Permission
class Permission (View source)
Class Permission
This class handles permission checks for various actions.
Constants
| RESTRICTED_TYPES_FOR_CLIENT |
Record types that holders of zone_content_edit_own_as_client may not modify. |
| PERM_EDIT_NS_SUBZONE |
Permission that lets client-level editors manage NS records below the zone apex. |
Methods
Check whether the given record type is off-limits for a client-level editor.
Check whether a record type is off-limits inside a zone template.
Check whether a specific record is off-limits for a client-level editor.
Check whether a record is an NS record below the zone apex.
Localized error message for a restricted-record-type denial.
Details
static bool
isRecordTypeRestrictedForClient(string $type, string $permEdit)
Check whether the given record type is off-limits for a client-level editor.
Returns true only when the user is limited to zone_content_edit_own_as_client and the record type is one that requires a stronger edit permission.
static bool
isTemplateRecordTypeRestricted(string $type, string $permEdit)
Check whether a record type is off-limits inside a zone template.
Template records are written straight to the backend when a template is applied, so they never pass the record-level gates. LUA is held to a stricter standard than the client rule alone: it executes on the DNS server, and a template seeds it into every zone created from it, so it requires the standing to write one directly.
static bool
isRecordRestrictedForClient(string $type, string $permEdit, string|null $recordName = null, string|null $zoneName = null, bool $canEditSubzoneNs = false)
Check whether a specific record is off-limits for a client-level editor.
Same gate as isRecordTypeRestrictedForClient(), except that holders of zone_content_edit_ns_subzone may manage NS records below the zone apex. SOA and apex NS records stay restricted regardless of that permission.
static bool
isSubzoneNsRecord(string $type, string|null $recordName, string|null $zoneName)
Check whether a record is an NS record below the zone apex.
This is the record shape zone_content_edit_ns_subzone applies to; the caller supplies the permission check. Unknown names never qualify.
static string
restrictedRecordTypeMessage(string $type, string $action)
Localized error message for a restricted-record-type denial.
Each branch keeps its gettext string literal so xgettext can extract it into the translation catalog unchanged.
static string
getViewPermission($db, ConfigurationInterface $config)
Get view permission.
This method determines the user's permission to view content.
static string
getEditPermission($db, ConfigurationInterface $config)
Get edit permission.
This method determines the user's permission to edit content.
static string
getDeletePermission(PDO $db, ConfigurationInterface $config)
Get delete permission.
This method determines the user's permission to delete zones.