feat: align role assignment logic with myep-team
This commit is contained in:
Björn Fromme
+174
-30
@@ -5,11 +5,17 @@ declare(strict_types=1);
|
||||
namespace App\Security;
|
||||
|
||||
/**
|
||||
* The roles this application knows about.
|
||||
* The roles this application knows about, and the policy that assigns them.
|
||||
*
|
||||
* Roles are stored as plain strings in the User::$roles JSON column and consumed as strings
|
||||
* by #[IsGranted], the voters and security.yaml's role_hierarchy, so they are constants
|
||||
* rather than an enum.
|
||||
*
|
||||
* The governing rule: the BusPro CRM is the source of truth. It may nominate, but never grant,
|
||||
* an administrative role — a nomination is stored as a marker (ROLE_X_PENDING) that grants
|
||||
* nothing until an administrator approves it in /admin/user. The CRM's word alone is enough to
|
||||
* take a role away, never to hand it out, and an administrator's word alone is enough for
|
||||
* neither.
|
||||
*/
|
||||
final class Role
|
||||
{
|
||||
@@ -27,6 +33,14 @@ final class Role
|
||||
public const GROUPS_ADMIN = 'ROLE_GROUPS_ADMIN';
|
||||
public const GROUPS_MANAGER = 'ROLE_GROUPS_MANAGER';
|
||||
|
||||
/**
|
||||
* Appended to an administrative role to mark it as claimed by the CRM but not yet approved.
|
||||
* Markers live in the same column as the real roles and are handed to Symfony along with
|
||||
* them, but nothing references them: no access_control rule, no role_hierarchy entry and no
|
||||
* voter. Always ask effectiveOnly() when the question is what an account may actually do.
|
||||
*/
|
||||
public const PENDING_SUFFIX = '_PENDING';
|
||||
|
||||
/**
|
||||
* The roles that are actually assigned to accounts. ROLE_USER is left out because every
|
||||
* account has it implicitly (see User::getRoles()) and it is never stored.
|
||||
@@ -44,37 +58,54 @@ final class Role
|
||||
];
|
||||
|
||||
/**
|
||||
* Roles that are never taken over from BusProNet. Many people can edit CRM selections in
|
||||
* the BusPro backend, so these are granted by an administrator in /admin/user only.
|
||||
* Roles the CRM grants outright. ROLE_CUSTOMER is never claimed by BusPro — it is the
|
||||
* fallback for an account left without any effective role, and exclusive with the others.
|
||||
*
|
||||
* @var string[]
|
||||
*/
|
||||
public const PRIVILEGED = [
|
||||
public const UNCONDITIONAL = [
|
||||
self::TEAMER,
|
||||
self::CUSTOMER,
|
||||
];
|
||||
|
||||
/**
|
||||
* Roles the CRM only nominates for. Many people can edit CRM selections in the BusPro
|
||||
* backend, so honouring these directly would let anybody make themselves an administrator.
|
||||
*
|
||||
* @var string[]
|
||||
*/
|
||||
public const ADMINISTRATIVE = [
|
||||
self::ADMIN,
|
||||
self::MANAGER,
|
||||
self::HOUSE_MANAGER,
|
||||
self::GROUPS_ADMIN,
|
||||
self::GROUPS_MANAGER,
|
||||
];
|
||||
|
||||
/**
|
||||
* Reduces the roles derived from BPN CRM attributes to the ones we accept from there.
|
||||
* Roles nobody may approve for their own account. ROLE_ADMIN outranks every check in this
|
||||
* application, including the approval surface itself, so it always takes a second
|
||||
* administrator. The remaining administrative roles grant less than what an approver
|
||||
* already holds, so requiring a second pair of eyes for them would only lock out the
|
||||
* single-administrator case for no gain.
|
||||
*
|
||||
* Falls back to ROLE_CUSTOMER the way CrmAttributesResponseParser does, so an account
|
||||
* whose only selection was a privileged one does not end up without any role.
