UserPermissionReadInterface
interface UserPermissionReadInterface (View source)
Read access to what a user may do: permissions, uberuser status, template grants and zone ownership.
Methods
Get all permissions for a specific user
Check if a user has admin permissions
Check whether a permission template grants the uberuser permission
Names of the permissions a permission template grants
Id of the permission template with exactly this name, accent-exact so an IdP-asserted claim cannot map to a look-alike template.
Resolve every permission id carrying a given name
Check if a specific user is an uberuser
Count total number of uberusers (super admins) in the system
Whether removing or demoting this user would leave no active uberuser.
Whether a group the user belongs to grants the super admin permission, so changing the user's own template cannot take it away.
How many active super admins would remain once $change is written. Inside an open transaction it locks the active super admin rows first, as isLastUberuser() does.
Ids of every user holding the ueberuser permission directly or through a group.
Check if a user owns a zone directly or via group membership
Ids of the groups the user is a member of
Canonical ids of the zones the user owns directly or through any group
Canonical ids of the zones the user owns directly, without group grants; each zone once however many owner rows it has
getDirectlyOwnedZoneIds() counted for many users in one query
Details
array
getUserPermissions(int $userId)
Get all permissions for a specific user
bool
hasAdminPermission(int $userId)
Check if a user has admin permissions
bool
templateGrantsUberuser(int $permTemplId)
Check whether a permission template grants the uberuser permission
array
getTemplatePermissionNames(int $permTemplId)
Names of the permissions a permission template grants
int|null
findPermissionTemplateIdByName(string $name)
Id of the permission template with exactly this name, accent-exact so an IdP-asserted claim cannot map to a look-alike template.
array
getPermissionIdsByName(string $name)
Resolve every permission id carrying a given name
perm_items.name has no unique constraint, so a name can map to several rows and all of them grant the permission.
bool
isUberuser(int $userId)
Check if a specific user is an uberuser
int
countUberusers()
Count total number of uberusers (super admins) in the system
bool
isLastUberuser(int $userId)
Whether removing or demoting this user would leave no active uberuser.
Inside an open transaction it locks the active uberuser rows first, so callers that check and then write in one transaction cannot race each other.
bool
holdsUberuserThroughGroup(int $userId)
Whether a group the user belongs to grants the super admin permission, so changing the user's own template cannot take it away.
int
countUberusersAfter(UberuserChange $change)
How many active super admins would remain once $change is written. Inside an open transaction it locks the active super admin rows first, as isLastUberuser() does.
array
getAdminUserIds()
Ids of every user holding the ueberuser permission directly or through a group.
bool
userOwnsZone(int $userId, int $domainId)
Check if a user owns a zone directly or via group membership
array
getUserGroupIds(int $userId)
Ids of the groups the user is a member of
array
getUserOwnedZoneIds(int $userId)
Canonical ids of the zones the user owns directly or through any group
array
getDirectlyOwnedZoneIds(int $userId)
Canonical ids of the zones the user owns directly, without group grants; each zone once however many owner rows it has
array
countDirectlyOwnedZones(array $userIds)
getDirectlyOwnedZoneIds() counted for many users in one query