_acl, $controller, $action);
return $this->matchAcl($this->project_manager_acl, $controller, $action);
}
/**
* Return true if the given action is for application managers
*
* @access public
* @param string $controller Controller name
* @param string $action Action name
* @return bool
*/
public function isProjectAdminAction($controller, $action)
{
return $this->matchAcl($this->project_admin_acl, $controller, $action);
}
/**
@@ -162,9 +183,9 @@ class Acl extends Base
* @param string $action Action name
* @return bool
*/
public function isMemberAction($controller, $action)
public function isProjectMemberAction($controller, $action)
{
return $this->matchAcl($this->member_acl, $controller, $action);
return $this->matchAcl($this->project_member_acl, $controller, $action);
}
/**
@@ -189,13 +210,18 @@ class Acl extends Base
return false;
}
// Check project admin permissions
if ($this->isProjectAdminAction($controller, $action)) {
return $this->handleProjectAdminPermissions($project_id);
}
// Check project manager permissions
if ($this->isManagerAction($controller, $action)) {
return $this->isManagerActionAllowed($project_id);
if ($this->isProjectManagerAction($controller, $action)) {
return $this->handleProjectManagerPermissions($project_id);
}
// Check project member permissions
if ($this->isMemberAction($controller, $action)) {
if ($this->isProjectMemberAction($controller, $action)) {
return $project_id > 0 && $this->projectPermission->isMember($project_id, $this->userSession->getId());
}
@@ -203,12 +229,43 @@ class Acl extends Base
return true;
}
public function isManagerActionAllowed($project_id)
/**
* Handle permission for project manager
*
* @access public
* @param integer $project_id
* @return boolean
*/
public function handleProjectManagerPermissions($project_id)
{
if ($this->userSession->isAdmin()) {
return true;
if ($project_id > 0) {
if ($this->userSession->isProjectAdmin()) {
return $this->projectPermission->isMember($project_id, $this->userSession->getId());
}
return $this->projectPermission->isManager($project_id, $this->userSession->getId());
}
return $project_id > 0 && $this->projectPermission->isManager($project_id, $this->userSession->getId());
return false;
}
/**
* Handle permission for project admins
*
* @access public
* @param integer $project_id
* @return boolean
*/
public function handleProjectAdminPermissions($project_id)
{
if (! $this->userSession->isProjectAdmin()) {
return false;
}
if ($project_id > 0) {
return $this->projectPermission->isMember($project_id, $this->userSession->getId());
}
return true;
}
}

View File

@@ -57,6 +57,7 @@ class User extends Base
'name',
'email',
'is_admin',
'is_project_admin',
'is_ldap_user',
'notifications_enabled',
'google_id',
@@ -254,7 +255,7 @@ class User extends Base
}
$this->removeFields($values, array('confirmation', 'current_password'));
$this->resetFields($values, array('is_admin', 'is_ldap_user'));
$this->resetFields($values, array('is_admin', 'is_ldap_user', 'is_project_admin'));
}
/**
@@ -442,6 +443,7 @@ class User extends Base
new Validators\Unique('username', t('The username must be unique'), $this->db->getConnection(), self::TABLE, 'id'),
new Validators\Email('email', t('Email address invalid')),
new Validators\Integer('is_admin', t('This value must be an integer')),
new Validators\Integer('is_project_admin', t('This value must be an integer')),
new Validators\Integer('is_ldap_user', t('This value must be an integer')),
);
}

View File

@@ -34,6 +34,7 @@ class UserSession extends Base
$user['id'] = (int) $user['id'];
$user['is_admin'] = (bool) $user['is_admin'];
$user['is_project_admin'] = (bool) $user['is_project_admin'];
$user['is_ldap_user'] = (bool) $user['is_ldap_user'];
$user['twofactor_activated'] = (bool) $user['twofactor_activated'];
@@ -73,6 +74,17 @@ class UserSession extends Base
return isset($this->session['user']['is_admin']) && $this->session['user']['is_admin'] === true;
}
/**
* Return true if the logged user is project admin
*
* @access public
* @return bool
*/
public function isProjectAdmin()
{
return isset($this->session['user']['is_project_admin']) && $this->session['user']['is_project_admin'] === true;
}
/**
* Get the connected user id
*

View File

@@ -6,7 +6,12 @@ use PDO;
use Core\Security;
use Model\Link;
const VERSION = 82;
const VERSION = 83;
function version_83($pdo)
{
$pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INT DEFAULT 0");
}
function version_82($pdo)
{