|
||||
*
|
||||
* @param string[] $roles
|
||||
*
|
||||
* @return string[]
|
||||
* @var string[]
|
||||
*/
|
||||
public static function filterImportable(array $roles): array
|
||||
{
|
||||
$importable = array_values(array_unique(array_diff($roles, self::PRIVILEGED)));
|
||||
public const SELF_APPROVAL_FORBIDDEN = [
|
||||
self::ADMIN,
|
||||
];
|
||||
|
||||
return [] === $importable ? [self::CUSTOMER] : $importable;
|
||||
/**
|
||||
* The marker standing for a role that the CRM claims but nobody has approved.
|
||||
*/
|
||||
public static function pending(string $role): string
|
||||
{
|
||||
return $role.self::PENDING_SUFFIX;
|
||||
}
|
||||
|
||||
/**
|
||||
* The roles actually assigned to an account — everything except the implicit ROLE_USER,
|
||||
* which User::getRoles() prepends and which is never stored.
|
||||
* The roles actually stored on an account — everything except the implicit ROLE_USER,
|
||||
* which User::getRoles() prepends and which is never stored. Markers included.
|
||||
*
|
||||
* @param string[] $roles
|
||||
*
|
||||
@@ -86,41 +117,148 @@ final class Role
|
||||
}
|
||||
|
||||
/**
|
||||
* The non-privileged half of a role set: what BpnAuthenticator syncs from the BusPro CRM.
|
||||
* The roles that actually grant something: no ROLE_USER, no markers.
|
||||
*
|
||||
* @param string[] $roles
|
||||
*
|
||||
* @return string[]
|
||||
*/
|
||||
public static function syncedOnly(array $roles): array
|
||||
public static function effectiveOnly(array $roles): array
|
||||
{
|
||||
return array_values(array_diff(self::assignedOnly($roles), self::PRIVILEGED));
|
||||
return array_values(array_filter(
|
||||
self::assignedOnly($roles),
|
||||
static fn (string $role): bool => false === self::isPending($role),
|
||||
));
|
||||
}
|
||||
|
||||
/**
|
||||
* The privileged half: what an administrator granted in /admin/user.
|
||||
* The markers on an account: administrative roles the CRM claims, awaiting approval.
|
||||
*
|
||||
* @param string[] $roles
|
||||
*
|
||||
* @return string[]
|
||||
*/
|
||||
public static function privilegedOnly(array $roles): array
|
||||
public static function pendingOnly(array $roles): array
|
||||
{
|
||||
return array_values(array_intersect($roles, self::PRIVILEGED));
|
||||
return array_values(array_filter($roles, static fn (string $role): bool => self::isPending($role)));
|
||||
}
|
||||
|
||||
/**
|
||||
* Reassembles a complete role set from its two owners. Both sides are filtered, so a
|
||||
* privileged role can never arrive through the synced half and vice versa.
|
||||
* The roles behind those markers, labelled — what an approver acts on.
|
||||
*
|
||||
* @param string[] $synced
|
||||
* @param string[] $privileged
|
||||
* @param string[] $roles
|
||||
*
|
||||
* @return array<string, string> role => label
|
||||
*/
|
||||
public static function nominatedFrom(array $roles): array
|
||||
{
|
||||
$labels = self::labels();
|
||||
$nominated = [];
|
||||
|
||||
foreach (self::pendingOnly($roles) as $marker) {
|
||||
$role = self::realRole($marker);
|
||||
|
||||
if (\in_array($role, self::ADMINISTRATIVE, true)) {
|
||||
$nominated[$role] = $labels[$role];
|
||||
}
|
||||
}
|
||||
|
||||
return $nominated;
|
||||
}
|
||||
|
||||
/**
|
||||
* The whole policy, applied on every login.
|
||||
*
|
||||
* 1. revoke everything the CRM no longer claims — granted roles and markers alike, which is
|
||||
* what makes BusPro the source of truth;
|
||||
* 2. grant the unconditional roles it claims;
|
||||
* 3. mark every administrative role it claims that is not granted already. This runs after
|
||||
* the revocation, so a role just revoked is not immediately marked again, and an approved
|
||||
* role is never marked a second time;
|
||||
* 4. fall back to ROLE_CUSTOMER when nothing effective is left.
|
||||
*
|
||||
* Nothing here can raise a privilege: step 3 only ever produces markers.
