Permission
class Permission (View source)
Permission names and the record-type restrictions for client-level editors.
Constants
| RESTRICTED_TYPES_FOR_CLIENT |
Record types that holders of zone_content_edit_own_as_client may not modify. |
| PERM_EDIT_NS_SUBZONE |
Permission that lets client-level editors manage NS records below the zone apex. |
| PERM_ZONE_MASTER_ADD |
|
| PERM_ZONE_SLAVE_ADD |
|
| PERM_ZONE_CONTENT_VIEW_OWN |
|
| PERM_ZONE_CONTENT_EDIT_OWN |
|
| PERM_ZONE_META_EDIT_OWN |
|
| PERM_ZONE_CONTENT_VIEW_OTHERS |
|
| PERM_ZONE_CONTENT_EDIT_OTHERS |
|
| PERM_ZONE_META_EDIT_OTHERS |
|
| PERM_SEARCH |
|
| PERM_SUPERMASTER_VIEW |
|
| PERM_SUPERMASTER_ADD |
|
| PERM_SUPERMASTER_EDIT |
|
| PERM_USER_IS_UEBERUSER |
|
| PERM_USER_VIEW_OTHERS |
|
| PERM_USER_ADD_NEW |
|
| PERM_USER_EDIT_OWN |
|
| PERM_USER_EDIT_OTHERS |
|
| PERM_USER_PASSWD_EDIT_OTHERS |
|
| PERM_USER_EDIT_TEMPL_PERM |
|
| PERM_TEMPL_PERM_ADD |
|
| PERM_TEMPL_PERM_EDIT |
|
| PERM_ZONE_CONTENT_EDIT_OWN_AS_CLIENT |
|
| PERM_ZONE_TEMPL_ADD |
|
| PERM_ZONE_TEMPL_EDIT |
|
| PERM_API_MANAGE_KEYS |
|
| PERM_ZONE_DELETE_OWN |
|
| PERM_ZONE_DELETE_OTHERS |
|
| PERM_USER_ENFORCE_MFA |
|
| PERM_ZONE_DNSSEC_MANAGE_OWN |
|
| PERM_ZONE_LOGS_VIEW_OWN |
|
| PERM_ZONE_LOGS_VIEW_OTHERS |
|
| PERM_USER_LOGS_VIEW |
|
| PERM_GROUP_LOGS_VIEW |
|
| PERM_ZONE_METADATA_VIEW_OWN |
|
| PERM_ZONE_METADATA_VIEW_OTHERS |
|
| PERM_ZONE_OWNERSHIP_VIEW_OWN |
|
| PERM_ZONE_OWNERSHIP_VIEW_OTHERS |
|
| PERM_ZONE_CHANGE_REQUEST_OWN |
|
| PERM_ZONE_CHANGE_REQUEST_OTHERS |
|
| PERM_ZONE_CHANGE_APPROVE_OWN |
|
| PERM_ZONE_CHANGE_APPROVE_OTHERS |
|
| PERM_SERVER_STATUS_VIEW |
|
| ALL |
Every permission name known to perm_items, for validation and lint tooling. |
Methods
Check whether the given record type is off-limits for a client-level editor.
Check whether a record type is off-limits inside a zone template.
Check whether a specific record is off-limits for a client-level editor.
Check whether a record is an NS record below the zone apex.
Localized error message for a restricted-record-type denial.
Details
static bool
isRecordTypeRestrictedForClient(string $type, string $permEdit)
Check whether the given record type is off-limits for a client-level editor.
Returns true only when the user is limited to zone_content_edit_own_as_client and the record type is one that requires a stronger edit permission.
static bool
isTemplateRecordTypeRestricted(string $type, string $permEdit)
Check whether a record type is off-limits inside a zone template.
Template records are written straight to the backend when a template is applied, so they never pass the record-level gates. LUA is held to a stricter standard than the client rule alone: it executes on the DNS server, and a template seeds it into every zone created from it, so it requires the standing to write one directly.
static bool
isRecordRestrictedForClient(string $type, string $permEdit, string|null $recordName = null, string|null $zoneName = null, bool $canEditSubzoneNs = false)
Check whether a specific record is off-limits for a client-level editor.
Same gate as isRecordTypeRestrictedForClient(), except that holders of zone_content_edit_ns_subzone may manage NS records below the zone apex. SOA and apex NS records stay restricted regardless of that permission.
static bool
isSubzoneNsRecord(string $type, string|null $recordName, string|null $zoneName)
Check whether a record is an NS record below the zone apex.
This is the record shape zone_content_edit_ns_subzone applies to; the caller supplies the permission check. Unknown names never qualify.
static string
restrictedRecordTypeMessage(string $type, string $action)
Localized error message for a restricted-record-type denial.
Each branch keeps its gettext string literal so xgettext can extract it into the translation catalog unchanged.