View File

@@ -6,7 +6,12 @@ use PDO;
use Core\Security;
use Model\Link;
const VERSION = 62;
const VERSION = 63;
function version_63($pdo)
{
$pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INTEGER DEFAULT 0");
}
function version_62($pdo)
{

View File

@@ -6,7 +6,12 @@ use Core\Security;
use PDO;
use Model\Link;
const VERSION = 78;
const VERSION = 79;
function version_79($pdo)
{
$pdo->exec("ALTER TABLE users ADD COLUMN is_project_admin INTEGER DEFAULT 0");
}
function version_78($pdo)
{

View File

@@ -19,7 +19,7 @@
<i class="fa fa-calendar fa-fw"></i>
<?= $this->url->link(t('Back to the calendar'), 'calendar', 'show', array('project_id' => $project['id'])) ?>
</li>
<?php if ($this->user->isManager($project['id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($project['id'])): ?>
<li>
<i class="fa fa-cog fa-fw"></i>
<?= $this->url->link(t('Project settings'), 'project', 'show', array('project_id' => $project['id'])) ?>

View File

@@ -19,7 +19,7 @@
<i class="fa fa-calendar fa-fw"></i>
<?= $this->url->link(t('Back to the calendar'), 'calendar', 'show', array('project_id' => $project['id'])) ?>
</li>
<?php if ($this->user->isManager($project['id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($project['id'])): ?>
<li>
<i class="fa fa-cog fa-fw"></i>
<?= $this->url->link(t('Project settings'), 'project', 'show', array('project_id' => $project['id'])) ?>

View File

@@ -1,7 +1,7 @@
<section id="main">
<div class="page-header page-header-mobile">
<ul>
<?php if ($this->user->isAdmin()): ?>
<?php if ($this->user->isProjectAdmin()): ?>
<li>
<i class="fa fa-plus fa-fw"></i>
<?= $this->url->link(t('New project'), 'project', 'create') ?>

View File

@@ -16,7 +16,7 @@
<?= $this->url->link('#'.$project['id'], 'board', 'show', array('project_id' => $project['id']), false, 'dashboard-table-link') ?>
</td>
<td>
<?php if ($this->user->isManager($project['id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($project['id'])): ?>
<?= $this->url->link('<i class="fa fa-cog"></i>', 'project', 'show', array('project_id' => $project['id']), false, 'dashboard-table-link', t('Settings')) ?>&nbsp;
<?php endif ?>

View File

@@ -9,7 +9,7 @@
</li>
<?php endif ?>
<?php if ($this->user->isManager($project['id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($project['id'])): ?>
<li>
<i class="fa fa-line-chart fa-fw"></i>
<?= $this->url->link(t('Analytics'), 'analytic', 'tasks', array('project_id' => $project['id'])) ?>

View File

@@ -13,7 +13,7 @@
<?= $this->form->text('identifier', $values, $errors, array('maxlength="50"')) ?>
<p class="form-help"><?= t('The project identifier is an optional alphanumeric code used to identify your project.') ?></p>
<?php if ($this->user->isAdmin()): ?>
<?php if ($this->user->isAdmin() || $this->user->isProjectAdministrationAllowed($project['id'])): ?>
<?= $this->form->checkbox('is_private', t('Private project'), 1, $project['is_private'] == 1) ?>
<?php endif ?>

View File

@@ -1,7 +1,7 @@
<section id="main">
<div class="page-header">
<ul>
<?php if ($this->user->isAdmin()): ?>
<?php if ($this->user->isProjectAdmin()): ?>
<li><i class="fa fa-plus fa-fw"></i><?= $this->url->link(t('New project'), 'project', 'create') ?></li>
<?php endif ?>
<li><i class="fa fa-lock fa-fw"></i><?= $this->url->link(t('New private project'), 'project', 'create', array('private' => 1)) ?></li>

View File

@@ -5,7 +5,7 @@
<?= $this->url->link(t('Summary'), 'project', 'show', array('project_id' => $project['id'])) ?>
</li>
<?php if ($this->user->isManager($project['id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($project['id'])): ?>
<li>
<?= $this->url->link(t('Public access'), 'project', 'share', array('project_id' => $project['id'])) ?>
</li>
@@ -42,7 +42,7 @@
<?= $this->url->link(t('Enable'), 'project', 'enable', array('project_id' => $project['id']), true) ?>
<?php endif ?>
</li>
<?php if ($this->user->isAdmin()): ?>
<?php if ($this->user->isProjectAdministrationAllowed($project['id'])): ?>
<li>
<?= $this->url->link(t('Remove'), 'project', 'remove', array('project_id' => $project['id'])) ?>
</li>

