AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-08-10 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add clientScopeSql helper for client-scoped list queries

Browse Source
This commit is contained in:
johnnyq
2026-08-06 11:25:11 -04:00
parent 49a3c2d266
commit 83383599a1
3 changed files with 37 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
api/v1/enforce_api_rbac.php
View File

@@ -45,24 +45,10 @@ function apiUserCanAccessClient($client_id) {
}
// Client-scope SQL fragment for a read query, from the user's allow / deny lists.
// Admin and unrestricted users get no restriction. Column-aware, so it works on any
// resource. Returns " AND ..." or "" (used after a "WHERE 1=1" anchor).
// Thin wrapper over clientScopeSql() in functions/auth.php so the API and the UI share one
// implementation. Kept under the api* name because every endpoint already calls it.
function apiClientScopeSql($column) {
global $session_is_admin, $client_access_array, $client_deny_array;
if ($session_is_admin) {
return '';
}
if (empty($client_access_array) && empty($client_deny_array)) {
return ''; // unrestricted user - all clients
}
$sql = '';
if (!empty($client_access_array)) {
$sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
}
if (!empty($client_deny_array)) {
$sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
}
return $sql;
return clientScopeSql($column);
}
// --- Every key must be tied to a user (legacy keys were removed in the 2.4.7 migration) ---