|
||||
*
|
||||
* @param string[] $storedRoles
|
||||
* @param string[] $claimedRoles what the CRM reports
|
||||
*
|
||||
* @return string[]
|
||||
*/
|
||||
public static function combine(array $synced, array $privileged): array
|
||||
public static function sync(array $storedRoles, array $claimedRoles): array
|
||||
{
|
||||
return array_values(array_unique([...self::syncedOnly($synced), ...self::privilegedOnly($privileged)]));
|
||||
$claimed = array_values(array_intersect(self::ALL, array_unique($claimedRoles)));
|
||||
|
||||
$roles = array_values(array_filter(
|
||||
self::assignedOnly($storedRoles),
|
||||
static fn (string $role): bool => \in_array(self::realRole($role), $claimed, true),
|
||||
));
|
||||
|
||||
foreach (array_intersect($claimed, self::UNCONDITIONAL) as $role) {
|
||||
$roles[] = $role;
|
||||
}
|
||||
|
||||
foreach (array_intersect($claimed, self::ADMINISTRATIVE) as $role) {
|
||||
if (false === \in_array($role, $roles, true)) {
|
||||
$roles[] = self::pending($role);
|
||||
}
|
||||
}
|
||||
|
||||
return self::withCustomerFallback(array_values(array_unique($roles)));
|
||||
}
|
||||
|
||||
/**
|
||||
* Turns a marker into the role it stands for. Refuses anything the account is not nominated
|
||||
* for, so neither a hand-crafted request nor a claim revoked while the confirmation dialog
|
||||
* was open can grant a role the CRM never reported.
|
||||
*
|
||||
* @param string[] $storedRoles
|
||||
*
|
||||
* @return string[]
|
||||
*
|
||||
* @throws \InvalidArgumentException when $role is not pending on this account
|
||||
*/
|
||||
public static function approve(array $storedRoles, string $role): array
|
||||
{
|
||||
$roles = self::assignedOnly($storedRoles);
|
||||
|
||||
if (false === \in_array(self::pending($role), $roles, true)) {
|
||||
throw new \InvalidArgumentException(sprintf('The role "%s" is not pending approval.', $role));
|
||||
}
|
||||
|
||||
$roles = array_diff($roles, [self::pending($role)]);
|
||||
$roles[] = $role;
|
||||
|
||||
return self::withCustomerFallback(array_values(array_unique($roles)));
|
||||
}
|
||||
|
||||
/**
|
||||
* Everybody without an effective role is a customer, and nobody with one is. The fallback is
|
||||
* a fallback, not a baseline — ROLE_CUSTOMER and ROLE_TEAMER are mutually exclusive on
|
||||
* purpose.
|
||||
*
|
||||
* @param string[] $roles
|
||||
*
|
||||
* @return string[]
|
||||
*/
|
||||
private static function withCustomerFallback(array $roles): array
|
||||
{
|
||||
if ([] === array_diff(self::effectiveOnly($roles), [self::CUSTOMER])) {
|
||||
return array_values(array_unique([...$roles, self::CUSTOMER]));
|
||||
}
|
||||
|
||||
return array_values(array_diff($roles, [self::CUSTOMER]));
|
||||
}
|
||||
|
||||
private static function isPending(string $role): bool
|
||||
{
|
||||
return str_ends_with($role, self::PENDING_SUFFIX);
|
||||
}
|
||||
|
||||
private static function realRole(string $role): string
|
||||
{
|
||||
return self::isPending($role)
|
||||
? substr($role, 0, -\strlen(self::PENDING_SUFFIX))
|
||||
: $role;
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -128,7 +266,7 @@ final class Role
|
||||
*/
|
||||
public static function labels(): array
|
||||
{
|
||||
return [
|
||||
$labels = [
|
||||
self::ADMIN => 'Administration',
|
||||
self::MANAGER => 'Manager:in',
|
||||
self::TEAMER => 'Teamer:in',
|
||||
@@ -137,5 +275,11 @@ final class Role
|
||||
self::GROUPS_ADMIN => 'Preisrechner Admin',
|
||||
self::GROUPS_MANAGER => 'Preisrechner',
|
||||
];
|
||||
|
||||
foreach (self::ADMINISTRATIVE as $role) {
|
||||
$labels[self::pending($role)] = $labels[$role].' (nicht freigeschaltet)';
|
||||
}
|
||||
|
||||
return $labels;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user