View File

@@ -9,7 +9,7 @@
<i class="fa fa-calendar fa-fw"></i>
<?= $this->url->link(t('Back to the calendar'), 'calendar', 'show', array('project_id' => $task['project_id'])) ?>
</li>
<?php if ($this->user->isManager($task['project_id'])): ?>
<?php if ($this->user->isProjectManagementAllowed($task['project_id'])): ?>
<li>
<i class="fa fa-cog fa-fw"></i>
<?= $this->url->link(t('Project settings'), 'project', 'show', array('project_id' => $task['project_id'])) ?>

View File

@@ -39,6 +39,7 @@
<?= $this->form->checkbox('notifications_enabled', t('Enable notifications'), 1, isset($values['notifications_enabled']) && $values['notifications_enabled'] == 1 ? true : false) ?>
<?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1 ? true : false) ?>
<?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1 ? true : false) ?>
</div>
<div class="form-actions">

View File

@@ -39,6 +39,7 @@
<?= $this->form->checkbox('notifications_enabled', t('Enable notifications'), 1, isset($values['notifications_enabled']) && $values['notifications_enabled'] == 1 ? true : false) ?>
<?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1 ? true : false) ?>
<?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1 ? true : false) ?>
<?= $this->form->checkbox('disable_login_form', t('Disallow login form'), 1, isset($values['disable_login_form']) && $values['disable_login_form'] == 1) ?>
</div>

View File

@@ -24,6 +24,7 @@
<?php if ($this->user->isAdmin()): ?>
<?= $this->form->checkbox('is_admin', t('Administrator'), 1, isset($values['is_admin']) && $values['is_admin'] == 1) ?><br/>
<?= $this->form->checkbox('is_project_admin', t('Project Administrator'), 1, isset($values['is_project_admin']) && $values['is_project_admin'] == 1) ?><br/>
<?php endif ?>
<div class="form-actions">

View File

@@ -18,9 +18,9 @@
<th><?= $paginator->order(t('Name'), 'name') ?></th>
<th><?= $paginator->order(t('Email'), 'email') ?></th>
<th><?= $paginator->order(t('Administrator'), 'is_admin') ?></th>
<th><?= $paginator->order(t('Project Administrator'), 'is_project_admin') ?></th>
<th><?= $paginator->order(t('Two factor authentication'), 'twofactor_activated') ?></th>
<th><?= $paginator->order(t('Notifications'), 'notifications_enabled') ?></th>
<th><?= t('External accounts') ?></th>
<th><?= $paginator->order(t('Account type'), 'is_ldap_user') ?></th>
</tr>
<?php foreach ($paginator->getCollection() as $user): ?>
@@ -40,6 +40,9 @@
<td>
<?= $user['is_admin'] ? t('Yes') : t('No') ?>
</td>
<td>
<?= $user['is_project_admin'] ? t('Yes') : t('No') ?>
</td>
<td>
<?= $user['twofactor_activated'] ? t('Yes') : t('No') ?>
</td>
@@ -50,16 +53,6 @@
<?= t('Disabled') ?>
<?php endif ?>
</td>
<td>
<ul class="no-bullet">
<?php if ($user['google_id']): ?>
<li><i class="fa fa-google fa-fw"></i><?= t('Google account linked') ?></li>
<?php endif ?>
<?php if ($user['github_id']): ?>
<li><i class="fa fa-github fa-fw"></i><?= t('Github account linked') ?></li>
<?php endif ?>
</ul>
</td>
<td>
<?= $user['is_ldap_user'] ? t('Remote') : t('Local') ?>
</td>

View File

@@ -11,7 +11,7 @@
<h2><?= t('Security') ?></h2>
</div>
<ul class="listing">
<li><?= t('Group:') ?> <strong><?= $user['is_admin'] ? t('Administrator') : t('Regular user') ?></strong></li>
<li><?= t('Group:') ?> <strong><?= $user['is_admin'] ? t('Administrator') : ($user['is_project_admin'] ? t('Project Administrator') : t('Regular user')) ?></strong></li>
<li><?= t('Account type:') ?> <strong><?= $user['is_ldap_user'] ? t('Remote') : t('Local') ?></strong></li>
<li><?= $user['twofactor_activated'] == 1 ? t('Two factor authentication enabled') : t('Two factor authentication disabled') ?></li>
</ul>