AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Centralize client portal access checks through contactCan()

Browse Source 
Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.
This commit is contained in:
johnnyq
2026-07-25 17:55:30 -04:00
parent 887063394a
commit 497ea3b669
18 changed files with 62 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
client/functions.php
View File

@@ -7,8 +7,7 @@
/*
* Verifies a contact has access to a particular ticket ID, and that the ticket is in the correct state (open/closed) to perform an action
*/
function verifyContactTicketAccess($requested_ticket_id, $expected_ticket_state)
{
function verifyContactTicketAccess($requested_ticket_id, $expected_ticket_state) {
// Access the global variables
global $mysqli, $session_contact_id, $session_contact_primary, $session_contact_is_technical_contact, $session_client_id;
@@ -38,6 +37,41 @@ function verifyContactTicketAccess($requested_ticket_id, $expected_ticket_state)
}
/*
* Portal access control - single source of truth for what a logged-in contact can do.
* Primary contacts have full access; others are gated by their billing / technical flags.
* Capabilities are named by area so the rule for one can change without touching callers.
*/
function contactCan($capability) {
global $session_contact_primary, $session_contact_is_billing_contact, $session_contact_is_technical_contact;
// Primary contacts can do everything in the portal
if ($session_contact_primary == 1) {
return true;
}
switch ($capability) {
case 'accounting': // invoices, quotes, recurring invoices, saved payment methods
return (bool) $session_contact_is_billing_contact;
case 'itdoc': // assets, certificates, domains, documents, files
case 'contacts': // view / manage contacts
return (bool) $session_contact_is_technical_contact;
default: // unknown capability -> deny (fail closed)
return false;
}
}
/*
* Enforce a capability at the top of a page or handler - bounce the contact out if they lack it.
*/
function enforceContactCan($capability) {
if (!contactCan($capability)) {
redirect("post.php?logout");
}
}
/*
* Returns appropriate FontAwesome icon for file extension
*/