diff --git a/module/Frontpage/src/Model/Page.php b/module/Frontpage/src/Model/Page.php index 1da4f7dbd2..329c69927f 100644 --- a/module/Frontpage/src/Model/Page.php +++ b/module/Frontpage/src/Model/Page.php @@ -201,6 +201,6 @@ public function toArray(): array */ public function getResourceId(): string { - return 'page' . $this->getId(); + return 'page'; } } diff --git a/module/Frontpage/src/Module.php b/module/Frontpage/src/Module.php index f93e9daaab..9697c19461 100644 --- a/module/Frontpage/src/Module.php +++ b/module/Frontpage/src/Module.php @@ -31,11 +31,8 @@ use Frontpage\Service\Page as PageService; use Frontpage\Service\Poll as PollService; use Psr\Container\ContainerInterface; -use RuntimeException; use User\Authorization\AclServiceFactory; -use function sprintf; - class Module { /** @@ -58,28 +55,7 @@ public function getServiceConfig(): array return [ 'factories' => [ // Services - AclService::class => static function ( - ContainerInterface $container, - $requestedName, - ?array $options = null, - ) { - $aclService = (new AclServiceFactory())->__invoke($container, $requestedName, $options); - - if ($aclService instanceof AclService) { - $pages = $container->get(PageMapper::class)->findAll(); - $aclService->setPages($pages); - - return $aclService; - } - - throw new RuntimeException( - sprintf( - 'Expected service of type %s, got service of type %s', - AclService::class, - $aclService::class, - ), - ); - }, + AclService::class => AclServiceFactory::class, FrontpageService::class => FrontpageServiceFactory::class, NewsService::class => NewsServiceFactory::class, PageService::class => PageServiceFactory::class, diff --git a/module/Frontpage/src/Service/AclService.php b/module/Frontpage/src/Service/AclService.php index 7f609e918e..a6c7a60e0e 100644 --- a/module/Frontpage/src/Service/AclService.php +++ b/module/Frontpage/src/Service/AclService.php @@ -4,23 +4,11 @@ namespace Frontpage\Service; -use Frontpage\Model\Page as PageModel; use Laminas\Permissions\Acl\Resource\GenericResource as Resource; +use User\Permissions\Assertion\IsAllowedToViewPage; class AclService extends \User\Service\AclService { - /** - * @param PageModel[] $pages - */ - public function setPages(array $pages): void - { - foreach ($pages as $page) { - $requiredRole = $page->getRequiredRole()->value; - $this->acl->addResource($page); - $this->acl->allow($requiredRole, $page, 'view'); - } - } - protected function createAcl(): void { parent::createAcl(); @@ -36,5 +24,7 @@ protected function createAcl(): void $this->acl->allow('user', 'infimum', 'view'); $this->acl->allow('user', 'poll', ['vote', 'request']); $this->acl->allow('user', 'poll_comment', ['view', 'create', 'list']); + + $this->acl->allow(null, 'page', 'view', new IsAllowedToViewPage()); } } diff --git a/module/User/src/Permissions/Assertion/IsAfterMembershipEndedAndNotTagged.php b/module/User/src/Permissions/Assertion/IsAfterMembershipEndedAndNotTagged.php index 6e3d255065..7ffbd90fd6 100644 --- a/module/User/src/Permissions/Assertion/IsAfterMembershipEndedAndNotTagged.php +++ b/module/User/src/Permissions/Assertion/IsAfterMembershipEndedAndNotTagged.php @@ -21,13 +21,7 @@ class IsAfterMembershipEndedAndNotTagged implements AssertionInterface { /** - * Returns true if and only if the assertion conditions are met. - * - * This method is passed the ACL, Role, Resource, and privilege to which the authorization query applies. If the - * $role, $resource, or $privilege parameters are null, it means that the query applies to all Roles, Resources, or - * privileges, respectively. - * - * @param string|null $privilege + * @inheritDoc */ public function assert( Acl $acl, diff --git a/module/User/src/Permissions/Assertion/IsAllowedToViewPage.php b/module/User/src/Permissions/Assertion/IsAllowedToViewPage.php new file mode 100644 index 0000000000..88ec425ff9 --- /dev/null +++ b/module/User/src/Permissions/Assertion/IsAllowedToViewPage.php @@ -0,0 +1,35 @@ +getRequiredRole()->value; + + return $role->getRoleId() === $requiredRole || $acl->inheritsRole($role, $requiredRole); + } +} diff --git a/module/User/src/Permissions/Assertion/IsCreator.php b/module/User/src/Permissions/Assertion/IsCreator.php index 19a43d3dab..7db061a543 100644 --- a/module/User/src/Permissions/Assertion/IsCreator.php +++ b/module/User/src/Permissions/Assertion/IsCreator.php @@ -18,13 +18,7 @@ class IsCreator implements AssertionInterface { /** - * Returns true if and only if the assertion conditions are met. - * - * This method is passed the ACL, Role, Resource, and privilege to which the authorization query applies. If the - * $role, $resource, or $privilege parameters are null, it means that the query applies to all Roles, Resources, or - * privileges, respectively. - * - * @param string|null $privilege + * @inheritDoc */ public function assert( Acl $acl, diff --git a/module/User/src/Permissions/Assertion/IsCreatorOrOrganMember.php b/module/User/src/Permissions/Assertion/IsCreatorOrOrganMember.php index 42e8e83905..58f681b544 100644 --- a/module/User/src/Permissions/Assertion/IsCreatorOrOrganMember.php +++ b/module/User/src/Permissions/Assertion/IsCreatorOrOrganMember.php @@ -16,13 +16,7 @@ class IsCreatorOrOrganMember implements AssertionInterface { /** - * Returns true if and only if the assertion conditions are met. - * - * This method is passed the ACL, Role, Resource, and privilege to which the authorization query applies. If the - * $role, $resource, or $privilege parameters are null, it means that the query applies to all Roles, Resources, or - * privileges, respectively. - * - * @param string|null $privilege + * @inheritDoc */ public function assert( Acl $acl, diff --git a/module/User/src/Permissions/Assertion/IsOrganMember.php b/module/User/src/Permissions/Assertion/IsOrganMember.php index 057b14fb67..cd3d2b0364 100644 --- a/module/User/src/Permissions/Assertion/IsOrganMember.php +++ b/module/User/src/Permissions/Assertion/IsOrganMember.php @@ -20,13 +20,7 @@ class IsOrganMember implements AssertionInterface { /** - * Returns true if and only if the assertion conditions are met. - * - * This method is passed the ACL, Role, Resource, and privilege to which the authorization query applies. If the - * $role, $resource, or $privilege parameters are null, it means that the query applies to all Roles, Resources, or - * privileges, respectively. - * - * @param string|null $privilege + * @inheritDoc */ public function assert( Acl $acl, diff --git a/phpcs.xml.dist b/phpcs.xml.dist index 29259e6590..4323e06c3b 100644 --- a/phpcs.xml.dist +++ b/phpcs.xml.dist @@ -140,6 +140,7 @@ module/User/src/Service/Factory/UserFactory.php module/User/src/Permissions/Assertion/IsAfterMembershipEndedAndNotTagged.php + module/User/src/Permissions/Assertion/IsAllowedToViewPage.php module/User/src/Permissions/Assertion/IsCreator.php module/User/src/Permissions/Assertion/IsCreatorOrOrganMember.php module/User/src/Permissions/Assertion/IsOrganMember.php