GroupPermissionsLookup.php

Go to the documentation of this file.

<?php
namespace MediaWiki\Permissions;
 
use MediaWiki\Config\ServiceOptions;
use MediaWiki\MainConfigNames;
 
class GroupPermissionsLookup {
 
    public const CONSTRUCTOR_OPTIONS = [
        MainConfigNames::GroupInheritsPermissions,
        MainConfigNames::GroupPermissions,
        MainConfigNames::RevokePermissions,
    ];
 
    private $groupPermissions;
 
    private $revokePermissions;
 
    private $groupInheritance;
 
    /*
     * @param ServiceOptions $options
     */
    public function __construct( ServiceOptions $options ) {
        $options->assertRequiredOptions( self::CONSTRUCTOR_OPTIONS );
        $this->groupPermissions = $options->get( MainConfigNames::GroupPermissions );
        $this->revokePermissions = $options->get( MainConfigNames::RevokePermissions );
        $this->groupInheritance = $options->get( MainConfigNames::GroupInheritsPermissions );
    }
 
    public function groupHasPermission( string $group, string $permission ): bool {
        $inheritsFrom = $this->groupInheritance[$group] ?? false;
        $has = isset( $this->groupPermissions[$group][$permission] ) &&
            $this->groupPermissions[$group][$permission];
        // If the group doesn't have the permission and inherits from somewhere,
        // check that group too
        if ( !$has && $inheritsFrom !== false ) {
            $has = isset( $this->groupPermissions[$inheritsFrom][$permission] ) &&
                $this->groupPermissions[$inheritsFrom][$permission];
        }
        if ( !$has ) {
            // If they don't have the permission, exit early
            return false;
        }
 
        // Check if the permission has been revoked
        $revoked = isset( $this->revokePermissions[$group][$permission] ) &&
        $this->revokePermissions[$group][$permission];
        if ( !$revoked && $inheritsFrom !== false ) {
            $revoked = isset( $this->revokePermissions[$inheritsFrom][$permission] ) &&
                $this->revokePermissions[$inheritsFrom][$permission];
        }
 
        return !$revoked;
    }
 
    public function getGrantedPermissions( string $group ): array {
        $rights = array_keys( array_filter( $this->groupPermissions[$group] ?? [] ) );
        $inheritsFrom = $this->groupInheritance[$group] ?? false;
        if ( $inheritsFrom !== false ) {
            $rights = array_merge(
                $rights,
                // array_filter removes empty items
                array_keys( array_filter( $this->groupPermissions[$inheritsFrom] ?? [] ) )
            );
        }
 
        return array_unique( $rights );
    }
 
    public function getRevokedPermissions( string $group ): array {
        $rights = array_keys( array_filter( $this->revokePermissions[$group] ?? [] ) );
        $inheritsFrom = $this->groupInheritance[$group] ?? false;
        if ( $inheritsFrom !== false ) {
            $rights = array_merge(
                $rights,
                // array_filter removes empty items
                array_keys( array_filter( $this->revokePermissions[$inheritsFrom] ?? [] ) )
            );
        }
 
        return array_unique( $rights );
    }
 
    public function getGroupPermissions( array $groups ): array {
        $rights = [];
        $checkGroups = [];
 
        // Add inherited groups to the list of groups to check
        foreach ( $groups as $group ) {
            $checkGroups[] = $group;
            if ( isset( $this->groupInheritance[$group] ) ) {
                $checkGroups[] = $this->groupInheritance[$group];
            }
        }
 
        // grant every granted permission first
        foreach ( $checkGroups as $group ) {
            if ( isset( $this->groupPermissions[$group] ) ) {
                $rights = array_merge(
                    $rights,
                    // array_filter removes empty items
                    array_keys( array_filter( $this->groupPermissions[$group] ) )
                );
            }
        }
        // now revoke the revoked permissions
        foreach ( $checkGroups as $group ) {
            if ( isset( $this->revokePermissions[$group] ) ) {
                $rights = array_diff(
                    $rights,
                    array_keys( array_filter( $this->revokePermissions[$group] ) )
                );
            }
        }
        return array_unique( $rights );
    }
 
    public function getGroupsWithPermission( string $permission ): array {
        $allowedGroups = [];
        $groups = array_merge(
            array_keys( $this->groupPermissions ),
            array_keys( $this->groupInheritance )
        );
        foreach ( $groups as $group ) {
            if ( $this->groupHasPermission( $group, $permission ) ) {
                $allowedGroups[] = $group;
            }
        }
        return $allowedGroups;
    }
}